This Week in Privacy: Aug 17-23, 2026
This was the week Big Tech faced the bill for children's privacy violations. TikTok wrote a check for $400 million to settle federal charges, while Meta found itself defending similar accusations in not one but two major trials. The message from regulators and state prosecutors is clear: platforms that profit from young users will be held accountable for how they collect data and design addictive features.
Top Stories
The Justice Department closed its COPPA case against TikTok with a $400 million settlement, ending a lawsuit filed two years earlier under the Biden administration. Federal prosecutors had accused TikTok and ByteDance of illegally collecting personal information from children under 13, even in the app's supposed "Kid Mode," and failing to delete accounts when parents requested it. The settlement dismisses the civil case with prejudice, meaning the government cannot bring the same COPPA claims again. While $400 million is substantial, it's a fraction of TikTok's revenue and buys the company closure on federal child privacy enforcement dating back to 2024.
Meta is fighting a two-front legal battle over how it treats young users. In Oakland, California, 29 states are suing the company for allegedly violating federal and state children's privacy laws. Internal Meta documents presented in court reveal that the company identified millions of underage Instagram users and conducted research showing that features designed to maximize screen time conflicted with user well-being. Yet Meta continued targeting young users while publicly claiming its platforms were safe. The states want billions in damages and structural changes to Facebook and Instagram, including elimination of infinite scroll and public "like" counts. A parallel trial involves four states, California, Colorado, Kentucky, and New Jersey, focusing specifically on COPPA violations and the deliberate design of addictive features. Both cases stem from a 2023 multi-state investigation.
Artificial intelligence training emerged as a new privacy battleground. A Twitch streamer filed a class action lawsuit alleging Amazon used creators' streams and videos to train generative AI models without permission or payment. The complaint claims Amazon's systems were built to capture content without securing consent from the people being recorded. Twitch introduced an opt-out setting for AI training shortly before the lawsuit landed. Meanwhile, nine major tech companies, including Apple, Meta, Amazon, Microsoft, Nvidia, Samsung, Adobe, Alphabet, and ElevenLabs, face a federal class action in Chicago from journalists, podcasters, and audiobook narrators who say their voice recordings and biometric data were scraped from the internet to train AI models. The lawsuits invoke Illinois' Biometric Information Privacy Act, claiming companies failed to inform users, obtain consent, or establish data retention policies as required by state law.
Germany's competition authority handed Apple a significant defeat over App Tracking Transparency. The Bundeskartellamt ruled that Apple's consent prompts, launched in April 2021, unfairly favor Apple's own apps through biased wording, design, and symbols that encourage users to share data with Apple while discouraging consent for third-party apps. Apple must redesign the prompts to be neutral within four months, and an independent trustee will monitor compliance for seven years. The ruling challenges Apple's claim that App Tracking Transparency was purely a privacy feature, finding it also functioned as competitive advantage.
In Brief
- Discord suspended livestreaming in Brazil after a July 2026 incident where a 13-year-old girl was allegedly coerced into suicide during a livestream, prompting the national data protection agency to cite inadequate prevention of harmful content targeting minors.
- TikTok settled a separate lawsuit in January 2026 from a 19-year-old alleging the platform's addictive design caused depression and suicidal thoughts, just before jury selection was set to begin.
- Apple American Group notified employees in mid-August that an unauthorized actor accessed network servers in April 2026, compromising files with personal information, though no identity theft or fraud has been detected.
- Italy's data protection authority fined Poste Italiane and PostePay a total of €6.62 million for GDPR violations involving mismanagement of a banking app, part of €225 million in European penalties issued in Q2 2026.
The Big Picture
After years of warnings and incremental enforcement, regulators and state attorneys general are taking Big Tech to task for what happens when children use their platforms. The combined legal pressure, spanning COPPA violations, mental health harms, and deceptive design, suggests a fundamental shift in how governments view platform accountability for young users. Meanwhile, the AI training lawsuits signal that the next privacy frontier involves not just how companies collect data, but how they repurpose existing content to build new technologies without compensating or even notifying the people whose voices, faces, and creative work fuel those systems. The settlements and trials this week aren't isolated incidents but early chapters in what will likely be years of litigation defining the boundaries of acceptable data use in the AI era.