Brazil fines TikTok record US$30 million for profiting from children’s data

Brazil's National Data Protection Authority (ANPD) has imposed a record fine of US$30 million on ByteDance, the parent company of TikTok, for its practices concerning children's data. This penalty, levied on Tuesday, is the largest since the ANPD was established in 2020.

The authority identified five breaches of Brazil's data protection law. ByteDance has been given 10 working days to appeal the decision. In addition to the fine, the company faces stringent requirements: it must erase records of users aged 13 to 18 whose parental authorization is not properly regulated within 60 working days. Furthermore, ByteDance must ensure all partners who received this data do the same and provide system logs, signed by its data protection officer, as proof of compliance.

Failure to meet these obligations will result in a daily fine exceeding US$26,000. The ANPD's investigation, detailed in a 25-page technical note, found that users in Brazil could access personalized content immediately after downloading TikTok, without specifying their age or agreeing to terms of service. This contrasts with practices observed abroad.

Investigators noted that the logged-out feed feature was available in Brazil but restricted in the United States and Europe. Screenshots of the sign-up screens encountered overseas were submitted as evidence. The ANPD also referenced a 2023 ruling by the European Data Protection Board, which highlighted that access to TikTok in the European Union was limited to registered users. ByteDance, headquartered in Beijing, operates TikTok, one of the world's most popular social media platforms.