TikTok Is Paying an Extra $100 Million to Erase a 2019 Consent Decree

The first thing worth reading in this settlement is not the $400 million. It is the clause saying the money does not leave in one piece.

The $100 Million Arrives Only When an Old Order Is Erased

On August 21, 2026, the Justice Department announced a $400 million settlement with TikTok, ByteDance, and affiliated entities. Three hundred million is payable immediately. The other $100 million becomes due upon entry of a court order vacating the consent decree that sits on TikTok’s predecessor, Musical.ly. Musical.ly was the lip-sync app that became TikTok, and in February 2019 it settled with the Federal Trade Commission for $5.7 million, taking an order about how it handled children’s accounts along with the check. That order is still on the books.

A consent decree is a promise made in front of a court instead of a trial: the company agrees to do certain things, and the court keeps the paper. Once it exists, the nature of the next dispute changes. The question stops being whether a law was broken and becomes whether a promise was kept. The gap between having that page on file and having it erased was priced, in this settlement, at $100 million.

No vacatur has been entered yet. Because the second tranche is conditional, the document leaves room for the actual payment to stop at $300 million. The case sits in the U.S. District Court for the Central District of California, handled by the Civil Division’s Enforcement and Affirmative Litigation Branch on referral from the FTC.

$5.7 Million in 2019, $400 Million in 2026, Same Statute

Put the two figures side by side and the multiple is roughly seventy. Both rest on COPPA, the federal statute requiring verifiable parental consent before an operator collects personal information from a child under 13.

The complaint the Justice Department filed on August 2, 2024 dated the alleged conduct back to 2019. The years that elapsed while an order was already in force counted as exposure. This is the line most compliance budgets skip. Teams remember the first penalty as a ceiling, when the real determinant is how many years pass before somebody comes back.

Anyone shipping across jurisdictions carries more than one age line. GDPR Article 8 lets member states set the digital consent age anywhere from 13 to 16, and several picked 16. The UK’s Age Appropriate Design Code, in force since 2021, applies a separate set of design expectations to services likely to be accessed by children rather than to a fixed age. A single onboarding flow that satisfies the US number does not automatically satisfy any of these, and the divergence usually shows up in data retention rules rather than in the signup screen.

The Complaint Pointed at the Deletion Queue, Not the Signup Screen

The 2024 complaint made three claims. From 2019 onward, children under 13 were allowed to create regular accounts and to create, view, and exchange videos and messages with adults, while their personal information was collected and retained without notice to parents or parental consent. Inside Kids Mode, the pared-down version built for under-13 users, email addresses and other personal information were collected and kept anyway. And when parents found their children’s accounts and asked for deletion, those requests were frequently not honored, on top of internal policies for finding and deleting children’s accounts that the government called deficient and ineffectual.

The first two read as product design problems. The third is what moves a number. An age gate can be defended with a screenshot; a deletion queue cannot. Every request carries a timestamp, and so does whatever eventually got deleted, and both live in a ticketing system that becomes the other side’s exhibit. The government also alleged that TikTok failed to delete accounts and information belonging to users it knew were children. The hard part of that sentence is not whether they were children. It is the knowing.

Registration changes were on the list too. The complaint alleged that TikTok altered its signup policies in ways that made it harder to tell whether a user was old enough to join. A friction-reduction win in a growth review came back years later as a line in a federal pleading.

Count the Days Between a Deletion Request and the Deletion

If minors can reach your service, there is a number worth pulling this week: the distribution of turnaround times on account and data deletion requests. Skip the mean and look at the slowest five percent, then count how many requests that actually is. Litigation quotes the worst case, not the average.

Next, look at whether the moment of knowledge is logged. When information reaches the company that an account might belong to a minor, whether through support, an internal report, or automated detection, does that arrival get a timestamp? If it does, you can explain how many days passed before action. If it does not, the other side gets to decide when you knew.

Write down the reason whenever an age-related screen or policy changes. Removing a date-of-birth field for conversion looks like an improvement in a dashboard and reads differently in a pleading. The only thing standing between those two readings is the sentence somebody wrote at the time.

Old orders and settlements still sitting in the corporate file belong in the same review. Erasing one page of that kind was worth $100 million here.

The department’s own announcement notes that since the 2024 complaint, TikTok’s ownership, management, compliance functions, and privacy practices have changed substantially, and that protections for younger users were materially strengthened. That improvement appears to be reflected in the amount. The same release also states that the resolved claims are allegations only, with no determination of liability. Whether the last $100 million ever moves depends on a vacatur order that has not been entered.