Epic Games agreed to pay $275 million in December 2022 to settle Federal Trade Commission and Department of Justice allegations that Fortnite violated the Children's Online Privacy Protection Act, the largest civil penalty the FTC has ever obtained for breaking one of its own rules. That single case anchors a run of children's-privacy enforcement that has produced at least $540 million in disclosed COPPA penalties since 2018, spread across gaming, streaming video, voice assistants, game consoles, and ed tech.
This is the full ranked list: every major COPPA settlement, what triggered it, how the pace of enforcement has changed, and which company types keep showing up on the list.
What is the largest COPPA fine ever issued?
The $275 million penalty against Epic Games, announced December 19, 2022, is the largest COPPA fine on record and, per the FTC's own release, the largest civil penalty the agency has ever obtained for violating any FTC rule. The complaint alleged Epic collected personal information from Fortnite players under 13 without notifying parents or getting verifiable consent, and that default settings enabled voice and text chat between children and strangers. A companion $245 million order, covering dark-patterns billing practices rather than COPPA itself, brought Epic's total FTC relief to $520 million, but the $275 million figure is the COPPA-specific number that sets the record.
Every case on this list involves a service regulators found was popular with, or specifically directed at, children under 13, the same population covered in our full breakdown of children's online privacy numbers. Six settlements have now crossed the eight-figure mark, and every one of them involves a platform with hundreds of millions of registered accounts.
Figure 1: The six largest confirmed COPPA settlements by dollar amount. Source: FTC and DOJ press releases, 2019 to 2025.
Sites and apps that collect any information from children, including a children-directed audience segment covered in our full child-privacy breakdown, face the same knowledge test regulators applied in every case above.
How has COPPA enforcement changed since 2018?
COPPA enforcement has shifted from single-digit-million penalties against smaller apps toward nine and ten-figure settlements against the largest consumer platforms. Oath (formerly AOL) opened the current era with a $5 million settlement in December 2018 over programmatic ad auctions on child-directed sites, and every subsequent year through 2025 produced at least one settlement of $1 million or more.
Figure 2: Confirmed COPPA settlements by year. Source: FTC and DOJ press releases and case filings, 2018 to 2025.
The trend line is not just bigger dollar figures. It is a widening list of company types: game studios, video platforms, voice assistants, console makers, ed tech vendors, and entertainment studios have all settled COPPA cases since 2018, a spread that did not exist in the law's first two decades.
How much has TikTok paid in COPPA-related fines?
TikTok's predecessor, Musical.ly, paid $5.7 million in February 2019 to settle FTC allegations that it collected children's names, email addresses, and other personal information without parental consent, the largest COPPA penalty at the time. That settlement required Musical.ly to delete videos and account data belonging to users under 13.
TikTok's exposure did not end there. The DOJ and FTC filed a new civil lawsuit against TikTok and ByteDance in August 2024, alleging the platform knowingly let children keep regular TikTok accounts and made it difficult for parents to delete a child's account and data. As of November 2025, a federal judge in the Central District of California had largely denied TikTok's motion to dismiss and adopted a tentative ruling allowing the case to proceed, so treat any penalty figure for this case as unresolved, not a settled historical fact, until a court order or settlement sets one. Platform-level enforcement like this sits alongside the wave of account removals covered in our count of underage children removed from social media platforms.
Figure 3: Count of publicly confirmed COPPA settlements of $1 million or more, by year the settlement was announced. Source: FTC and DOJ press releases, 2018 to 2025.
Enforcement pace is uneven year to year, but no year since 2018 has passed without at least one confirmed COPPA action against a platform children were actively using, a pattern our look at how many child-directed apps illegally track kids tracks from the app-store side of the same problem.
What actually triggers a COPPA violation?
Every settlement above turns on the same legal test: did the operator have actual or constructive knowledge that a user was under 13, and did it collect personal information from that user without first getting verifiable parental consent. Regulators do not need proof a company targeted children specifically; internal data, age fields, or a service that is obviously popular with kids can establish knowledge on its own.
Figure 4: The knowledge-and-consent test regulators applied in the Amazon, Microsoft, and Epic Games cases. Source: FTC COPPA Rule guidance and case complaints, 2022 to 2023.
A privacy policy that never states what data is collected from minors, how consent is obtained, or how a parent can request deletion is the first thing investigators check once a knowledge question is raised. Businesses that operate any child-directed service, or a mixed-audience service with a meaningful under-13 user base, can generate a privacy policy built around COPPA's disclosure requirements covering parental consent, data retention, and deletion rights in the specific language regulators look for.
Which company types pay the most in COPPA settlements?
Grouped by business type, gaming and entertainment companies account for the largest share of confirmed COPPA penalty dollars since 2018, driven almost entirely by Epic Games' $275 million case plus Cognosphere's $20 million and Disney's $10 million settlements. Social media and video platforms rank second, led by Google and YouTube's $170 million case.
Figure 5: Cumulative confirmed COPPA penalty dollars by company type. Source: PrivacyTerms.io tally of FTC and DOJ press releases, 2018 to 2025.
Voice assistants and game consoles form a smaller but consistent third category, with Amazon's Alexa case and Microsoft's Xbox case together accounting for $45 million, both settled within weeks of each other in mid-2023.
How is the $540 million in penalties distributed among the biggest cases?
A small number of cases account for almost all of the money. Epic Games alone represents just over half of the $540 million tracked here, and the top two cases combined, Epic Games and Google/YouTube, account for more than 80% of every confirmed dollar.
