Last updated: 2026-10-03
On September 21, 2026, Judge George H. Wu of the US District Court for the Central District of California denied without prejudice the United States' consent motion to vacate the 2019 stipulated order against Musical.ly, the app ByteDance bought and merged into TikTok (United States v. Musical.ly, No. 2:19-cv-01439). The ruling bears on the $400 million TikTok COPPA settlement under the Children's Online Privacy Protection Act, which the Justice Department announced on August 21, 2026: TikTok "will pay $300 million immediately" and $100 million "upon entry of an order vacating a prior consent decree entered against TikTok's predecessor, Musical.ly." The 2019 order stays in force, and the $100 million installment falls due only after a court vacates it.
What did the TikTok COPPA settlement agreement say?
The Settlement Agreement and Release is "dated as of August 19, 2026" and signed by the United States and six defendants, including ByteDance Ltd., TikTok Inc. and TikTok USDS Joint Venture LLC (formerly TikTok U.S. Data Security Inc.).
Its terms:
- The United States files a motion to vacate the 2019 order under Federal Rule of Civil Procedure 60(b) within 30 business days of signing, and "shall present the necessary arguments and evidence" to obtain it (paragraph 3).
- The parties dismiss the 2024 case with prejudice within two business days of the first payment (paragraph 4).
- Defendants pay "up to Four Hundred Million dollars": $300 million within 14 days of signing, and $100 million "within fourteen (14) days after, and is contingent upon, the entry of the Vacatur Order" (paragraph 5).
- Contingent on the first payment, the United States releases claims through August 19, 2026 arising from the 2019 case, the 2019 order and the 2024 case, "and also any and all claims arising out of or relating to COPPA, the COPPA Rule, and the FTC Act Section 5" (paragraph 6), unknown claims included (paragraph 7).
The agreement contains no conduct, reporting or monitoring obligation. It calls the settlement a compromise of "disputed claims" with no "admission of fault, wrongdoing, concession, or liability" (paragraph 2), and the DOJ press release states: "The claims resolved by the United States in the settlements are allegations only, and there has been no determination of liability." The documents cited here give no date for the $300 million payment.
What did the 2024 complaint allege about TikTok's age gate?
The United States sued on August 2, 2024, on referral from the Federal Trade Commission (United States v. ByteDance Ltd., No. 2:24-cv-06535). The complaint alleged that TikTok "allowed children to bypass or evade this 'age gate' and collected personal information even from individuals who identify themselves as children" (paragraph 35).
- Until at least late 2020, a child who entered an under-13 birth date could restart sign-up and enter an older one (paragraph 45).
- "Until at least May 2022", users could skip the age gate by signing in with Instagram or Google credentials; TikTok labeled these "age unknown" accounts (paragraph 46).
- In Kids Mode, TikTok collected "IP address and unique device identifiers" without parental notice or consent, and until at least mid-2020 shared Kids Mode data "with Facebook and AppsFlyer, a marketing analytics firm", a process it called "retargeting less active users" (paragraphs 52–57).
- TikTok had an internal "grade level" age estimate, used "for purposes such as advertising", and did not use it to find and remove children (paragraph 103).
According to the settlement recitals, the defendants answered on October 7, 2024, denying the material allegations. No court made findings on them. The parties filed a two-sentence stipulation of dismissal on August 21, 2026, and Judge Wu dismissed the case with prejudice on August 24, writing that "given the significant issues raised within this litigation and this Court's interest/curiosity in any resolution so suddenly reached by the parties, it is tempted to inquire of the parties" but "lacks the power to do so" (docket entry 89).
What does the 2019 Musical.ly order require?
Judge Otis D. Wright II entered the stipulated order on March 27, 2019. It defines "Defendants" as Musical.ly, Musical.ly, Inc. "and their successors and assigns" (TikTok Ltd. and TikTok Inc. after the 2019 renaming), enjoins them from violating the COPPA Rule, and enters a $5,700,000 civil penalty. For ten years from entry, to March 27, 2029, the defendants must give sworn notice of corporate changes, including "creation, merger, sale, or dissolution", and create compliance records, keeping each for five years (Parts VII and VIII).
