TikTok Settles for $400 Million Over "Children's Personal Information" - A Turning Point for "Data Protection for Under 16s" That Also Concerns Japan

A significant settlement concerning TikTok has been reached, which cannot be ignored by social media operators worldwide.

On August 21, 2026, the U.S. Department of Justice announced that it had reached a $400 million settlement with TikTok, ByteDance, and related companies over a lawsuit concerning children's online privacy protection.

The amount alone is substantial. According to the U.S. Department of Justice, this settlement is one of the largest recoveries related to cases involving the U.S. law "COPPA," which protects children's privacy.

However, the essence of this issue is not the $400 million amount.

The questions being raised are: "To what extent can companies collect information about children in an era where smartphones and social media are deeply embedded in their daily lives?" "Is consent from the child alone sufficient?" and "How strictly should age verification be conducted?"

And this is not just an issue for the United States.

In Japan, the revised Personal Information Protection Law was promulgated in July 2026, and the system is beginning to move towards emphasizing the involvement of legal guardians and the "best interests" of children under 16 regarding their personal information.

The $400 million settlement by TikTok is an event that cannot be dismissed as merely a "scandal of an overseas social media company" for Japan.

The issue involved data of children under 13

The lawsuit's background involves the U.S. Children's Online Privacy Protection Act, known as COPPA.

COPPA generally requires online services to notify and obtain consent from parents when collecting personal information from children under 13.

In 2024, the U.S. Department of Justice and the Federal Trade Commission (FTC) filed a lawsuit against TikTok and ByteDance.

The government was concerned not just about "users under 13 using TikTok."

According to the complaint, TikTok allowed children under 13 to create regular accounts, create, view, and share videos, and interact with other users.

Furthermore, the U.S. government claimed that personal information, including email addresses, was collected and retained even in "Kids Mode," which was intended for children under 13.

It was also pointed out that even when parents noticed their child's account and requested its deletion, the account and information were not always properly deleted.

Age verification is a very challenging issue for social media companies.

If only a birthdate is required at the start of use, it is easy for children to lie about their age. On the other hand, if age verification is made stricter by requiring ID, facial images, or biometric information, the verification process itself could create new privacy issues.

The contradiction of "collecting more personal information to protect children" can arise.

This incident symbolizes this difficulty.

It wasn't TikTok's "first warning"

What makes the issue more serious is the past history concerning TikTok's predecessor, Musical.ly.

In 2019, the U.S. government also took measures regarding COPPA violations involving Musical.ly.

Subsequently, the company was required to take certain measures to protect children's privacy.

Nevertheless, in 2024, the U.S. Department of Justice and FTC filed a lawsuit against TikTok, claiming that problematic actions continued even after 2019.

From the U.S. government's perspective, this lawsuit was not a simple case of a "new social media company not knowing the rules."

It questioned how effectively a corporate group, which had already been pointed out by regulators once regarding children's personal information, had taken measures afterward.

The breakdown of $400 million is "$300 million + $100 million"

According to the U.S. Department of Justice, TikTok will first pay $300 million, and an additional $100 million will be paid on the condition that past consent orders related to Musical.ly are canceled.

This totals $400 million.

However, there is a point to note here.

This settlement is not a final court ruling recognizing TikTok's illegal activities.

The U.S. Department of Justice itself states that the government's claims resolved through the settlement are merely "allegations," meaning the content alleged, and no legal responsibility has been recognized.

Therefore, it is not accurate to understand it as "TikTok paid $400 million, so all of the government's claims were factually recognized in court."

On the other hand, the fact that the company decided to end a long-term lawsuit by making a huge payment indicates that data protection for children has become a significant business risk for large platforms.

The U.S. Department of Justice also evaluates TikTok's improvements

Interestingly, in the settlement announcement, the U.S. Department of Justice not only criticized TikTok unilaterally but also mentioned improvements made after the 2024 lawsuit.

According to the Department of Justice, TikTok has undergone significant changes in ownership structure, management, compliance functions, and privacy measures, and mechanisms to protect young users, age-related management, and parental supervision functions have been strengthened.

TikTok itself has expanded features such as "Family Pairing," which allows parents to link accounts with teenage users, as well as usage time limits, privacy settings, and content restrictions.

Recently, features have been added that allow parents to check their children's follow/follower status, increasing safety and privacy features.

It is important not to simplify the issue to "TikTok lacks safety features."

Rather, the challenge lies in whether the system actually functions across the entire large platform, including age determination, data collection, and response to deletion requests, even if safety features exist.

Simply writing "under 13 prohibited" in the terms is not enough.

On social media, reactions are lukewarm, saying "even $400 million is just a business cost"

Various opinions emerged on overseas social media and forums immediately after the announcement.

Particularly noticeable in Reddit's technology-related communities was the question of whether the $400 million amount is truly a penalty that can change the behavior of a huge platform.

One user raised the concern that fines might become merely "the cost of doing business" for giant companies.

Another user voiced that "what's important is how the service actually changes to protect children, rather than just paying money."

