TikTok Pays Up: COPPA Just Got Teeth

By Harvey Specter Jr. | Law, Business & Power Correspondent

---

$400 million. Say that number slowly. Not because it's abstract — because it isn't. The U.S. Department of Justice just extracted that figure from TikTok in a settlement over violations of the Children's Online Privacy Protection Act, known as COPPA, and called it "one of the largest recoveries ever obtained" under the statute. The Department of Justice doesn't say things like that to fill press releases. They say them to send messages. This one arrived with the volume turned all the way up.

Here is what COPPA actually does, stripped of the legalese: if your platform collects personal data from children under thirteen, you need verifiable parental consent before you collect a single byte. Not implied consent. Not a terms-of-service checkbox that a twelve-year-old clicks through in four seconds. Verified. Documented. Defensible in federal court. TikTok, according to the DOJ's case, collected anyway — behavioural data, usage patterns, identifiers — and built engagement loops around children's profiles while the consent framework was either absent or cosmetic. The algorithm didn't care how old you were. Neither, apparently, did the compliance team.

What makes this settlement significant isn't the number. It's the acceleration. COPPA has existed since 1998. For most of that life it was treated as background noise by platforms — a statute with enforcement too slow and penalties too small to interrupt a growth strategy. The Federal Trade Commission fined YouTube $170 million in 2019, and the industry absorbed it. It fined Epic Games $275 million in 2022 over Fortnite, and the industry adjusted. Now the DOJ — not just the FTC, the full weight of the Department of Justice — brings $400 million against a single platform for children's data violations, and the calculus changes. This is no longer a compliance cost. This is an existential risk line item.

The European dimension matters here, and it matters to anyone operating in Malta or across the EU. COPPA is American statute, but the General Data Protection Regulation — Regulation (EU) 2016/679, in force since May 2018 — runs parallel and in some respects further. Article 8 of the GDPR sets the age of digital consent at sixteen across the EU, with member states given discretion to lower it to thirteen. Malta set it at thirteen. The mechanism is the same as COPPA — parental consent is required below the threshold — but the enforcement architecture is different. Under the GDPR, fines reach 4% of global annual turnover. For a platform the size of TikTok, 4% of global turnover makes $400 million look like a rounding error. The Irish Data Protection Commission, which serves as TikTok's lead supervisory authority in the EU by virtue of its European headquarters location, has active investigations open. The DOJ settlement didn't close anything on this side of the Atlantic. It opened a door.

What I find more interesting than the settlement itself is the structural problem it exposes. TikTok's defence was never that COPPA didn't apply. The argument, in various forms, was about the difficulty of age verification at scale — that a platform processing hundreds of millions of users cannot reliably distinguish a thirteen-year-old from a sixteen-year-old from a twenty-five-year-old without collecting more data than the law permits it to collect for verification purposes. This is a real tension. The UK's Age Appropriate Design Code, which came into force in 2020 and directly inspired similar EU thinking, attempts to resolve it by requiring privacy-by-default for any user who might be a child — not just confirmed children. If there's a reasonable likelihood, you treat them as a minor. That standard, increasingly, is the direction travel across every jurisdiction that takes children's data seriously.

Years before I understood any of this in legal terms, I understood it in practical ones. I grew up around people who treated rules as obstacles until the obstacles became consequences. The platforms that built engagement systems for children understood the rules. They treated them as obstacles. The $400 million is the consequence arriving.

For any business operating a platform, an app, or a service that touches users who could be minors — and in Malta, that includes hospitality tech, educational software, community platforms, even loyalty programmes that families use — the TikTok settlement is not a story about America. It is a template