Brazil’s data protection authority said the decision should serve as a signal to other digital platforms.
Brazil’s National Data Protection Authority (ANPD) fined TikTok R$153.7 million (approx. $30 million) for violations involving the processing of minors’ personal data. In determining the amount of the fine, the regulator took into account the company’s revenue in Brazil, the scope of the violations, the number of people affected, and the greater vulnerability of children and teenagers.
Fabrício Guimarães Madruga Lopes, ANPD’s superintendent of enforcement, described the decision as “a powerful signal” to other digital platforms. He said the agency is currently investigating a number of companies under Brazil’s General Data Protection Law (LGPD), the Digital Child and Adolescent Statute, and the Civil Rights Framework for the Internet. The companies include Claro, Serasa, and Discord, as well as providers of pornographic content.
ANPD ordered TikTok to delete data collected unlawfully and strengthen protections for children and teenagers. The case against the platform began in November 2024. According to ANPD Chairman Waldemar Gonçalves Ortunho Junior, during that time the company was given opportunities to bring its practices into compliance with the law.
The new compliance plan requires TikTok to automatically apply stricter privacy settings to accounts belonging to users under 16. These settings may only be changed with parental or guardian authorization. TikTok must also strengthen parental supervision tools and adopt stricter content filters.
The company is required to ban ads on minors’ accounts, including during live streams. ANPD stressed that its oversight will not end with the compliance plan: implementation of the plan itself will also be subject to oversight.
The violations were identified in two ways of accessing TikTok: without creating an account and after logging into an account. In the first case, the regulator found that the platform allowed children and teenagers to access the feed while processing their personal data without a valid legal basis.
In the logged-in version of TikTok, ANPD found irregularities in the processing of data to create accounts for children and teenagers, as well as insufficient measures to prevent members of this group from registering. In both cases, the agency said TikTok failed to demonstrate that it had adopted effective measures to ensure compliance with data protection rules.
ANPD is also conducting a separate enforcement proceeding involving Discord. The regulator temporarily suspended live streams on the platform in Brazil following the death of a 13-year-old girl who participated in a live stream on July 22.
ByteDance, TikTok’s parent company, may appeal the penalty to ANPD’s board within 10 business days of being notified of the sanction, which occurred on August 24.
Source: Valor International
