SELINA.ai
Sign in
tiktok data privacy settlement

TikTok Data Privacy Settlement: What Actually Happened, What Didn't, and Why It Matters

Two different settlements. Two different legal theories. One brand name generating a wall of confused search queries. The latest TikTok data privacy settlement, a $400 million deal with the DOJ announced on August 21, 2026, is a regulatory penalty for violating children's privacy law. It is not the same case as the older $92 million consumer payout. There is no claim form for you to fill out. If you're here because you got a check for $0.91 and want to know what's going on, that's a different story, and we'll cover it too. This post disambiguates everything, then talks about what the underlying failures actually tell you about how platforms handle your data.

Key Takeaways

What Is the $400 Million TikTok Settlement With the DOJ?

It is a regulatory penalty. On August 21, 2026, TikTok and parent company ByteDance agreed to pay $400 million to settle allegations that they violated the Children's Online Privacy Protection Act (COPPA) by collecting personal data from users under 13 without parental consent. The DOJ described it as one of the largest recoveries ever secured in a COPPA enforcement action.

The payment structure matters if you're trying to understand the legal mechanics. $300 million is due immediately. The remaining $100 million becomes payable once a court vacates a 2019 consent decree that was entered against Musical.ly, the short-video app ByteDance acquired in 2017 and later rebranded as TikTok. That earlier consent decree was itself a COPPA enforcement action, so the lineage here is long.

The underlying lawsuit was filed by the DOJ in 2024, alleging systemic failures in how TikTok handled children's data. Not a one-off bug. Not a rogue employee. The allegation was that the platform's consent architecture for minors was structurally inadequate.

The DOJ noted that TikTok has made "significant changes" to its ownership, management, compliance functions, and privacy practices since the lawsuit was filed. Whether those changes are sufficient is a separate question. What's clear is that the settlement closes a specific regulatory exposure. It does not create a claims process for individual users.

Can You File a Claim for the $400 Million Settlement?

No. This is a government enforcement action. The $400 million goes to the U.S. Treasury, not to a settlement fund with a claim form and a per-user payout. If you see a website telling you to file a claim for the "new TikTok settlement," it is either confused or trying to harvest your information. The irony of a privacy settlement generating phishing opportunities is not lost on anyone building in this space.

What About the $92 Million Settlement? Why Am I Getting Tiny Checks?

The $92 million settlement is a completely separate case. It resolved a consumer class action alleging that TikTok collected and profited from private user information, including facial recognition data and geolocation data, without adequate consent. The legal theory centered on state biometric privacy laws (particularly Illinois' BIPA) and general data-privacy claims.

That case reached final settlement approval in 2022. The claim deadline passed years ago. You cannot file a new claim.

But here's what's generating confusion: in late 2025 and into 2026, many past claimants started receiving small supplemental payments, sometimes checks as low as $0.91, representing a final distribution of residual funds. These are legitimate. They are not a scam (though the amount can feel like one). They are the tail end of a fund that's been winding down for years.

If you never filed a claim before the deadline, these checks are not coming to you. If you did file and received an initial payment, the sub-dollar check is likely your share of whatever remained after administrative costs and uncashed-check redistribution.

Is There a Third TikTok Privacy Case Still Active?

Yes. A federal judge ruled that TikTok must face claims alleging it illegally harvested user information through its in-app browser. The court found that this conduct falls outside the scope of the $92 million biometric settlement, meaning those earlier releases don't protect TikTok from this set of allegations. The theory here is different: it's about what happens when you tap a link inside TikTok and the app routes you through its own embedded browser rather than your device's default. The claim is that this browser was used to track keystrokes, form inputs, and browsing activity without disclosure.

This case is still proceeding. If it reaches a settlement with a consumer fund, there would be a claim process. As of August 2026, it hasn't reached that point.

How Does TikTok's U.S. Ownership Restructuring Fit In?

It is related but legally independent. On January 22, 2026, the long-running "divest-or-ban" saga concluded with the formation of TikTok USDS Joint Venture LLC, a new entity that is 80.1% American-owned. Three managing investors each hold approximately 15%: Oracle, Silver Lake, and MGX. ByteDance retains a stake just under 20%.

