TikTok collected personal information from children under 13 without obtaining verifiable parental consent, violating the federal Children’s Online Privacy Protection Act (COPPA). In March 2023, the Federal Trade Commission filed a formal complaint against TikTok alleging that the platform systematically gathered sensitive data—including birthdates, email addresses, phone numbers, browsing history, and behavioral tracking information—specifically from young users while failing to disclose these practices to parents or obtain their permission.
The complaint represents one of the most significant regulatory actions against a social media platform regarding children’s privacy rights, and the case remains active as of 2025. For parents and young users, understanding these privacy claims matters because they define what information TikTok is now legally required to protect and what compensation may be available to affected users. The violations outlined in the FTC complaint expose a pattern of practices that many parents assume do not happen on mainstream platforms—particularly the use of deceptive design elements that obscure privacy settings and the collection of behavioral data used to target advertising specifically at minors.
Table of Contents
- WHAT DATA DID TIKTOK COLLECT FROM CHILDREN?
- HOW TIKTOK VIOLATED CHILDREN’S PRIVACY LAWS
- THE FTC’S DATA PRIVACY CLAIMS AGAINST TIKTOK
- UNDERSTANDING CHILDREN’S CONSUMER RIGHTS IN THE DIGITAL AGE
- WHY ENFORCEMENT LIMITATIONS MATTER FOR CHILD PRIVACY PROTECTION
- PRIVACY SETTINGS PARENTS NEED TO KNOW ABOUT
- TIKTOK’S REQUIRED COMPLIANCE CHANGES FOR PROTECTING CHILDREN’S DATA
WHAT DATA DID TIKTOK COLLECT FROM CHILDREN?
tiktok‘s data collection practices targeted specific types of personal information that are particularly sensitive when gathered from children. The platform collected birthdates directly during account registration, email addresses for account recovery and communication, phone numbers for two-factor authentication, and detailed browsing history that tracked which videos each child viewed, how long they watched, and which content they engaged with through likes, comments, and shares. This behavioral data was then aggregated to create user profiles that could be used for targeted advertising purposes. The scope of this collection extended beyond what most parents realize is necessary for a basic social media platform. Video interaction data allowed TikTok to build detailed profiles of each child’s interests, emotional triggers, and viewing preferences.
The platform also collected device identifiers and usage patterns, creating a complete digital footprint of the child’s online behavior. Unlike some privacy violations that occur incidentally, TikTok’s data collection was built into the core infrastructure of the platform—every interaction generated data that was retained and analyzed. A parent whose child used TikTok for just one month had that child’s data collected and stored across hundreds of individual data points, many of which were not disclosed in any accessible privacy notice. The practical impact of this collection is significant because behavioral data tied to children’s identities creates a permanent record that can be used for purposes parents did not authorize. Unlike temporary browsing data that disappears when a child deletes their history, TikTok’s data collection created persistent profiles that accumulated over time and could theoretically follow a user throughout adulthood.
HOW TIKTOK VIOLATED CHILDREN’S PRIVACY LAWS
The Children’s Online Privacy Protection Act (COPPA) is the federal law specifically designed to protect children under 13 from online data collection. COPPA requires that platforms obtain verifiable parental consent before collecting any personal information from children, meaning parents must actively agree to data collection through a clear process. TikTok’s primary violation was proceeding with data collection from known child users without this required parental consent. Instead of implementing a system where parents received notice and gave permission before their child’s data could be collected, TikTok allowed children to create accounts and begin generating data trails immediately upon signing up. TikTok’s approach to parental notice and consent was inadequate in multiple ways.
The privacy policy buried information about data collection in lengthy terms of service documents that few parents read, and the platform did not separate out a child-specific privacy notice that clearly explained what information would be collected and how it would be used. When a child entered their birthdate during registration, TikTok knew they were potentially serving a user under 13, but the system did not trigger a parental consent requirement at that critical moment. Instead, TikTok relied on age-based restrictions that could be easily circumvented by children simply entering a false birthdate—a limitation that meant TikTok’s own age verification system could not reliably identify which accounts belonged to children. The deceptive design element that the FTC highlighted relates to privacy settings that, even when enabled, did not fully prevent data collection or targeted advertising directed at young users. A parent might have found privacy settings that suggested their child’s account was protected, but those settings did not actually stop the underlying data collection from occurring. This distinction—between privacy-friendly settings that limit visibility and the data collection itself—represents a significant gap in how TikTok’s protections actually functioned.
THE FTC’S DATA PRIVACY CLAIMS AGAINST TIKTOK
The Federal Trade Commission filed its complaint against TikTok in March 2023, alleging violations of both COPPA and the broader Federal Trade Commission Act, which prohibits unfair and deceptive practices. The FTC’s investigation revealed a systematic pattern of practices rather than isolated incidents, meaning TikTok’s data collection from children was not the result of technical error but rather the result of business decisions about how the platform would operate. The allegations included claims that TikTok failed to verify parental consent before collecting children’s data, failed to provide adequate privacy disclosures specifically designed for children and parents, and used design patterns that obscured privacy controls. One of the most significant elements of the FTC’s case is the allegation that TikTok’s use of dark patterns—user interface design choices deliberately engineered to encourage certain behaviors—made it difficult for users to understand and control their privacy settings.
