Parents and lawmakers may want social media platforms to know when a child is too young to use them. But there's a potential privacy issue hiding inside that goal, one that's been put front and center following TikTok's $100 million settlement with Alabama.
While improved age verification and age assurance on TikTok and other platforms are largely considered a win, questions are being raised about the type of information and data social media companies collect. Not to mention, what happens to that information after an underage user is identified.
TikTok Must Improve Age Assurance in Alabama
On September 25, TikTok and its parent company, ByteDance, agreed to pay Alabama at least $100 million, with the potential to pay as much as $300 million if certain conditions are met.
Among other allegations, Alabama accused the company of designing TikTok with addictive features, exposing young users to serious mental health harms. They also claimed ByteDance misled consumers about the platform's safety.
Part of the settlement requires TikTok to introduce "robust age assurance" measures to better determine how old younger users are.
Some of the other requirements include:
- Two-hour daily limits for children
- Nighttime restrictions (midnight to 6am)
- Stronger parental controls
- Restrictions on adults discovering teen accounts
- A default, non-personalized feed for teens
This case followed a similar Meta lawsuit verdict in New Mexico. The judge ordered Meta to make age-assurance improvements and to pay $567 million to address youth mental health harm.
What Personal Information Can TikTok Collect?
TikTok's U.S. privacy policy says it can collect account information, device and network information, location, user content, and how people use its services.
The company also says it can analyze photos, videos, audio, messages and associated metadata and can infer characteristics such as a user's age, gender and interests. It can use information to verify identity or age when verification is required.
That means determining whether someone is a child doesn't necessarily require one piece of information labeled "age."
After all, the more information a platform analyzes to identify children, the greater the potential consequences if that information is retained, misused, disclosed, or inaccurate.
How Does TikTok Know How Old a Child Is?
TikTok's minimum age is 13, but simply asking users to enter a birthday isn't enough to guarantee they tell the truth.
When it comes to how TikTok can tell how old a child is, ByteDance says they use a multilayered approach. This can include a user's stated birth date, information associated with the account, content and activity on the platform, and technology designed to estimate or verify age.
One method is facial age estimation, which attempts to estimate someone's age from their facial characteristics. Other ways can involve government identification or another form of age verification.
TikTok has said that, when facial age estimation is used through an outside provider in some markets, the provider can send the age estimate rather than the underlying facial information.
An age estimate and a person's biometric data are not necessarily the same thing.
But age-assurance technology is still evolving. The Federal Trade Commission held a 2026 workshop specifically examining age verification and estimation technologies, including how they interact with children's privacy laws.
Who Gets TikTok User Data and Information?
TikTok says it may share information with service providers and other business partners for purposes including technology services, analytics, advertising, data storage and hosting.
They collect information to operate and improve its services, develop technology, personalize content, provide advertising services, and train, test and improve machine-learning models and algorithms.
TikTok's broad privacy policy does not establish that every piece of information collected during an age check is automatically used for advertising or AI training. But the potential privacy issue is about what happens to information collected for the purpose of determining age.
How Could Age Verification Lead to Data Privacy Lawsuits?
Platforms are being pressured to know more about their young users. At the same time, child privacy laws require them to protect those users' personal information.
Under the Children’s Online Privacy Protection Act (COPPA), companies generally must obtain parental consent before collecting, using or disclosing personal information from children under 13.
COPPA can cover information such as names, contact information, geolocation, photos, videos, audio, biometric identifiers, and persistent identifiers that can track a child over time.
This means an age-verification system could potentially create a new legal risk if a social media company:
- Collects more information than necessary to determine age
- Keeps age-verification information longer than necessary
- Uses it for unrelated purposes
- Shares it with third parties without adequate protections
- Misidentifies a child and then collects or uses the child's data without required protections
2026 Social Media Lawsuits: Child Privacy and Youth Mental Health Harm
Social media companies are already facing lawsuits involving child privacy. In August, the Department of Justice announced a $400 million settlement with TikTok and ByteDance to resolve allegations of COPPA violations.
On August 26, 2026, 47 states and several U.S. territories reached a $17.1 billion settlement with Meta over claims the company's platforms harmed children. Alabama's share is about $117 million. The agreement requires Meta to implement stronger age assurance, time limits, nighttime restrictions, parental controls and other safety measures.
New Mexico went even further. Meta has to pay $567 million to fund treatment services for children and teens, and to make design changes to Facebook and Instagram.
These cases don't all involve the same allegations or legal theories. But together, they show that courts and regulators are increasingly examining how social media affects children and how tech companies collect and handle children's information.
What Parents Can Do
Age assurance could make it harder for a child to simply enter a false birthday and access a social media platform, but no technology is perfect. Because of this, we may be facing new risks as age verification processes change.
At this point, whether data privacy lawsuits will become the next wave of litigation involving social media platforms is unknown. But the misuse or improper handling of underage users' information, like failing to delete data as per child privacy laws, is a possibility.
How parents can protect children online involves several considerations. It’s important to be informed about the risks and dangers, understanding what happens behind the scenes, following lawsuits against Meta, ByteDance, Snap, and Google.