Figure 6: Share of the top six confirmed COPPA settlements by dollar amount. Source: FTC and DOJ press releases, 2019 to 2025.
That concentration means the headline total is sensitive to a single new mega-case. A future settlement in the pending TikTok/ByteDance litigation, once resolved, could meaningfully shift every percentage in this chart.
COPPA Settlements Ranked by Size
| Company | Year | Penalty | Violation type |
|---|---|---|---|
| Epic Games (Fortnite) | 2022 | $275,000,000 | No parental consent; default voice/text chat enabled for children |
| Google / YouTube | 2019 | $170,000,000 | Tracking cookies on child-directed channels without consent |
| Amazon (Alexa) | 2023 | $25,000,000 | Retained children's voice recordings past deletion requests |
| Microsoft (Xbox) | 2023 | $20,000,000 | Collected and retained kids' account data before parental consent |
| Cognosphere (Genshin Impact) | 2025 | $20,000,000 | No parental consent; deceptive loot-box odds disclosures |
| Disney | 2025 | $10,000,000 | Mislabeled child-directed YouTube videos, enabling data collection |
| Edmodo | 2023 | $6,000,000 | No parental consent; penalty later suspended, unable to pay |
| Musical.ly (TikTok) | 2019 | $5,700,000 | No parental consent; ignored parent complaints about child users |
| Oath (AOL) | 2018 | $5,000,000 | Programmatic ad auctions on child-directed sites without consent |
| WW International / Kurbo | 2022 | $1,500,000 | Collected children's health data via a weight-loss app |
Source: FTC and DOJ press releases and consent orders, 2018 to 2025. The $275 million Epic Games penalty remains the largest single COPPA settlement in the table above.
The Bottom Line
COPPA enforcement has not slowed since Epic Games' record $275 million penalty in 2022. Six settlements have now cleared eight figures, at least $540 million in confirmed penalties has landed since 2018, and the DOJ's active lawsuit against TikTok and ByteDance means the total is likely to grow again before this page's next refresh. The knowledge-and-consent test behind every case on this list applies the same way to a small mixed-audience app as it does to a platform with a billion accounts: know your under-13 users exist, disclose what you collect from them, and get verifiable parental consent before you collect it.
Frequently Asked Questions
What is the largest COPPA fine ever issued? Epic Games paid $275 million in December 2022 to settle FTC and DOJ allegations that Fortnite violated the Children's Online Privacy Protection Act, the largest civil penalty the FTC has ever obtained for violating any of its rules.
How much has TikTok paid in COPPA-related fines? TikTok's predecessor, Musical.ly, paid $5.7 million in February 2019, the largest COPPA penalty at the time. The DOJ and FTC sued TikTok and ByteDance again in August 2024 over new alleged COPPA violations, and as of November 2025 that case had survived a motion to dismiss with no penalty amount yet determined.
How much money has the FTC collected in COPPA penalties in total? At least 540 million dollars across the 13 largest disclosed FTC and DOJ COPPA settlements since December 2018, per a PrivacyTerms.io tally of individual FTC and DOJ press releases. That figure excludes numerous smaller sub-1-million-dollar cases and penalties suspended for a defendant's inability to pay.
What actually triggers a COPPA violation? Collecting personal information from a user under 13 without verifiable parental consent, when the operator has actual or constructive knowledge that the user is a child. Recent cases like Amazon's 25-million-dollar Alexa settlement (2023) and Microsoft's 20-million-dollar Xbox settlement (2023) both turned on this knowledge test.
Where the Numbers Come From
- Federal Trade Commission. (2022). "Fortnite Video Game Maker Epic Games to Pay More Than Half a Billion Dollars." $275 million COPPA penalty, announced December 19, 2022.
- Federal Trade Commission. (2019). "Google and YouTube Will Pay Record $170 Million." $136 million to the FTC, $34 million to New York, announced September 4, 2019.
- Federal Trade Commission. (2023). "FTC and DOJ Charge Amazon with Violating Children's Privacy Law." $25 million penalty, announced May 31, 2023.
- Federal Trade Commission. (2023). "FTC Will Require Microsoft to Pay $20 Million." Settlement agreed June 5, 2023.
- Federal Trade Commission. (2025). "Genshin Impact Game Developer Will Be Banned From Selling Lootboxes to Teens Under 16." Cognosphere, $20 million, announced January 17, 2025.
- Federal Trade Commission. (2025). "Court Approves Order Requiring Disney to Pay $10 Million." Approved December 31, 2025; settlement announced September 3, 2025.
- Federal Trade Commission. (2023). "FTC Says Ed Tech Provider Edmodo Unlawfully Used Children's Personal Information." $6 million penalty suspended for inability to pay, announced May 22, 2023.
- Federal Trade Commission. (2019). "Video Social Networking App Musical.ly Agrees to Settle FTC Allegations." $5.7 million, announced February 27, 2019.
- Federal Trade Commission. (2022). "FTC Takes Action Against Company Formerly Known as Weight Watchers." WW/Kurbo, $1.5 million, announced March 4, 2022.
- Federal Trade Commission. (2024). "FTC Investigation Leads to Lawsuit Against TikTok and ByteDance." Civil suit filed August 2, 2024; case active, no penalty set as of this post's freshness date.
Note: All figures verified as of July 2026. The $540 million cumulative figure is a PrivacyTerms.io sum of the 13 largest individually confirmed FTC and DOJ COPPA settlement press releases since December 2018, not an official FTC-published total, and excludes smaller cases and any penalty suspended for inability to pay. The TikTok and ByteDance case remains active litigation with no penalty determined; this page will be updated once that case resolves.
