TikTok, COPPA, and the Battle Over Children’s Online Privacy

Short-form video apps have become central to how children and teenagers communicate, learn, and socialize. Among these platforms, TikTok is one of the most widely used, which makes the way it handles young users’ data a significant legal and policy issue. The United States government has now accused TikTok and its parent company ByteDance of violating federal children’s privacy protections on a massive scale, raising important questions for parents, platforms, and regulators.

Understanding the Legal Landscape for Children’s Online Privacy

In the U.S., the primary federal law governing online data collection from young children is the Children’s Online Privacy Protection Act (COPPA) and its implementing regulations known as the COPPA Rule. COPPA applies to websites and online services that are directed to children under 13, or that have actual knowledge that they are collecting personal information from children in that age group.

Under COPPA, operators generally must:

• Provide clear, comprehensive notice of their data practices regarding children.
• Obtain verifiable parental consent before collecting, using, or disclosing personal information from children under 13.
• Offer parents the ability to review the information collected from their child and to request deletion.
• Limit data collection to what is reasonably necessary for the service and implement reasonable security procedures.

These requirements are meant to ensure that parents are the gatekeepers for young children’s digital footprints and that platforms cannot freely build profiles or target advertising to kids without informed consent.

TikTok’s Rapid Growth and Young User Base

TikTok is a global video-sharing platform where users create and view short videos, often accompanied by music, filters, and effects. The app’s intuitive design, viral trends, and recommendation algorithm have made it popular with users of all ages, including children under 13.

Key characteristics of TikTok’s environment for kids include:

• Highly engaging short-form video content that can encourage prolonged use.
• Social features allowing interaction with other users via comments, messages, and “duets” or “stitches.”
• Recommendation systems that surface videos tailored to user behavior and preferences.

Although TikTok maintains a separate experience for younger users—often referred to as an under-13 or kids mode—and states in its Children’s Privacy Policy that children cannot publicly share personal information in that environment, regulators allege that the reality of how the app is used and configured has not always matched these commitments.

What the Government Alleges TikTok Did Wrong

The U.S. Department of Justice (DOJ), working with the Federal Trade Commission (FTC), has filed a civil lawsuit against TikTok and ByteDance in federal court. The complaint claims that TikTok committed widespread violations of COPPA and the COPPA Rule, spanning several years.

According to the government’s filings and public statements, the alleged misconduct includes:

• Allowing children under 13 to create regular TikTok accounts on the main platform, not just in a restricted kids environment.
• Permitting children to evade age-gating mechanisms, effectively defeating safeguards that were supposed to keep them out of the standard app.
• Collecting and retaining personal information from these children—including persistent identifiers and other data—without first notifying parents and obtaining verifiable parental consent.
• Failing to honor parents’ requests to delete their children’s accounts and associated information.
• Continuing improper data practices even within TikTok’s kids-oriented features, including alleged profiling in the under-13 experience.

The DOJ describes these practices as “massive scale invasions of children’s privacy”, suggesting that the alleged violations affected millions of children over multiple years. The government also points to issues with TikTok’s recordkeeping and compliance with an earlier 2019 federal order involving children’s privacy.

TikTok’s Stated Commitments in Its Children’s Privacy Policy

TikTok, for its part, publishes a Children’s Privacy Policy that outlines how it claims to treat data collected from young users. The policy, last updated in early 2023, specifies that in the under-13 experience:

• Children cannot publicly share personal information, including videos or profile details.
• Data is used to provide and support TikTok’s services, and may be shared internally or with service providers for operational purposes.
• TikTok does not sell children’s information to third parties or share it for cross-context behavioral advertising.
• Parents or guardians can submit requests to know, access, delete, or correct information collected from their child using web forms or a mailing address.

These written commitments are designed to align with COPPA’s framework by restricting public sharing, limiting commercial uses of children’s data, and providing meaningful parental control. The gap that regulators are focused on is whether TikTok’s actual product design and enforcement have lived up to these stated safeguards.

Core COPPA Obligations vs. Alleged TikTok Practices

Enforcement Actions and Potential Penalties

The DOJ’s lawsuit seeks not only injunctive relief—court orders that would require TikTok to change its practices—but also substantial civil penalties. Under COPPA, each violation can trigger a separate penalty, and the government is seeking amounts that could reach tens of thousands of dollars per violation per day for the relevant time period.

In addition to the federal enforcement action, private litigants have also brought class action lawsuits on behalf of parents, arguing that TikTok’s handling of children’s data violated COPPA and related privacy laws. These lawsuits aim to secure damages and stronger safeguards for minors who use the platform.

Evolving Laws: COPPA 2.0, Kids Online Safety Act, and State Codes

While the current litigation focuses on existing COPPA requirements, lawmakers are also moving to tighten protections for children and teens online. These updates matter because they help define what future compliance should look like for platforms like TikTok.