| Instrument | Date | Money | Ongoing obligations | Status on 2026-10-03 |
|---|---|---|---|---|
| Stipulated order, No. 2:19-cv-01439 (Dkt. 10) | 2019-03-27 | $5.7M civil penalty | COPPA Rule injunction; corporate-change notices and records to 2029-03-27 | In force; motion to vacate denied without prejudice 2026-09-21 |
| Complaint, No. 2:24-cv-06535 (Dkt. 1) | 2024-08-02 | Sought civil penalties | Sought a permanent injunction | Dismissed with prejudice 2026-08-24 (Dkt. 89) |
| Settlement Agreement and Release | Dated as of 2026-08-19 | $300M within 14 days of signing; $100M within 14 days of a vacatur order | None in the text | $100M pending a vacatur order |
Sources: the 2019 order, the ByteDance docket, the settlement agreement.
Why did Judge Wu refuse to vacate the Musical.ly decree?
The court adopted its September 18 tentative ruling as final. The government cited three changed circumstances: the January 2026 divestiture to a US joint venture, which its motion called "a predecessor of TikTok US thrice removed" from Musical.ly; platform changes; and the settlement payment. The court rejected a deferential standard for an unopposed motion, treated the request under Rule 60(b)(5) only, and found the burden unmet on each:
- Ownership: the order binds "successors and assigns" and requires notice of corporate changes, so a sale was anticipated; "COPPA applies without regard to whether the relevant operator is foreign- or domestically owned" (pages 12–13). On the new owner's compliance commitments: "a commitment to comply is not the same as having demonstrated actual compliance" (page 13).
- Platform changes: a declaration by a TikTok USDS Joint Venture employee states that every new user must enter a date of birth, that third-party sign-up without the age gate was eliminated, and that "Age Gate 100" in 2023 and 2024 "prompted every user for whom TikTok did not have a date of birth to pass through TikTok's age gate." The court answered that the government's own complaint "alleges that the existence of an age gate did not prevent widespread underage use of the platform" (page 14).
- Settlement: the motion gave neither the amount nor other terms, so the court "cannot determine what liabilities the payment resolves, whether the settlement imposes any prospective obligations, or how any such obligations would be enforced" (page 16).
The tentative ruling notes that "the sufficiency of TikTok's current tools for achieving compliance with COPPA is still being litigated" in the private case, In re TikTok, Inc., Minor Privacy Litigation (MDL No. 3144, No. 2:25-ml-03144, C.D. Cal.) (footnote 11). On September 24, 2026, Judge Wu denied TikTok and ByteDance's motion to dismiss that MDL for the period before August 22, 2022.
What happens next with the Musical.ly order?
The minutes state: "The parties will meet and confer regarding the Government's filing of its renewed motion and advise the Court's clerk as soon as practicable." The CourtListener docket and the PacerMonitor copy of the PACER docket, both checked on October 3, 2026, show no renewed motion; the last entry is a September 24 transcript order (entry 24). On October 2, after the ruling, DOJ posted the agreement whose terms the motion omitted.
Operators covered by COPPA also have to meet the amended COPPA Rule (compliance date April 22, 2026), and state app store age signal laws, most effective in 2027, give apps an age signal. See also Brazil's TikTok fine.
What does a CITT scan and capture show for TikTok's age gate?
The 2024 allegations turn on what an app collects before and after the age gate, whether a sign-in path skips it, and which third parties receive identifiers from an under-13 account. A traffic capture of account creation on a test device, run twice (under-13 and adult birth dates), records each request the app sent, its receiving host and identifier fields (device ID, install ID, advertising ID, IP-derived fields). It also records whether each request was sent before the birth date screen, after it, or after a sign-in with Google or another provider. A scan of an Android build lists the analytics and attribution SDKs whose code is present, such as the AppsFlyer SDK (classes under com.appsflyer) or the Meta (Facebook) SDK's app events classes (com.facebook.appevents), with the file where each was found. Presence in a binary shows the code is there; only a capture shows what was sent.
A static scan of the iOS build is on the public TikTok app page. The complaint covers conduct from March 2019 through 2024; a capture covers the build tested that day. What TikTok's servers do with a request is outside any app capture. What a scan checks and the limits of a scan are on the methodology page.
I run age gate and children's data investigations for lawyers and for researchers working with lawyers, on one app or a list of apps in bulk. Sign up for a CanITrustThat (CITT) account to run your own research, or let us run an investigation for you.