Brazil fines ByteDance for minors' data

Brazil’s data protection authority, the ANPD, fined ByteDance, TikTok’s owner, 153.7 million reais for irregularities in the handling of children’s and adolescents’ personal data under the LGPD. The ruling, published in the Diário Oficial da União, also requires the deletion of irregularly collected data and the submission of a compliance plan to strengthen protections for users under 18.

What did the ANPD conclude about TikTok?

The ANPD said ByteDance processed personal data from minors ages 13 to 18 without a valid legal basis. According to Reuters, the authority also estimated that TikTok may have handled data from at least 8 million children during the investigation period, amid failures in its age-verification system.

The ANPD’s official communication said the case covered two ways of accessing TikTok, the feed without registration and the feed with registration. In both, it concluded that minors’ data was processed without an adequate legal basis.

What did the ruling order?

The decision requires the deletion of personal data from registered teenagers if legal representation or assistance is not regularized and documented within 60 business days. It also obligates ByteDance to comply with a conformity plan aimed at reinforcing protections for users under 18 in Brazil.

G1 reported that the resolution published by the ANPD in the Diário Oficial da União included both the deletion of irregularly collected data and the submission of that conformity plan. Reuters, in coverage republished by La Nación, also said the sanction was officially published and imposed for an alleged violation of Brazil’s General Data Protection Law.

How large is the sanction?

The fine was described in international coverage as the largest imposed by the ANPD since the authority was created in 2020. South China Morning Post described it as a record penalty of US$30 million in its coverage of the case.

The move creates a concrete regulatory front for platforms operating in Brazil or processing user data in that market, especially when they handle minors’ information and rely on age-verification controls and access controls for registered and unregistered users.