Brazil fines TikTok owner ByteDance for unlawful processing of teenagers' data

Brazil's data protection authority, the ANPD, has imposed a record US$30 million fine on TikTok for violating the country's data protection law. The fine is the largest imposed by the ANPD since its creation in 2020. The agency found five breaches of the law and gave ByteDance 10 working days to appeal the decision. The company must erase the records of users aged 13 to 18 without proper parental authorization within 60 working days, and instruct all partners it passed these records to do the same.

They must also report back with system logs signed off by their data protection officer. Failure to comply could result in a daily fine of over US$26,000. The investigation began in March 2021 after a federal lawmaker raised concerns about a report by Vice Italy, which detailed how TikTok collects data from users who never opened an account.

The agency's inquiry found that the app's logged-out feed was available in Brazil but blocked in the US and EU, and they used screenshots of sign-up screens from overseas as evidence. The ANPD also cited a 2023 ruling by the European Data Protection Board, which noted that access to the app in the EU is restricted to registered users.

TikTok claimed its terms of service set a minimum age of 13, and that children under that age were not authorized users. However, investigators found that the age gate, a screen asking for a date of birth, could be easily bypassed. ByteDance argued that teenagers clicking through the terms of service formed a valid contract, as parents could be presumed to allow it.

But the agency rejected this claim, citing the Brazilian civil code, which denies individuals under 16 the capacity to enter a contract without a parent or guardian.