São Paulo, Brazil – In a significant move that underscores a global surge in data privacy enforcement, Brazil’s National Data Protection Authority (ANPD) has levied a substantial fine of 153.8 million reais (approximately $29.81 million USD) against TikTok’s parent company, ByteDance. The penalty stems from allegations of unlawfully processing the personal data of teenagers, a decision that amplifies the mounting regulatory pressure on social media giants concerning the protection of minors.
This enforcement action marks one of Brazil’s most substantial data protection penalties against a major international technology platform. The ANPD’s investigation, which commenced in 2021, concluded that ByteDance’s Brazilian operations processed personal data of users aged 13 to 18 without a valid legal basis, in direct violation of the country’s General Data Protection Law (LGPD). The regulator estimates that the data of at least 8 million minors may have been improperly handled due to what it deems inadequate age-verification mechanisms employed by TikTok.
The scope of this penalty is particularly noteworthy as it extends beyond merely registered TikTok accounts. The ANPD’s scrutiny also encompasses the platform’s handling of younger users who access content without logging in, a practice that has raised significant concerns about data collection and processing in the absence of explicit consent or robust age verification.
Unpacking the Core Violations: Inadequate Age Verification and Unregistered User Data
At the heart of the ANPD’s decision lies the assertion that TikTok’s age-verification systems were insufficient to prevent underage individuals from accessing and interacting with the platform. The regulator estimates that the personal data of a considerable number of minors, potentially exceeding 8 million, may have been processed due to these shortcomings. This figure is contextualized by separate data indicating that TikTok removed approximately 7.75 million accounts belonging to children in Brazil between October 2022 and September 2023, a number that represented roughly 20% of the country’s child population. This statistic highlights the perceived scale of underage access that regulators believe the platform has grappled with.
A critical element of the ANPD’s investigation focused on TikTok’s "logged-out feed." This feature allows individuals to consume content on the platform without the necessity of creating an account. The ANPD found that children could access TikTok through this mechanism without adequate age verification, leading to the collection and processing of personal data even from users who had not formally registered. This approach, the Brazilian regulator pointed out, differed significantly from TikTok’s practices in major markets like the United States and Europe, where similar unrestricted access without age checks was reportedly not available. Consequently, the case transcends conventional account registration controls, raising fundamental questions about how digital platforms identify and safeguard minors who engage with content anonymously.
A Chronology of Regulatory Scrutiny and Enforcement
The ANPD’s investigation into TikTok’s data processing practices is not a recent development. It was initiated in 2021, indicating a multi-year examination that has now culminated in this significant enforcement action. The lengthy duration of the investigation underscores the complexity of digital data privacy issues and the thoroughness with which regulators are approaching these matters.
The timeline of events leading to this penalty can be broadly outlined as follows:
- 2021: The ANPD launches its investigation into TikTok’s data processing practices, focusing on the handling of personal data of minors.
- Ongoing (2021-2023): The ANPD conducts its in-depth analysis, gathering evidence and evaluating TikTok’s compliance with Brazil’s LGPD. During this period, TikTok reportedly removes millions of underage accounts in Brazil.
- Recent (October 2023): Separate reporting emerges detailing the significant number of underage accounts removed by TikTok in Brazil over a 12-month period, providing supporting data for the ANPD’s concerns.
- Present (March 2024): The ANPD announces its decision to impose a fine of 153.8 million reais on ByteDance and orders the deletion of unlawfully processed minors’ data, citing violations of the LGPD.
- Concurrent Developments: In parallel, ByteDance faces a substantial $400 million settlement in the U.S. related to allegations concerning children’s online privacy, highlighting a consistent pattern of regulatory challenges across different jurisdictions.
Supporting Data: Scale of Potential Impact and Previous Actions
The scale of the potential data breach is a central pillar of the ANPD’s case. The estimate of at least 8 million minors potentially affected underscores the vast reach of TikTok’s platform and the challenges in effectively segmenting and protecting different user demographics. The figure of 7.75 million underage accounts removed in Brazil between October 2022 and September 2023 serves as a stark indicator of the prevalence of minors on the platform, and by extension, the potential for their data to be processed without appropriate safeguards. This statistic, representing approximately 20% of Brazil’s child population, paints a vivid picture of the regulatory concern.
This Brazilian penalty follows closely on the heels of a significant $400 million U.S. settlement reached between TikTok, ByteDance, and U.S. authorities over allegations concerning children’s online privacy. In that agreement, TikTok committed to paying $300 million immediately, with an additional $100 million contingent on the treatment of an earlier consent decree. With over 200 million users in the U.S., this settlement further illustrates the global trend of increased scrutiny and financial penalties for social media platforms regarding child data protection.
Official Responses: ANPD’s Mandate and ByteDance’s Defense
The ANPD’s official statement articulated a clear mandate for ByteDance. Beyond the financial penalty, the authority has ordered ByteDance to delete all personal data belonging to minors where the company lacks appropriate legal consent or another valid legal basis for processing. TikTok has been granted a 60-day period to comply with this deletion order. Failure to adhere to this directive could result in additional daily fines, further increasing the potential financial burden on the company.
The ANPD’s action also mandates significant changes to TikTok’s privacy and child-safety framework within Brazil. These measures include:
- Tighter Default Privacy Settings: Implementing more restrictive privacy configurations by default for users under the age of 16.
- Stronger Parental Authorization: Requiring more robust parental consent mechanisms for certain platform functionalities and data processing activities.
- Enhanced Content Controls: Introducing improved tools for parents and users to manage the type of content they encounter.
- Restrictions on Functionality for Unregistered Users: Limiting features such as advertising, comments, social interactions, direct messaging, and livestreaming for individuals using TikTok without registered accounts.
- Stronger Parental Supervision and Content Filtering: Reinforcing parental oversight capabilities and implementing more effective content filtering systems.
ByteDance, in its defense, has argued that the Brazilian penalty pertains to practices dating back to 2021 and does not fully account for the significant compliance improvements implemented by the company during 2025. The company asserts its commitment to enhancing age-verification systems and child-safety measures in various markets, driven by increasing global regulatory pressure. This stance suggests a potential disagreement with the ANPD’s assessment of the current state of TikTok’s compliance.
Broader Implications: A Global Trend in Data Protection
The Brazilian enforcement action against ByteDance is more than an isolated incident; it is a potent signal of a broader global trend. Governments worldwide are intensifying their focus on the protection of children’s data online, recognizing the unique vulnerabilities of this demographic. The ANPD’s proactive stance, including its expansion of scrutiny across the digital sector with further investigations launched against 22 other digital platforms, demonstrates Brazil’s commitment to strengthening its online child protection framework.
This penalty adds to a rapidly escalating global compliance burden for ByteDance and other major social media platforms. As governments increasingly demand robust age verification, tighter data controls, and enhanced protections for young users, companies operating in the digital space must navigate a complex and evolving regulatory landscape. The implications of Brazil’s action are far-reaching, potentially influencing how other regulatory bodies approach similar cases and setting new precedents for data protection in the digital age, particularly concerning the welfare of minors. The consistent enforcement actions across continents signal a unified global push towards greater accountability and responsibility from social media companies in safeguarding their youngest users.
