TikTok's $400 Million Settlement Over Children's Privacy

Timeline: two years from the DOJ's action to the signed settlement

The story goes back to 2024, when the US Department of Justice formally accused TikTok of violating COPPA. The American law on children's online privacy dates back to 1998. Still, enforcement has become increasingly strict in the age of algorithmic social media.

The main charge was the unauthorized collection of personal data from users under 13. The DOJ also challenged profiling and targeting practices that allegedly involved age groups protected by the law. TikTok has always rejected the most serious allegations. Even so, it chose to close the matter with an out-of-court settlement of $400 million, as reported by TechCrunch in August 2026.

It is one of the costliest settlements ever reached over children's privacy in the tech sector. Its symbolic value outweighs its financial weight for a company the size of ByteDance.

Who loses ground and who stands to gain

The case has uneven effects on the market. TikTok, of course, takes a significant reputational hit. But the biggest impact may fall on the entire ecosystem of social platforms aimed at a young audience.

Among the most exposed are:

• Fashion, gaming and food brands that built awareness strategies on TikTok by targeting broad audiences without precise segmentation.
• Agencies and consultants that set up campaigns without adequately verifying the age of the audience reached.
• Competing platforms such as Instagram Reels and YouTube Shorts, which could suffer a regulatory halo effect.

On the flip side, those who may benefit are platforms with a more mature audience and more transparent targeting tools. For example, LinkedIn operates in a B2B context where COPPA risk is structurally absent. Likewise, search-based platforms like Google present a different risk profile.

Providers of consent management and compliance solutions could also see demand grow. The privacy tech market may accelerate further over the next 18-24 months.

SHM Studio's take: beyond the fine, a structural signal

At SHM Studio, we see this settlement not as an isolated event but as an indicator of regulatory direction. The American COPPA and the European GDPR are converging toward similar standards for protecting children's data. As a result, Italian companies operating on social platforms need to update their compliance frameworks.

The critical point isn't just targeting minors directly. The problem also arises when campaigns unintentionally reach mixed audiences. So the issue comes down to the quality of your segmentation and documenting your targeting choices. This applies to large companies and to SMEs investing in TikTok with limited budgets alike.

It's also worth considering the European context. The Digital Services Act already imposes specific obligations on platforms regarding minors. An Italian company advertising on TikTok is therefore exposed to two layers of regulation: the platform's and that of the context where it operates.

That's why the most prudent strategy isn't to abandon TikTok. It's to structure your campaigns with documentable, verifiable criteria. This calls for an integrated approach between digital marketing and legal advice.

What it means in practice for Italian marketing managers

The TikTok-COPPA case offers practical takeaways for anyone managing ad budgets on social platforms. First, run an audit of your active campaigns. In particular, check your age targeting settings and any custom audience segments that might include minors.

Next, review your contractual terms with the platforms. Many advertising contracts include clauses that shift part of the responsibility onto the advertiser. Understanding these provisions is essential for informed risk management.

Some priority actions to consider:

• Document your targeting choices: keep a record of each campaign's settings, with the reasoning behind your segmentation choices.
• Explicitly exclude protected age groups: use every option available on the platforms to limit reach to adults only.
• Review your creative content: avoid assets that could unintentionally appeal to a underage audience, even if targeting is set up correctly.
• Monitor regulatory developments: the regulatory framework is evolving fast. We recommend regular check-ins with your legal advisor.

For companies that also invest in Google Ads campaigns, the risk is generally lower thanks to keyword targeting. Still, caution is needed here too, especially for display and YouTube campaigns.

The global regulatory landscape: where things are heading by 2028

The TikTok settlement is part of a broader trend: privacy compliance is no longer optional for anyone doing digital advertising.

In Europe, the GDPR has already introduced strict consent requirements. The DSA also adds specific obligations for platforms that reach minors. As a result, social platforms are investing in age verification tools. But those tools are still a long way from being 100% reliable.

So the residual risk falls on advertisers as well. Some European jurisdictions are also considering even stricter rules on advertising aimed at minors. And the political debate on the topic is growing in several countries, including Italy.

For marketing managers running SEO and digital marketing strategies over multi-year horizons, this means building the regulatory variable into strategic planning. It's not a bureaucratic exercise. It's a component of your company's competitiveness in the medium term.

What nobody is saying: the problem of indirect data

There's an aspect that often gets overlooked in the debate on children's privacy and advertising. Targeting under-13s directly is obviously prohibited. The subtler problem lies in indirect data: behaviors, interests and browsing patterns that platforms collect even without knowing the user's age for certain.

Many minors access platforms by entering a false age. As a result, algorithmic systems classify them as adults and place them in commercial audience segments. So an advertiser who set up targeting correctly can still reach minors without knowing it.

This creates a significant regulatory gray area. So the solution can't be purely technical. It calls for a broader approach that includes artificial intelligence for anomaly detection, stricter editorial policies, and greater shared responsibility between platforms and advertisers.

If you manage content marketing strategies and want to dive deeper into these topics, the SHM Studio blog offers regular updates on the evolving digital regulatory landscape. In short, the complexity of the topic demands continuous monitoring and an adaptive strategy.

Next moves: what to evaluate in the next 90 days

The TikTok-DOJ settlement marks a turning point. The next three months are therefore a chance to build stronger processes before new regulations make mandatory what is still voluntary today.

First, we recommend conducting a review of your TikTok presence: types of content, audience reached, and performance by age group. It's also worth assessing whether your current platform mix is the best fit for your risk profile and business goals.

Next, update your internal marketing policies to include explicit criteria on protecting minors in digital campaigns. This applies even to companies that don't target a young audience: organic and algorithmic reach can always create unexpected overlaps.

Finally, if you'd like a structured conversation on these topics, the SHM Studio team is available for a consultation. Our web strategy and digital marketing services already build regulatory considerations into campaign planning. Because in 2026, responsible marketing isn't just ethics: it's strategy.