TikTok's $100M Alabama deal makes defaults the remedy

The money is the headline and the boring part. On September 25, Alabama Attorney General Steve Marshall announced a settlement in which TikTok pays the state at least $100 million — due within 45 days, rising to as much as $300 million if certain conditions are met. The part worth your engineering time is the rest of the document: a list of product defaults the company now has to ship. Not a promise to "prioritize safety." A spec.

What actually happened

Per the Alabama Attorney General's announcement, the deal resolves claims that TikTok built addictive features, exposed young users to mental-health harms, and misled the public about platform safety. TikTok did not admit wrongdoing, and told TechCrunch the agreement "builds on our commitment and core objective to continually enhance our robust safety tools to protect teens." The settlement landed the same week Alabama was set to be the first state to take its child-safety claims against TikTok to trial.

Here is the actual remedy list from the AG's office:

• A two-hour daily limit for underage users, with parental controls to tighten it further
• "Productive pauses" at 15, 60, and 90 minutes of continuous use
• Overnight access blocked from 12 a.m. to 6 a.m., with messaging and notifications restricted overnight and during school hours
• Enhanced age verification
• Stricter moderation, including limits on adults discovering teen accounts
• Cosmetic filters prohibited for teen users
• A non-personalized default feed for teens
• Improved parental control interfaces

That is a functional requirements doc written by a state attorney general. It follows TikTok's $400 million COPPA settlement with the DOJ in August — where the fix was largely process. This one reaches into the product.

Why product defaults matter for your business

Enforcement has moved from disclosure to configuration. The old pattern was a fine plus a privacy policy rewrite. The new pattern names the timer, the curfew hours, and which feed ranking a minor gets. If you ship anything consumer-facing with an under-18 population — a fitness app, a tutoring platform, a game, a loyalty program with a teen tier — assume the eventual remedy is a config change you will be ordered to make, not a paragraph you get to write.

Which means: make those knobs exist before someone specifies them. Time-of-day gating, session caps, per-cohort feed ranking, and notification windows should be server-side configuration keyed to an account's age band, not hardcoded behavior. If a state AG hands you "no notifications between midnight and 6 a.m. local time for users under 18," that should be a row in a table. If it requires a release, you have a problem — and a 45-day clock.

Age verification is now the load-bearing dependency. Every item on that list is meaningless without knowing who is a minor. An age checkbox at signup does not survive this. You need a stored age band, a defensible method of establishing it, and a log of when and how. We said this about the DOJ settlement's age-gate implications; Alabama just showed why the gate is what the remedies hang on.

Fifty states, fifty possible specs. Alabama got a two-hour cap and a midnight curfew. The next state may pick different numbers. A per-jurisdiction policy table — age band, jurisdiction, limit, curfew window, feature flags — is the only architecture that absorbs that without a rewrite per settlement. Build the table with one row in it today.

"We don't do personalized feeds" is not an exit. The non-personalized-default-for-teens clause is a recommender requirement. If any part of your product ranks content or offers by behavior, you need the ability to serve a deterministic, non-behavioral variant to a cohort. Most teams cannot do this without touching the ranking path. Find out which you are.

Sources: Alabama Attorney General's Office, TechCrunch.