close
close
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

Enforcement · Settlement / consent order

DOJ’s $400M TikTok privacy settlement hits a snag: a judge may reject part of it

COPPA Federal

The Department of Justice reached a $400 million settlement with TikTok and parent company ByteDance to resolve allegations that the platform violated COPPA by knowingly allowing children under 13 to create accounts and failing to delete their data when parents requested it. TikTok would pay $300 million immediately and $100 million more once a related consent decree is dismissed. But in September 2026 a federal judge signaled he may reject that part of the deal, leaving the settlement's final terms unresolved.

Why it matters A $400M privacy settlement isn't final just because the government announced it: a judge can still send both sides back to the table.
Read the primary source
U.S. Department of Justice
Open source

Published by Editorial on Sep 23, 2026. Not independently re-checked against the primary source — read it via the link above.

Related actions

Class-action lawsuit

Flagstar Bank reaches $31.5M settlement over 2021 data breaches affecting 2.2M people

Flagstar Bank, N.A.

Federal

$31,500,000Settled

A bank paid hackers a ransom to delete stolen data, then still had to pay $31.5 million to the customers whose data was stolen in the first place.

Primary source
Regulator enforcement

FTC orders Illuminate Education to fix security after breach exposed 10.1M students’ data

Illuminate Education, Inc.

FTC Act Section 5 Federal

DecidedNo monetary penalty

There was no fine, but a company that ignores a two-year-old security warning can still be forced into a binding security overhaul.

Primary source
Regulator enforcement

FTC orders Match and OkCupid to stop misrepresenting how they share user data

Match Group, LLC and OkCupid

FTC Act Section 5 Federal

DecidedNo monetary penalty

There's no fine, but a privacy policy promise about who sees your data is now something the FTC will hold the company to directly.

Primary source

Summaries are DataGrail’s wording, not statutory text; amounts and outcomes come from the linked primary source.

This summary is DataGrail's own plain-language account, written for privacy practitioners. It is not legal advice. For the authoritative text, follow the primary-source link above.