Brazil's Data Protection Agency Fines TikTok R$ 153.7 Million Over Minors' Data

Brazil's National Data Protection Agency (ANPD) has fined ByteDance, the parent company of TikTok, R$ 153.7 million for irregularities in the processing of data belonging to children and adolescents. The sanction, published in the Official Gazette of the Union on Tuesday, marks the largest fine ever issued by the agency since its creation. The ANPD identified five violations of the General Data Protection Law (LGPD) occurring across two access methods: the registered feed and the feed accessible without an account. The agency concluded that TikTok processed the data of minors without a valid legal basis and failed to implement effective measures to prevent such processing.

As part of the ruling, the ANPD ordered the deletion of irregularly collected data. ByteDance has committed to a compliance plan to strengthen protections for minors. For users under 16, the platform will automatically apply more restrictive privacy settings that can only be changed with parental authorization. The plan also includes reinforced parental supervision and stricter content filters. For users accessing the platform without an account, the experience will be limited to 12 hours, and the company must suspend all advertisements in Brazil. Additionally, non registered users will be blocked from creating content, commenting, sending direct messages, following other profiles, or accessing live broadcasts. Data collection for these users will be reduced to minimum information regarding language, region, and device.

The ANPD's Board of Directors approved the compliance plan with the requirement that the company adhere to age verification rules established by the Digital Statute of the Child and Adolescent (ECA Digital). ByteDance was notified of the penalty on Monday and has ten business days to appeal the decision to the agency's Board of Directors.