The U.S. Department of Justice has announced a $400 million settlement with TikTok and ByteDance resolving children’s privacy litigation under the Children’s Online Privacy Protection Act. According to the government, the deal resolves a 2024 lawsuit alleging unlawful data practices involving minors and ranks among the largest recoveries ever obtained in a COPPA matter.

For companies operating consumer-facing digital platforms, the size of the settlement is the headline—but the broader takeaway is the government’s continued willingness to pursue major privacy penalties where minors are involved.

23andMe’s data-breach exposure grew again this week, as a coalition of more than 40 state attorneys general announced they will share in an additional $18 million resolution over alleged unreasonable security practices. The state deal follows a bankruptcy court’s approval of a separate $46.75 million settlement with private claimants, bringing the combined fallout to $64.75 million and underscoring how cyber incidents can trigger overlapping liability across private litigation, regulatory enforcement, and insolvency proceedings.

The underlying civil litigation has been centralized in the Northern District of California as IN RE: 23ANDME, Inc., Customer Data Security Breach Litigation, a multidistrict proceeding that has become a key docket for watching how courts handle privacy claims tied to alleged security failures involving highly sensitive consumer data.

The Supreme Court’s decision to take up the challenge to the federal law targeting TikTok marks one of the most consequential intersections of national security, platform regulation, and First Amendment law in years. The dispute centers on a statute requiring ByteDance to divest TikTok or face restrictions on the app’s U.S. operations, with challengers arguing the law unlawfully burdens speech and exceeds constitutional limits.

The Court’s involvement is significant not just because of TikTok’s reach, but because the case tests how far the political branches can go when regulating a communications platform on national security grounds.