For example, enabling maximum privacy protections might require navigating through multiple screens and options that were not clearly labeled, while the default settings encouraged maximum data sharing. The FTC alleged this design was intentional, meant to steer users toward less protective choices and therefore facilitate greater data collection. As of February 2025, the FTC case remains active and TikTok has not admitted to wrongdoing, but the company has agreed to implement compliance measures. This distinction is important because it means the regulatory action is not concluded, and additional findings or remedies may emerge as the case proceeds. The case has not yet resulted in a finalized settlement that would specify which users are eligible for compensation or what payment amounts would be provided.
UNDERSTANDING CHILDREN’S CONSUMER RIGHTS IN THE DIGITAL AGE
Children under 13 have specific legal rights under COPPA that are different from adults’ privacy rights under general federal law. These rights include the right to have parents notified before any personal information is collected, the right to have parents actively consent to data collection, the right to have that consent obtained through a clear and understandable process, and the right to have their personal information deleted upon parental request. These rights exist because children are recognized as a vulnerable population less able to understand the implications of data collection and the long-term consequences of having their behavior tracked and profiled. Parents, not children themselves, typically exercise these rights under COPPA. A parent has the right to request access to all personal information a platform has collected about their child, to request deletion of that information, and to opt out of future collection.
However, these rights only protect children under 13, and COPPA does not cover teenagers aged 13 and older. This creates a gap in protection for many young users on TikTok, where a significant portion of the user base consists of teenagers who fall outside COPPA’s requirements. A 16-year-old’s data on TikTok receives less legal protection than a 12-year-old’s data, even though teenagers are still developing their judgment about privacy and data sharing. The complexity of asserting these rights in practice creates a meaningful limitation. A parent seeking to exercise COPPA rights must navigate the platform’s formal data request processes, often without clear guidance about what information to request or how long the process will take. Some parents have reported difficulty even identifying whether their child used the platform, since account creation requires minimal verification.
WHY ENFORCEMENT LIMITATIONS MATTER FOR CHILD PRIVACY PROTECTION
The FTC has limited enforcement resources compared to the vast number of platforms and services that collect data from children. This resource constraint means the FTC must prioritize enforcement actions against the largest, most visible platforms—which can actually allow smaller platforms with similar practices to operate without regulatory scrutiny. TikTok’s enforcement action received significant attention precisely because TikTok is a major platform with millions of child users, but hundreds of smaller apps and services that collect children’s data operate without facing formal investigation. Another limitation is the gap between regulatory findings and actual compensation for affected users. Even after the FTC proves that illegal data collection occurred, translating that proof into payment to individual users requires either a settlement that includes compensation or a separate private litigation action.
The March 2023 FTC complaint did not immediately specify what compensation would be available to affected children or parents, and as of 2025, no finalized settlement amount has been publicly announced. This means families whose children’s data was collected may eventually receive compensation, but the amount and timing remain uncertain. The data collection itself presents a practical problem that enforcement cannot fully remedy: once personal information has been collected and retained by a platform, deleting it does not erase it from any copies, backups, or secondary uses that may have already occurred. TikTok’s collection of children’s data created permanent records that may have been shared with advertising partners, brokers, or other third parties. Even if TikTok deletes a child’s profile data in response to an FTC enforcement action, that data may have already been used or sold in ways that continue to affect the child’s digital footprint.
PRIVACY SETTINGS PARENTS NEED TO KNOW ABOUT
TikTok offers privacy settings that parents should understand, though these settings do not eliminate data collection even when enabled to their most restrictive levels. Account privacy can be set to “private,” which restricts who can see a child’s videos and comment on their content. However, private account status does not prevent TikTok from collecting data about what videos the child watches, how long they engage with content, or what their viewing patterns reveal about their interests. The FTC alleged that even when a child’s account was set to private, TikTok continued collecting behavioral data and used that data for targeted advertising purposes. Family Pairing, a feature TikTok introduced partly in response to privacy concerns, allows parents to link their own account to their child’s account and impose restrictions on content, screen time, and who can contact the child.
However, even with Family Pairing enabled, the underlying data collection continues. Parents should understand that limiting a child’s access to certain content through Family Pairing settings is different from limiting data collection. The platform may still be gathering information about what restricted content the child attempted to view, or what other users they interacted with before being blocked by parental controls. Restricted Mode filters content, but like other privacy settings, does not address the core data collection issue. The absence of robust privacy controls that would actually stop data collection—rather than merely limiting visibility or access—represents a significant gap in how TikTok’s privacy settings function compared to what parents reasonably expect when they enable a “private” or “restricted” mode.
TIKTOK’S REQUIRED COMPLIANCE CHANGES FOR PROTECTING CHILDREN’S DATA
As part of its agreement to address FTC concerns, TikTok committed to implementing enhanced age-verification mechanisms intended to more reliably identify accounts belonging to children under 13. These mechanisms are meant to prevent children from simply entering false birthdates during registration to circumvent age restrictions. However, age verification at account creation remains a technical challenge for all platforms, and TikTok’s specific implementation has not yet been publicly detailed or independently verified as effective. TikTok also agreed to implement parental controls that provide parents with greater visibility into their child’s account and activity.
The company committed to strengthening privacy disclosures and making information about data collection and use clearer and more accessible to both children and parents. Additionally, TikTok agreed to restrict targeted advertising directed at children, though the precise scope of this restriction and how it will be technically implemented remain subjects of ongoing FTC oversight. The compliance requirements represent changes TikTok must make to continue operating, but they do not retroactively address data that was already collected from children before these measures took effect. Children who used TikTok before compliance measures were implemented had their data collected under the practices the FTC deemed illegal, and that historical data collection remains part of the regulatory record even as TikTok moves forward with new safeguards.