Duane Morris Takeaway: This week’s episode features Duane Morris partner Jerry Maatman and special counsel Justin Donoho and Tyler Zmick with their analysis of significant settlement agreement resolving a DOJ enforcement lawsuit against TikTok under the Children’s Online Privacy Protection Act (“COPPA”).
Check out today’s episode and subscribe to our show from your preferred podcast platform: Spotify, Amazon Music, Apple Podcasts, Podcast Index, Tune In, Listen Notes, iHeartRadio, Deezer, and YouTube.
Episode Transcript
Jerry Maatman: Hello everyone, and thank you for being here again for our next episode of the Class Action Weekly Wire. I’m Jerry Maatman, a partner at Duane Morris, and joining me today are my colleagues Justin and Tyler. Thanks so much for being here today on our podcast.
Justin Donoho: Glad to be here, Jerry.
Tyler Zmick: Thank you for having me, Jerry.
Jerry: Today, we’re discussing one of the most significant privacy enforcement settlements we’ve seen in years. TikTok has agreed to pay $400 million to resolve allegations that it violated the Children’s Online Privacy Protection Act, known as COPPA, by collecting personal information from children under the age of 13, without allegedly complying with federal regulations and requirements. According to the U.S. Department of Justice, this is one of the largest recoveries ever, in terms of monies collected under the COPPA. It’s also accompanied by a separate effort by the government to vacate a 2019 consent decree that had governed the predecessor of TikTok for years. Justin, let’s start with the headline. What happened here in this litigation?
Justin: Thank you, Jerry. The government announced a $400 million settlement with TikTok to resolve allegations that the company knowingly allowed children under 13 to create accounts on the platform and collected personal information from those users without obtaining parental consent as required by COPPA. The settlement reportedly requires TikTok to pay $300 million immediately, and another $100 million if, and when, a federal court vacates a consent decree that was entered against Musical.ly, TikTok’s predecessor, in 2019. The settlement resolves a lawsuit that the DOJ filed in 2024 following a referral from the Federal Trade Commission.
Jerry: So, I take it this is not a new issue that TikTok has faced on the litigation front?
Justin: No, not at all. This really represents the latest chapter in a dispute that goes back nearly a decade. The original allegations involved Musically, the video sharing platform that TikTok acquired and eventually merged into its current product. The government has consistently maintained that the children’s privacy and data collection practices were at the center of both the 2019 case and the more recent litigation.
Jerry: Tyler, if you look at the allegations at issue in this lawsuit. What exactly was the Department of Justice asserting?
Tyler: So, the government’s allegations were serious and extensive. The DOJ claimed that TikTok knowingly permitted large numbers of children under the age of 13 to create standard accounts and interact on the primary TikTok platform. According to the DOJ, TikTok collected various forms of personal data from those users without notifying their parents or obtaining their parents’ consent, as required under COPPA. The government also alleged that TikTok’s efforts to identify underage users were ineffective, and basically that the company failed to delete the children’s accounts and information when the parents requested it.
Jerry: I take it, then, that these allegations overlapped with obligations in the 2019 consent decree, and so that prior order was at issue here, too.
Tyler: That’s exactly right, Jerry, and that’s what made the later enforcement action so notable. The government claimed that despite the 2019 settlement and the compliance obligations imposed by that agreement, deficiencies remained in TikTok systems for identifying children under 13 and preventing the unlawful data collection. So, from a regulator’s perspective, allegations involving children’s data are really one of the most serious privacy issues a company can face. COPPA has been a major enforcement priority for years, and when regulators believe a company has repeatedly failed to comply with the law, penalties can become significant.
Jerry: I take it that helps explain, at least in part, how we got from a $5.7 million settlement with the consent decree in 2019 to a $400 million settlement in 2026. And the settlement certainly reflects and manifests the seriousness of the alleged conduct at issue and the government’s continued focus on children’s privacy protections. Let’s turn to another aspect, which I think is the most interesting one of the story. Justin, it seems very unusual for the government to collect $400 million, and at the same time tell a court that an existing consent decree should be removed. Why would they do that, and what was at issue there?
