Brazil fines TikTok record US$30 million for profiting from children’s data

Brazil's data protection authority, ANPD, has imposed a record fine of US$30 million on ByteDance, the parent company of TikTok, for violating data protection laws concerning children's data. This is the largest fine ANPD has ever imposed. The authority found five breaches of Brazil's data protection law and gave ByteDance 10 working days to appeal.

The company must erase the records of users aged 13 to 18 whose parental authorization is not regularized within 60 working days. Additionally, ByteDance must inform all partners it passed the records to do the same and provide system logs signed off by its data protection officer. If ByteDance fails to meet any of these conditions, it will face a daily fine of over US$26,000.

The ANPD's investigation began in March 2021, following a complaint from a federal lawmaker about a report by Vice Italy detailing the data collected by TikTok from users who never opened an account. During the investigation, TikTok claimed its terms of service set a minimum age of 13, and that it had removed 7.75 million children's accounts in Brazil between October 2022 and September 2023.

However, the ANPD found that the company's age gate was easily circumvented, and that the presumption of parental authorization found no support in Brazilian law. ByteDance also provided incomplete information about the data collected by the app's logged-out feed and whether the feed collected unique advertising identifiers. The ANPD split the fine into three parts based on the specific articles violated, with two fines totaling US$12.27 million each and a third fine of US$5.32 million for failing to demonstrate compliance.