TikTok: the conditional $100 million inside the 400

What the settlement actually says

On 21 August, the Department of Justice announced a settlement with TikTok and ByteDance over allegations involving data of children under 13 and compliance with COPPA.

The structure is precise: $300 million is payable; a further $100 million would follow if the court grants TikTok’s request to vacate the earlier Musical.ly injunction. Writing only “$400 million fine” would erase that condition.

The release also describes controls TikTok says it has already improved. They should not be recast as new undertakings imposed by the settlement. There is no determination of liability.

The payment structure belongs ahead of the headline: $300 million is immediately payable. The remaining $100 million becomes payable only when a court vacates the earlier injunction against Musical.ly.

The complaint alleged that children could create regular accounts, data was collected or retained without adequate notice and parental consent, and some deletion requests were mishandled. TikTok disputed the claims; settlement avoids a judicial determination.

Why Europe should watch

COPPA is US law. The design problem is not. The GDPR gives children special protection; the Digital Services Act adds safety duties and restricts, among other things, certain profiling-based advertising to minors.

Age assurance must be proportionate: strong enough to protect and restrained enough not to build a fresh surveillance database.

A date-of-birth field is not a barrier; it is a door with a sign on it. Age assurance should match the risk without becoming a reason to collect everyone’s identity.

The EDPB emphasises necessity, proportionality, data minimisation, purpose limitation, security and effective redress. Protecting minors does not justify building a new database about every user.