The structural detail that matters most for privacy: Oracle serves as both an equity holder and the designated security partner, responsible for auditing and enforcing national-security compliance. Concretely, Oracle is supposed to ensure that ByteDance cannot access U.S. user data.

Many users conflate "TikTok privacy settlement" with "TikTok ban/sale" news. They are different threads, but they share a root cause: sustained, credible concerns that the platform's data practices were not adequate for the volume and sensitivity of information it collects.

Why Does a Single Platform Have This Many Privacy Cases?

Because "privacy" is not one problem. It's at least two distinct failure modes, each requiring different technical controls.

Failure mode one: consent and age-gating architecture. The $400 million COPPA case targets the platform's inability to reliably identify users under 13 and gate their data collection accordingly. This is a systems-design problem. Age verification on the open internet is genuinely hard, but COPPA has been law since 1998. If your product collects data from children without verifiable parental consent, you've built the wrong system. The penalty is now denominated in nine figures.

Failure mode two: unauthorized collection of biometric and behavioral data. The $92 million case (and the ongoing in-app browser litigation) targets what data TikTok collected from all users, not just children, and whether it had consent to do so. Facial geometry, geolocation, keystroke patterns. These are different data types governed by different statutes (BIPA, state consumer protection laws) requiring different technical controls (local processing, explicit opt-in, data minimization).

A platform can solve one problem completely and still be fully exposed to the other. Strong age-gating doesn't help you if your in-app browser is logging keystrokes. Clean biometric practices don't help you if a nine-year-old is uploading videos to an account with no parental consent gate. Different architectures, different audit surfaces, different legal risk.

What Does "Significant Changes" Actually Mean in Practice?

The DOJ's statement that TikTok has made "significant changes" to its compliance functions and privacy practices is worth examining carefully, because it is doing a lot of work in justifying the settlement amount. The changes referenced appear to include the ownership restructuring, the Oracle security partnership, and internal compliance overhauls. But the DOJ did not publish a detailed technical audit of what changed.

What we can observe from the outside: TikTok's architecture is now nominally split between U.S. operations (under the joint venture, audited by Oracle) and the rest of the world (still controlled by ByteDance). The theory is that this structural separation makes certain data-access violations impossible rather than merely policy-prohibited.

The word "nominally" is doing work in that sentence. Oracle's role is to audit and enforce data-access boundaries. But audit-based compliance is a different animal than architectural impossibility. An auditor can verify that access logs show no unauthorized queries. An auditor cannot easily verify that no side channel exists for exfiltrating data outside the audited path. The gap between "we audit the front door" and "there is no back door" is where the interesting technical questions live.

What Does This Mean for How You Think About Platform Data?

If you are a user, the practical takeaway is straightforward: every major platform treats settlement payments as a cost of doing business. The $400 million sounds large. TikTok's U.S. advertising revenue in 2025 was estimated at over $12 billion. A $400 million fine is material but not existential. It is a pricing signal, not a deterrent.

The pattern is predictable. A platform collects data aggressively during its growth phase. Regulators investigate. Years pass. A settlement is reached. The platform pays. The practices may or may not change in substance. Users get either nothing (regulatory settlement) or a sub-dollar check (consumer settlement). The data that was collected remains collected.

This pattern holds across platforms, not just TikTok. The structural problem is that data collection happens at ingest. Once your facial geometry, your location history, your child's viewing habits are in a database, the question of who can access that data is a governance problem layered on top of an architecture that already captured it. Governance can fail. Architecture that never collects the data in the first place cannot leak what it does not hold.

How Do You Build Systems That Avoid This Category of Problem?

You make the violation structurally impossible rather than policy-prohibited. This is not a novel idea. It is just expensive and inconvenient to implement, which is why most platforms don't.

Concretely: if you never store biometric data on your servers, you cannot be sued for unauthorized biometric data collection. If you process facial features on-device and discard them, no breach or subpoena can produce what doesn't exist. If your age-verification system runs before any data collection begins (not after), a COPPA violation requires an affirmative bypass of a system rather than passive non-compliance with a policy.

The Oracle-as-auditor model that TikTok's new joint venture adopted is a retrofit. It is an entire corporate restructuring built around firewalling data access after the fact. It may work. It is also expensive, complex, and fragile in the sense that it depends on continuous human oversight of technical boundaries. Compare that to an architecture where the data simply never reaches the entity you're trying to firewall it from. The retrofit is the more common approach because most platforms don't start with privacy as a design constraint. They start with growth, and privacy becomes a compliance function bolted on later.

