TikTok buys its way out of trial: age checks and a night curfew for Alabama teens

Four days before a jury was due to hear Alabama's case against it, TikTok settled. The company will pay the state at least 100 million dollars, rising to as much as 300 million if enough other states sign comparable deals, and it has agreed to rebuild how the app behaves for teenagers. A two hour daily cap, no access between midnight and 6am, age checks, private accounts by default, no cosmetic filters.

The detail worth pausing on is not the money. It is that these rules apply to teenagers in Alabama. Not to teenagers. To teenagers in one American state, because that is the state whose attorney general brought the case.

What TikTok agreed to

The list in the attorney general's announcement is unusually specific for a settlement. It reads less like a penalty and more like a product specification written by a government lawyer.

TikTok's statement was brief and predictable, saying the deal builds on its existing commitment to safety tools. The money is due within 45 days.

Age verification is arriving through the courts now

For two years the story about age checks has been a story about legislation: bills in US states, the Online Safety Act in Britain, the under-16 ban in Australia. This is a different route to the same place. No statute was passed in Alabama. A lawsuit was filed, a trial date approached, and the company bought its way out by agreeing to the thing a law would have required.

That route has properties a law does not. It is faster, it is not debated in public, it binds one company rather than a market, and it is not reviewable by a court for constitutionality in the way a statute is, because the company consented. It also scales by imitation: the terms here mirror what Meta accepted from the states in August, and Alabama's share of that one was 117 million dollars. We wrote about that case when it was still heading for trial with damages estimates running into the trillions.

The geography problem nobody has solved

A settlement that binds behaviour in Alabama requires TikTok to know two things about a user: roughly how old they are, and which side of a state line they are on. Neither is a solved problem, and both are the machinery that pushes people towards VPNs in the first place.

Location is inferred from the network, which is precisely what a tunnel changes. That is not a recommendation, it is a description of a design that assumes the network tells the truth about where you are. When Utah tried to make websites detect and block suspected VPN traffic, the same assumption was the load-bearing part. Age is harder still: "robust age assurance" in a settlement document means document checks, face estimation or a third-party vendor holding both, and the choice between those is where the privacy cost actually lands.

We keep the running list of the legislative version of this in our guide to countries restricting social media for minors, and the regulatory version in Europe when the European Commission charged TikTok under the DSA over minors' accounts.

What this actually changes

For a teenager in Alabama, quite a lot, at least on TikTok. For everyone else, nothing yet, and that "yet" is doing real work: the ceiling on the payment is explicitly tied to other states signing similar deals, so the agreement contains its own incentive to spread. Twenty-seven states and Washington DC have comparable suits pending.

The broader shift is that a platform's safety design is now something a state can buy in a negotiation. Whether that is better or worse than legislating it depends on what you think of rules written by two sets of lawyers with a trial date approaching and no public reading of the text beforehand.