Loading story…
TikTok and its parent company ByteDance agreed to a $400 million settlement with the U.S. Department of Justice over allegations that the platform violated children's privacy law, including requirements under the Children’s Online Privacy Protection Act (COPPA). The case stemmed from a 2024 lawsuit, and the DOJ described the resolution as one of the largest settlements reached in a COPPA-related matter.
Under the agreement, TikTok will pay $300 million immediately and an additional $100 million after a prior consent decree involving TikTok predecessor Musical.ly is vacated. Justice Department officials said the settlement also reflects changes TikTok has made to ownership, management, compliance, privacy practices, age controls, and parental oversight aimed at improving protections for children and families.
See the reporting duties and controls this puts on the clock.
2 events from the most recent confirmed update back to the earliest known activity.
The Biden administration's Department of Justice filed a lawsuit against TikTok in 2024 alleging violations of U.S. children's privacy law, including COPPA compliance issues.
On August 22, 2026, the U.S. Department of Justice announced a $400 million settlement with TikTok and parent company ByteDance to resolve the child privacy lawsuit. The settlement requires a $300 million immediate payment and another $100 million after a prior consent decree against Musical.ly is vacated.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
6 references tracked. Mallory keeps watching after this page renders.
techrepublic.com
Open sourcescworld.com
Open sourcesecurityaffairs.com
Open sourcecryptika.com
Open sourcefoxbusiness.com
Open sourcejustice.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Disney has agreed to pay a $10 million settlement following allegations that it violated the Children’s Online Privacy Protection Act (COPPA) by failing to properly label thousands of its YouTube videos as directed at children. This mislabeling allowed Disney and its partners to collect personal data from children under 13 and serve them targeted advertisements without obtaining parental consent, actions that are explicitly prohibited under COPPA. The Federal Trade Commission (FTC) initially investigated the case before referring it to the Department of Justice (DoJ), which announced the settlement and emphasized the importance of protecting children’s privacy online. The settlement highlights the ongoing regulatory scrutiny of large content providers on platforms like YouTube, especially regarding compliance with child privacy laws. YouTube had previously updated its policies to require content creators to label videos as "made for kids" or not, following its own record $170 million COPPA settlement in 2019. The Disney case underscores the legal and financial risks for companies that fail to adhere to these requirements, reinforcing the government’s commitment to enforcing parental rights and safeguarding children’s data online.
Jun 29, 2026
President Donald Trump signed an executive order authorizing a plan for U.S. investors to acquire majority control of TikTok’s U.S. operations, aiming to resolve longstanding national security concerns regarding the platform’s Chinese ownership. TikTok, owned by ByteDance, has over 170 million American users and is a major platform for content creators and businesses. The U.S. government has expressed concerns that the Chinese government could access American user data or use the platform for propaganda, leading to a brief ban in January and subsequent executive actions to delay enforcement while a divestiture plan was negotiated. The newly approved framework establishes a U.S.-based joint venture to operate TikTok, Lemon8, CapCut, and related apps in the United States, with U.S. persons holding majority ownership and control. ByteDance and its affiliates will retain less than a 20% stake in the new entity, and will be excluded from security-related decisions. The deal is structured to comply with the 2024 Protecting Americans from Foreign Adversary Controlled Applications Act, which mandates divestiture or a ban for applications deemed national security threats. Oracle, Andreessen Horowitz, and Silver Lake are among the U.S. investors involved, with Oracle specifically tasked with hosting user data, retraining the algorithm, supporting application development, and conducting source-code reviews. All U.S. user data will be stored in an American-run cloud environment, and U.S. security partners will monitor software, algorithms, and data flows to ensure compliance. The agreement also stipulates that U.S. entities will have full control over algorithms, code, and content moderation for the American version of TikTok. ByteDance will have only one representative on the board of the new entity, without influence over security matters. The deal still requires approval from the Chinese government, though President Trump has stated that President Xi Jinping has agreed in principle, pending further confirmation. The divestiture is intended to remove TikTok and related applications from the control of a foreign adversary, as defined by U.S. law. The restructuring aims to allow TikTok to continue operating in the U.S. while addressing concerns about data privacy and foreign influence. The plan includes intense monitoring of software updates and recommendation models to prevent unauthorized access or manipulation. The move is seen as a significant step in balancing national security interests with the economic and social importance of TikTok to American users and businesses. The outcome of the Chinese government’s review will determine the finalization of the deal. If completed, the new structure will set a precedent for how the U.S. handles foreign-owned technology platforms deemed security risks. The agreement also covers related apps and websites, ensuring a comprehensive approach to data protection and platform governance.
Jun 29, 2026
ByteDance has agreed to transfer majority ownership of TikTok to a group of US-based investors and allies, including Oracle, Silver Lake, and MGX, following prolonged negotiations and legal pressure from US lawmakers. Under the terms of the deal, US entities will control 80.1% of TikTok, while ByteDance retains a 19.9% stake and one board seat. Oracle will serve as a "trusted security partner," responsible for safeguarding US user data and ensuring that China-based ByteDance has no access to sensitive information or influence over the algorithm for US users. The agreement establishes TikTok's US operations as an independent entity with authority over data protection, algorithm security, content moderation, and software assurance. All US data will be stored in a secure cloud environment managed by Oracle. ByteDance will continue to manage global product interoperability and certain commercial activities, but the new structure is designed to address national security concerns about potential Chinese government access to US user data and content manipulation.
Jun 29, 2026