Brazil's National Data Protection Authority has fined TikTok owner ByteDance R$153.7 million for collecting personal information from children and adolescents who did not have accounts on the social media platform.
The federal regulatory agency, known as the ANPD, ordered the Beijing-based technology company to delete all improperly collected data within 60 days. ByteDance must also submit and execute a comprehensive compliance plan to improve how it processes the personal information of minors.
The enforcement action follows an investigation revealing that TikTok allowed unregistered visitors to view short-form videos without setting up an account or submitting personal registration details. According to the ANPD, the platform nevertheless gathered virtual profile data on those unregistered users for targeted advertising profiling without receiving any form of user consent.
Regulatory inspectors also identified critical vulnerabilities in TikTok's age verification safeguards. The flaws left the social video platform unable to properly verify the age of children registering as users on the network.
Regulatory findings and legal framework
The ANPD grounded its decision on Brazil's General Data Protection Law, known as LGPD, alongside the country's Digital Child and Adolescent Statute. The LGPD serves as Brazil's primary data privacy statute, granting federal regulators broad oversight to penalize companies that misuse personal information. The agency based the penalty on an official technical note from its internal control department, which cited international regulatory precedents in similar data privacy cases involving tech platforms.
Speaking on CNN Brasil's Live CNN program on Thursday, political analyst Clarissa Oliveira described the ruling as a milestone in the punishment of big tech companies in South America's largest country. She stated that collecting data from individuals who had never even opened an account represented one of the most severe infractions uncovered during the regulatory audit.
Industry impact and warning to platforms
Oliveira characterized the fine as a symbolic and exemplary sanction at a time when major digital platforms face growing global scrutiny over child safety. She noted that courts and observers had previously criticized the ANPD for moving too slowly to enforce strict penalties, pointing to platforms such as Discord where serious crimes were documented without triggering immediate major fines from the data protection watchdog.
The analyst warned that the ruling serves as a direct alert to other social media firms operating in Brazil, noting that platforms risk similar multi-million-real penalties if they fail to align their data collection practices with existing statutory rules.
ByteDance response and compliance commitments
In a statement sent to news outlets, ByteDance said it has cooperated fully with Brazilian regulators since the start of the investigation. The parent company confirmed it signed a formal compliance plan to implement all necessary adjustments demanded by the agency.
ByteDance emphasized that the infractions identified by the ANPD involve historic practices occurring prior to the start of the regulatory audit. The company added that it has already implemented multiple corrective measures to upgrade its platform security and user privacy protections since the period in question.