There are also harsh opinions suggesting that "it may just be putting a price of $400 million on children's privacy."

These reactions are based on the distrust that even if fines are repeatedly imposed on giant IT companies, the service structure does not seem to change significantly from the user's perspective.

For companies with very large sales and corporate value, even payments on the scale of hundreds of millions of dollars may not be a penalty that shakes the management itself.

On the other hand, there is also caution on social media about further tightening age verification.

If ID submission or facial recognition is required for all users to identify children, it could lead to a situation where "to protect children's privacy, even adults have to provide more personal information to companies."

There is no simple answer to this problem.

This is because it is necessary to simultaneously satisfy the demand for "stricter age verification" and the demand for "not wanting to give more personal information to platforms."

At the time of publication, large-scale discussions about the $400 million settlement itself are still limited in the Japanese-speaking sphere.

Therefore, the reactions introduced here were mainly confirmed on English-speaking social media and forums and do not statistically represent the opinions of all social media users.

In Japan, "under 16" is becoming an important number, not "under 13"

There is a crucial movement to consider when viewing this news from Japan.

In July 2026, a law partially amending the Personal Information Protection Act was promulgated in Japan.

This amendment includes significant changes regarding the protection of children's personal information.

According to materials published by the Personal Information Protection Commission, a system is shown that involves legal guardians in notifying the purpose of use of personal information and obtaining certain consent for individuals under 16.

Furthermore, it is being directed to prioritize the "best interests" of minors according to their age and developmental level and to strive to take necessary measures to prevent harm to their rights and interests.

In other words, even in Japan, the era is advancing where the notion of "it's okay because there's a consent button in the terms of use" or "the person clicked, so consent is given" is no longer sufficient to handle children's data.

The amended law will come into effect on a date specified by a government ordinance within two years of promulgation, except for some parts, so the development of detailed ordinances and guidelines will proceed from now on.

Nevertheless, it can be said that the preparation period for companies has already begun.

The U.S. lawsuit against TikTok seems to be indicating the risks a few years ahead for Japanese companies as well.

In Japan, it is already common for children to have their own smartphones

This issue is important for Japan because children's internet use is not a special behavior but has become completely routine.

According to the "Survey on the Actual Conditions of Youth Internet Use Environment for Fiscal Year 2025" published by the Children and Family Agency, among young people using smartphones, the percentage who answered "I use my own" was 74.9% for elementary school students, 95.4% for junior high school students, and 99.1% for high school students.

For middle and high school students, smartphones can be said to be almost entirely "personal devices."

The situation is different from the era when parents and children shared the same computer.

It is difficult for parents to constantly check screens, and SNS, videos, games, searches, and chats are completed within each child's device.

Therefore, there are limits to making children's safety solely the responsibility of the family.

The same survey also showed that parents who set rules for internet use at home have a higher rate of using filtering than families without rules.

Education and rule-making at home remain important.

However, that alone is not enough.

Without age-appropriate default settings, data minimization, clear explanations, reliable deletion procedures, and parental control features from the platform side, it is difficult to protect children's privacy.

Not only "what was posted" but also "what was viewed" becomes data

Japanese parents need to be particularly aware that the term "personal information" should not only conjure images of names, addresses, and phone numbers.

In modern social media, the material used to understand users is not just the information entered in the profile section.

What videos were watched.

How many seconds were watched.

Where the scroll was stopped in a video.

What was liked.

Who was followed.

What keywords were searched.

What time the app was used.

By accumulating such behavioral information, it is possible to infer what a person is interested in and what content they respond to.

For social media with recommendation algorithms, such data becomes important material to enhance service quality.

However, when the user is a child, the question arises whether such data should be handled with the same mindset as adults.

Children are more likely than adults to use services without fully understanding the potential future impacts.

Even if they think they are "just watching videos for free," continuous data generation is happening behind the scenes.

How to explain this structure and how much choice to give to the individual and their guardians will likely become central issues in next-generation privacy policies.

Japanese companies cannot simply say "we are not TikTok"

It is not only social media companies that should learn from this incident.

Almost all digital services that children might use, such as games, video streaming, educational apps, generative AI, chat services, e-commerce, and online communities, are involved.

In particular, Japanese companies will need to consider whether it is sufficient to say "we didn't know the user's age" in the future.

If the mechanism for age verification is too weak, the risk of unintentionally acquiring children's data increases, while if verification is too strict, it will result in collecting excessive personal identification information from all users.

The important concept will be "data minimization," which means not collecting more data than necessary.

Is it necessary to accurately determine the age itself?

Is there a way to verify only whether someone is "under 16 or over 16" while protecting privacy?

When will unnecessary data be deleted?

When a guardian requests deletion, can it be reliably erased from multiple systems within the company?

To what extent will children's behavioral history be used for advertising and recommendations?

These are all issues that cannot be solved by the legal department alone.

They involve service design, engineering, advertising, AI, data analysis, customer support, and management decisions.

The true meaning of the huge settlement is