Justin: Thanks, Jerry. Yes, the government’s position is that the circumstances today are dramatically different from those that existed when the original consent decree was entered in 2019. In the motion filed with the court, the DOJ emphasized that the original decree addressed conduct involving Musical.ly, and predecessor entities that existed years before the current structure of TikTok’s U.S. operations. The government also points to major changes in ownership and corporate governance. According to the filing, TikTok USA’s operations are now controlled by a newly formed U.S.-based entity known as TikTok US, following a restructuring and divestiture process. The government argues that this represents a fundamentally different organization than the one that engaged in the historical conduct that led to the original settlement.
Jerry: I guess it underscores the notion that no corporation is static, change is inevitable, and the same as in the law, and here’s an argument about how something should be modified or adjusted, just seven years after the 2019 decree.
Justin: Yes, that’s exactly the DOJ’s argument. They contend that the consent decree imposes requirements that go beyond the underlying statutory requirements contained in the COPPA itself, and that continued enforcement is no longer necessary or equitable, given the changes that have occurred.
Jerry: A very seminal aspect of the agreement, however, is that the statement that TikTok remains subject to COPPA regardless of what happens to the consent decree.
Justin: Correct. The DOJ makes clear that vacating the decree would not eliminate TikTok’s obligation to comply with federal privacy laws. According to the motion, TikTok would still be fully subject to the COPPA FTC enforcement authority, and future government actions if violations occur.
Jerry: Let’s talk about the broader issues and implications here. Tyler, what should corporate counsel and compliance professionals take away from this settlement, and what do you see as the most important lesson here?
Tyler: Well, the first takeaway here is simple: privacy enforcement remains a top regulatory priority. A $400 million settlement sends a powerful message that regulators view children’s privacy as an area warranting substantial penalties when they believe that companies fail to comply with the law. The second takeaway is that compliance programs matter. The government’s court filings repeatedly highlight measures that TikTok says it implemented after the original settlement, including enhanced age verification systems, artificial intelligence tools designed to identify underage users, human moderation teams, and efforts to remove accounts that appear to belong to children under the age of 13.
Jerry: I guess, in other words, regulators are looking beyond written policies and increasingly expect organizations to implement audit, operational controls, technological safeguards, monitor systems, and have a governance framework that demonstrates actual compliance in practice. A company, for instance, can’t simply point to an employee handbook and say, “We have a policy.” Governmental regulators want evidence that compliance controls are functioning in effect and have a causative impact on behavior. What about for companies involved in mergers, acquisitions, and restructuring, which certainly seem to be the backdrop here in the difference between 2019 consent decree and the 2026 settlement?
Tyler: That is another important lesson. Businesses often assume that changing ownership structures can eliminate historical regulatory concerns. This settlement shows that regulatory obligations and scrutiny can follow a company for years. Successor entities may still need to address legacy issues, regulatory settlements, and historical compliance failures. At the same time, this settlement suggests that regulators may be willing to account for meaningful remediation efforts and significant organizational changes when evaluating future remedies.
Jerry: Before we sign off on this week’s episode, how about your final thoughts in this area?
Justin: I’ll start. Jerry, what stands out to me is that this case reflects a balance between accountability and remediation. The government obtained a substantial monetary recovery for alleged historical violations, while also recognizing that the company has undergone significant changes in ownership, management, compliance functions, and privacy practices. The settlement appears designed to achieve both of these objectives.
Tyler: From my point of view, the biggest lesson is that privacy compliance has evolved into a core enterprise risk management function. It’s no longer solely a legal issue. It’s also a governance issue. It’s a technology issue. And increasingly, it is a board-level issue. Organizations that collect consumer data, especially data involving kids, should expect regulators to closely scrutinize how they obtain consent, how they manage their personal information, how they verify user age, and how they respond to consumer requests.
Jerry: Well, thanks so much. Those are great insights from both of you. The settlement certainly is a story we’ll continue to follow, both on our blog and in the Class Action Weekly Wire, as the court considers the government’s request to vacate the 2019 consent decree and as companies continue to evaluate what this record-setting settlement means in terms of privacy compliance moving forward. So, thanks so much for being here today, both Justin and Tyler, and thanks to our listeners for tuning in.
Tyler: Thanks for having me, Jerry. Thank you, listeners.
Justin: Thanks, everybody. Thanks everyone for listening.