$400 million for child data: What companies can learn from the TikTok case
The comparison in the USA shows why the protection of underage users should begin as early as the design of digital offerings.
400 million US dollars: This amount has been agreed upon by TikTok, ByteDance and the US Department of Justice in a case to protect the personal data of children. Although the case concerns US data protection law, the questions involved are also relevant for European companies:
Are our offerings used by minors? Do we know how old our users actually are? And do our processes take into account that personal data from children deserves special protection?
What happened on TikTok?
The US Department of Justice had already sued TikTok and ByteDance in 2024. The accusation: TikTok had enabled children under 13 to create regular accounts and collected and stored personal data without properly informing the parents and obtaining their consent.
According to the DOJ, this affected millions of children. Accounts in the so-called „Kids Mode“ were also reportedly processed, among other things, email addresses, IP addresses, device identifiers, and other information. Furthermore, the DOJ accused TikTok of lacking processes for identifying and deleting child accounts. (Source: U.S. Department of Justice, lawsuit of August 2, 2024).
In August 2026, the proceedings were now concluded through a settlement. TikTok will pay $300 million immediately and an additional $100 million once the earlier consent decree against TikTok’s predecessor, Musical.ly, is lifted. The DOJ describes the settlement as one of the largest payments ever obtained in a proceeding under the U.S. Children’s Online Privacy Protection Act (COPPA).
Important for a proper classification: This is not a judgment and it is not a legally determined data privacy violation. The settlement resolves the allegations; the DOJ explicitly states that no liability has been established.
The real problem: Children do not always give their correct age
A particularly interesting aspect of the original lawsuit concerns the determination of age.
According to the DOJ’s allegations, TikTok employees knew that children were providing false information when age verification was performed. At the same time, TikTok is said to have had access to additional technical capabilities to assess users’ age based on their behavior. However, these were not properly used to identify children under 13 on the regular platform and remove their accounts.
This is where the case becomes interesting outside the USA as well. A simple question like „How old are you?“ This does not necessarily solve the problem of child data protection. Companies must instead address the question of who is actually using their offering and what protective measures are appropriate given the specific offering.
What applies in Europe?
The GDPR also places special importance on the protection of children.
Article 8 of the GDPR is particularly relevant when an information society service is offered directly to a child and the processing of personal data is based on consent pursuant to Article 6(1)(a) of the GDPR.
Basically, the GDPR sets an age limit of 16 years for this. The member states can lower this limit to up to 13 years. In Germany, the age limit of 16 years has been maintained.
If the child is younger, processing based on consent is only lawful if and insofar as it has been granted or approved by the holder of parental responsibility.
And the GDPR goes one step further: The controller must, taking into account the available technology, make reasonable efforts to verify that the consent has actually been given or approved by the person with parental responsibility.
Thus, the practical question arises here as well:
How reliable is our age and consent process?
Child data protection does not start with the checkbox
The TikTok case therefore highlights a fundamental problem. It is not always sufficient to query a birth date in a registration process and then assume that minors are excluded or that necessary consents have been obtained. Companies should, instead, take into account the following when designing a digital offering:
Especially in the case of offers that are attractive to children and young people due to their design or content, the answer should not be sought until complaints have been received.
What companies can learn from the TikTok case
The comparison cannot be applied to European companies in a strictly equivalent way from a legal perspective. COPPA and GDPR are different regulations.
The practical message, however, goes beyond the specific US case:
Anyone who has to realistically expect minors to be users of their offering should understand child data protection as part of the product and process design – and not just as a question for the privacy policy.
These include a deliberate decision regarding the target audience, appropriate age mechanisms, appropriate legal frameworks, and processes for handling the data of underage users. The TikTok case vividly demonstrates the extent to which this issue can be addressed if these questions are not asked until years later.
FAQ
Has TikTok received a $400 million data protection fine?
Not in the sense of a court-ordered fine. TikTok and ByteDance have reached a settlement with the US Department of Justice for a total of 400 million US dollars. No liability was established in court.
What was TikTok accused of?
The DOJ accused TikTok of, among other things, collecting and storing personal data from children under 13 without the required information and consent from parents, and failing to adequately identify and delete children's accounts.
Is there a fixed age limit in Germany for data protection consent forms?
Article 8 of the GDPR provides for a special regulation for certain consent-based processing of information society services offered directly to children. In Germany, the relevant age limit is 16 years. However, this does not mean that persons under 16 cannot generally consent to data protection under the law – Article 8 applies to this particular situation.
Is a query of the date of birth sufficient?
This cannot be answered in a general way. Article 8(2) of the GDPR requires, within its scope of application, reasonable efforts to verify parental consent or authorization, taking into account the available technology.
What do companies need to consider when dealing with the personal data of minors?
Companies should in particular consider whether their offering is also used by minors, what data is processed, on what legal basis this takes place, and what role age plays in this. In addition, processes for age verification, consent, deletion, rights of the data subject, and understandable privacy information should be provided.
What can companies learn from the TikTok case?
This case shows that children's data protection should be taken into account already during the design of digital offerings. Anyone who has to realistically expect minors as users should include the target group, age mechanisms, legal bases, and the handling of personal data of minors from the very beginning in product and process design.