At Selina, we made different choices early. Memory is encrypted at rest. Files and transfers through SelinaSEND are zero-knowledge encrypted. We built the system so that certain categories of data exposure are not possible by design, not merely prohibited by policy. That doesn't solve every problem (nothing does), but it does mean we don't end up in a position where the technical architecture contradicts the privacy promise.

What Should You Watch for Next?

Three things are worth tracking.

First, the in-app browser litigation. If that case produces a class-wide settlement, there will likely be a claim form, and the per-user payouts could be meaningful depending on class size. If you used TikTok and tapped links within the app, you may eventually have standing. No action is required now.

Second, Oracle's actual performance as a security auditor. The joint venture structure is new. Whether Oracle's oversight proves rigorous or performative will become visible over time through either the absence of incidents or the disclosure of them. Several analysts have noted that the deal leaves important questions unanswered about the scope and enforceability of Oracle's audit mandate.

Third, the regulatory signal. A $400 million COPPA fine is not just about TikTok. Every platform that collects data from users who might be under 13 is now looking at this number and recalculating their exposure. If your age-gating system is a checkbox that says "I am over 13" and nothing else, you are in the same position TikTok was in circa 2024, just with less revenue to absorb the fine.

Does the Settlement Actually Protect Children Going Forward?

It creates financial incentive but not technical guarantee. The settlement requires TikTok to pay money. It does not, on its own, mandate a specific technical architecture for age verification or data minimization. Whatever compliance improvements TikTok has made were referenced by the DOJ but not publicly detailed.

COPPA enforcement has historically relied on consent decrees and monetary penalties. The FTC and DOJ do not typically prescribe specific engineering solutions. They describe outcomes ("obtain verifiable parental consent") and leave implementation to the company. This means the quality of protection depends entirely on how seriously the company treats the engineering problem, which tends to correlate with how recently they wrote a large check.

The honest assessment: the $400 million settlement makes it more expensive for TikTok to have bad age-gating. It does not make it impossible for TikTok to have bad age-gating. The difference between "expensive to fail" and "impossible to fail" is the difference between governance and architecture. Both matter. Only one of them works when nobody is watching.

A Quick Summary of All Active TikTok Privacy Tracks

If you want an AI assistant that treats your data with the kind of care these settlements suggest TikTok didn't, you can start a free 7-day trial, no card required.

Frequently Asked Questions

What is the $400 million TikTok settlement about?

It's a regulatory penalty announced on August 21, 2026, in which TikTok and ByteDance agreed to pay the DOJ $400 million to resolve allegations that they violated COPPA by collecting data from children under 13 without parental consent. The money goes to the U.S. Treasury, not to a consumer fund.

Can I file a claim to get money from the $400 million settlement?

No. This is a government enforcement action, so there is no claim form or per-user payout; any website telling you to file a claim for it is either mistaken or a phishing attempt.

Why am I receiving a tiny check, like $0.91, from TikTok?

That check is a legitimate final supplemental distribution from the separate $92 million class action settlement (finalized in 2022) over biometric and geolocation data, sent to people who already filed claims before the deadline years ago.

Is there another TikTok privacy lawsuit still ongoing?

Yes, a federal judge ruled that claims about TikTok's in-app browser allegedly harvesting keystrokes and browsing data fall outside the $92 million settlement's scope, so that case is proceeding separately and, as of August 2026, has not reached a settlement with a consumer claims process.

How does TikTok's U.S. ownership restructuring relate to these settlements?

It's a legally separate matter: on January 22, 2026, TikTok's U.S. operations became an 80.1% American-owned joint venture with Oracle, Silver Lake, and MGX as managing investors, and Oracle now serves as the security auditor meant to prevent ByteDance from accessing U.S. user data.

Sources & References

Michael C.

Michael C.

Founder & Principal Engineer, Selina Labs

Michael builds Selina, a privacy-first AI that remembers you across conversations. He ships security-sensitive AI in production — real attacks, real fixes, measured in minutes and dollars — and writes about privacy, security, and LLMs from that seat. Top Rated Plus and expert-verified on Upwork.

Learn more about Selina.ai