What happened
Texas Attorney General Ken Paxton announced that his office was granted partial summary judgment in its lawsuit against TikTok over the platform's representations about the safety of its service for minors.
Paxton filed the case in January 2025, alleging that TikTok marketed the platform as safe for children while minors could still encounter inappropriate content involving drugs, nudity, injuries and profanity, in violation of Texas consumer protection law. A Texas district judge ruled that TikTok is liable for misrepresenting key factors of its content moderation and the availability of inappropriate or explicit material to minors, including content accessible while the platform's Restricted Mode was enabled.
The ruling is not the end of the case. It resolves liability on the misrepresentation claim and sends the matter to trial, where the court will consider relief and penalties. Paxton's office has also brought a separate action against TikTok alleging violations of the Securing Children Online Through Parental Empowerment Act over its handling of children's privacy and online safety.
Why this is a GRC story
This is a case about representations rather than data security, and that is what makes it instructive for governance teams. The state did not have to prove a breach. It had to show a gap between what the company said about a control and what the control did. That gap is a governance failure before it is a legal one, because the claim was reviewed by marketing, published to parents, and never reconciled with testing evidence from the team that built the feature.
Restricted Mode is the detail worth sitting with. A named safety feature that does not perform as described leaves an organisation worse placed than one that never made the promise, because the promise is public and dated. Every public safety claim is, in effect, an assertion about control effectiveness, and assertions about control effectiveness are exactly what auditors and regulators test.
There is a structural point too. Consumer protection statutes written for advertising have been stretched to cover product design claims, and state attorneys general are filling the space while federal activity on technology regulation remains uneven. A parallel privacy case under a state children's law reinforces that the exposure does not live only in one statute.
The control question that follows is unglamorous. Who signs off on a public claim about how a safety feature works, and what evidence are they shown before they do? For most organisations the honest answer is that no one owns that step, and it sits between product, legal and communications until something goes wrong.
What to watch
Watch the trial on relief and penalties, whether the liability finding is appealed, and whether other state attorneys general adopt the same theory against platforms or against other products with published safety or moderation claims.
The immediate internal step is a review of outward facing safety and moderation claims to confirm each one is backed by current test evidence. If a claim cannot be evidenced, it should be corrected or withdrawn before a regulator asks.
Attribution: Analysis based on JD Supra and related public reporting. This article is original commentary, not a repost of the source material.