TikTok: $400 million deal on minors' privacy

Timeline: two years from the DOJ to the settlement signing

The story dates back to 2024, when the United States Department of Justice has formally accused TikTok of violating COPPA. The US online children's privacy law dates back to 1998. However, its enforcement has become increasingly strict in the era of algorithmic social media.

The main accusation concerned the unauthorized collection of personal data from users under 13. Furthermore, the DOJ challenged profiling and targeting practices that allegedly involved age groups protected by the regulations. TikTok has always denied the most serious allegations. Despite this, it chose to settle the matter out of court with an agreement of $400 million , as reported by TechCrunch in August 2026 .

So, this is one of the most burdensome agreements ever reached regarding minors' privacy in the tech sector. Therefore, its symbolic value exceeds its economic value for a company the size of ByteDance.

Who comes out diminished and who can benefit from it

The case produces asymmetric effects on the market. TikTok, obviously, suffers significant reputational damage. However, the most relevant impact could fall on the entire ecosystem of social platforms aimed at a young audience.

Among the most exposed entities are:

• Brands in the fashion, gaming, and food sectors who have built awareness strategies on TikTok focusing on broad audiences that are not precisely segmented.
• Agencies and consultants that set up campaigns without proper checks on the age of the audience reached.
• Competing platforms like Instagram Reels and YouTube Shorts, which might face a regulatory halo effect.

On the other hand, those who might benefit are platforms with more mature audiences and more transparent targeting tools. For example, Linkedin operates in a B2B context where the COPPA risk is structurally absent. Similarly, search-based platforms like Google offer a different risk profile.

Furthermore, providers of solutions for consent management and compliance could see a surge in demand. Therefore, the privacy tech market could accelerate even further over the next 18-24 months.

SHM Studio's take: beyond the fine, the structural signal

We at SHM Studio we interpret this agreement not as an isolated incident, but as an indicator of regulatory direction. The American COPPA and the European GDPR are increasingly converging toward similar standards for protecting minors' data. Consequently, Italian companies operating on social platforms must update their compliance frameworks.

The critical point isn't just direct targeting of minors. In fact, the problem also arises when campaigns unintentionally reach mixed audiences. Therefore, the issue affects the quality of segmentation and the documentation of targeting choices. This applies to both large enterprises and SMEs investing on TikTok with limited budgets.

Also, it's worth considering the European context. The Digital Services Act already imposes specific obligations on platforms regarding minors. Therefore, an Italian company advertising on TikTok is exposed to a double layer of regulation: that of the platform and that of the context in which it operates.

For this reason, the most prudent strategy isn't to abandon TikTok. On the contrary, it's to structure campaigns with documentable and verifiable criteria. This requires an integrated approach between Digital marketing and legal consulting.

Operational implications for Italian marketing managers

The TikTok-COPPA case offers concrete insights for those managing advertising budgets on social platforms. First of all, it's necessary to conduct an audit of active campaigns. In particular, age targeting settings and any custom audience segments that might include minors need to be checked.

Next, it is advisable to review the contractual terms with the platforms. In fact, many advertising contracts include clauses that shift part of the responsibility onto the advertiser. Therefore, understanding these steps is essential for smart risk management.

Some top-priority actions to consider:

• Document targeting choices : keep a log of each campaign's settings, including the rationale for segmentation choices.
• Explicitly exclude protected age groups : use all available options on platforms to limit reach to adults only.
• Review creative content : avoid assets that might unintentionally attract a minor audience, even if targeting is set correctly.
• Monitor regulatory developments : the regulatory framework is evolving rapidly. Therefore, periodic updates with your legal advisor are recommended.

For companies that also invest in google ads campaigns , the risk is generally lower thanks to keyword targeting mechanisms. However, even in this context, caution is necessary, especially for display and YouTube campaigns.

The global regulatory context: where things are heading by 2028

The TikTok deal fits into a broader trend: privacy compliance is no longer an optional issue for those doing digital advertising.

In Europe, GDPR has already introduced strict consent requirements. Furthermore, the DSA adds specific obligations for platforms reaching minors. Consequently, social platforms are investing in age verification tools. However, these tools are still far from being 100% reliable.

Therefore, the residual risk also falls on advertisers. Among other things, some European jurisdictions are considering even more restrictive regulations on advertising directed at minors. Furthermore, the political debate on the subject is growing in several countries, including Italy.

For marketing managers handling strategies SEO and Digital marketing on multi-year horizons, this means integrating the regulatory variable into strategic planning. It is not a bureaucratic exercise. On the contrary, it is a key part of medium-term business competitiveness.

What nobody is saying: the problem with indirect data

There is an aspect often overlooked in the debate on children's privacy and advertising. Direct targeting towards under-13s is obviously prohibited. However, the subtler issue concerns the indirect data : behaviors, interests, and browsing patterns that platforms collect even without knowing the user's exact age.

In fact, many minors access platforms by declaring false ages. As a result, algorithmic systems classify them as adults and include them in commercial audience segments. Therefore, an advertiser who has correctly set up targeting may still reach minors without knowing it.

This creates a significant regulatory gray area. Therefore, the solution cannot be purely technical. It requires a broader approach that includes Artificial intelligence for anomaly detection, stricter editorial policies, and greater shared responsibility between platforms and advertisers.

For those who manage strategies of content marketing and wants to dive deeper into these topics, the SHM Studio blog offers regular updates on the evolution of the digital regulatory landscape. In short, the complexity of the issue requires continuous monitoring and an adaptive strategy.

Next moves: what to evaluate in the next 90 days

The TikTok-DOJ agreement represents a moment of discontinuity. Therefore, the next three months are an opportunity to structure more robust processes before any new regulations make mandatory what is still voluntary today.

First, it is advisable to run a review of your presence on TikTok : content type, audience reached, performance by demographic group. Furthermore, it's worth evaluating whether the current platform mix is optimal considering the risk profile and business objectives.

Next, it is a good idea to update the internal marketing policies to include explicit criteria on child protection in digital campaigns. This also applies to companies that do not target a young audience: organic and algorithmic reach can always generate unexpected overlaps.

Finally, for those wanting a structured discussion on these topics, the team at SHM Studio is available for a consultation . Our services for web strategy and Digital marketing already integrate the regulatory dimension into campaign planning. Because in 2026, doing responsible marketing isn't just about ethics: it's strategy.