Recent legislative developments include:

• COPPA 2.0: A proposed federal update that would extend COPPA protections currently limited to children under 13 so they also cover teenagers up to age 16 or 17. It would also broaden the standard for applicability from “actual knowledge” that a service has child users to platforms that are reasonably likely to be used by minors.
• Kids Online Safety Act (KOSA): This bill would require online platforms to activate the most protective settings for minors by default, impose a duty of care to address potential harms, and provide options to limit data uses, addictive features, and personalized algorithms.
• State Age-Appropriate Design Codes: Some states have enacted or proposed laws requiring services that are likely to be accessed by children to design products with privacy and safety as a baseline, including strong default protections and careful data processing rules.

If these measures become law and withstand constitutional challenges, platforms will face stricter obligations and broader coverage, making compliance more complex but potentially offering stronger safeguards for young users.

Implications for Platforms: Designing for Child Privacy Compliance

The TikTok case illustrates how difficult it can be for a large, global platform to manage age-based access, privacy, and safety rules consistently. To meet current and emerging legal expectations, platforms that may attract child users should consider:

• Robust age verification and age assurance tools that make it harder for children to misrepresent their age and bypass under-13 restrictions.
• Segregated experiences for children versus older users, with distinct features, data practices, and moderation policies.
• Data minimization strategies that reduce what information is collected from children to the bare essentials for service delivery.
• Transparent, easily accessible privacy information for parents and guardians, including tools to manage accounts and data.
• Independent audits and recordkeeping to demonstrate compliance and quickly identify problems.

Failure to proactively adopt these measures can lead to enforcement actions, financial penalties, reputational harm, and, in some cases, requirements to redesign products under court supervision.

What Parents Can Do to Protect Their Children’s Data on TikTok

Even as regulators pursue enforcement against platforms, parents remain central to protecting children’s online privacy. For families whose children use TikTok or similar apps, practical steps can help reduce risks:

• Review age requirements: Confirm that your child meets the platform’s minimum age for the main app and consider kids or restricted modes for younger users.
• Use parental controls: Explore and enable built-in features that limit who can interact with your child, what content they can see, and how their data is used.
• Discuss privacy and sharing: Talk with children about not sharing personal information in videos, profiles, or messages, and about recognizing suspicious contacts.
• Exercise your rights: TikTok’s Children’s Privacy Policy explains how parents can request access to, correction of, or deletion of data collected from their child. Use these mechanisms if you are concerned about your child’s information.
• Monitor usage patterns: Periodically review your child’s watch history, content creation, and follower interactions to spot potential issues early.

While no single step can fully eliminate privacy risks, a combination of technical settings, ongoing communication, and awareness of legal rights can make a meaningful difference.

Frequently Asked Questions About TikTok and Child Privacy Laws

Is TikTok legally allowed to collect data from children under 13?

Under COPPA, TikTok may collect certain information from children under 13 only if it complies with strict requirements, including providing clear notice and obtaining verifiable parental consent. The government’s lawsuit alleges that TikTok collected and retained personal information from children without meeting these obligations, which is why COPPA enforcement is now being pursued.

What types of information are considered “personal” under COPPA?

COPPA defines personal information broadly. It includes identifiers such as names and addresses, but also persistent identifiers like cookies or device IDs that can recognize users over time and across services. According to the complaint against TikTok, the platform retained a wide variety of personal information from children, including persistent identifiers used to build profiles and target advertising.

How does the under-13 or kids mode on TikTok differ from the regular app?

In TikTok’s under-13 experience, the company states that children cannot publicly share personal information, including videos or profile details. The environment is supposed to restrict social features and limit data uses. Regulators, however, allege that even the kids mode did not fully comply with COPPA and that TikTok amassed profiles on child users there as well.

Can parents request that TikTok delete their child’s data?

Yes. COPPA gives parents the right to review and request deletion of the personal information collected from their child. TikTok’s Children’s Privacy Policy describes mechanisms for parents to submit deletion and access requests. The government’s complaint alleges that TikTok did not always honor parents’ requests to delete accounts and data for children under 13.

What might change if COPPA 2.0 and KOSA become law?

If enacted, COPPA 2.0 would extend privacy protections to older minors and broaden the range of services that must comply, while KOSA would impose a duty of care and require default protective settings for kids. For platforms like TikTok, this would likely mean more stringent obligations around data handling, content design, and safety tools for both children and teenagers.

Similar Articles

Your First Credit Card: How to Avoid Costly Fine‑Print Traps

Smart Student Borrowing: A Financial Literacy Guide

Brendlin v. California and the Fourth Amendment Passenger Rule

Miranda v. Arizona and the Birth of Modern Police Warnings

Bankruptcy Terms Explained

Understanding Bankruptcy Noticing in Federal Courts

Author

medha deb

 

Medha Deb is an editor with a master's degree in Applied Linguistics from the University of Hyderabad. She believes that her qualification has helped her develop a deep understanding of language and its application in various contexts.

Read full bio of medha deb