Brazil's National Data Protection Authority has fined TikTok owner ByteDance R$153.7 million over irregularities in protecting the personal data of children and teenagers.
The regulatory sanction was officially published on Tuesday in the Diário Oficial da União, Brazil's official government gazette.
Alongside the financial penalty, the agency ordered ByteDance to delete the affected data within 60 days. The Beijing-based technology company must also notify users about the intervention in their account registrations once the data deletion is complete.
The National Data Protection Authority, known as ANPD, acts as Brazil's chief privacy regulator. The agency enforces compliance with the Lei Geral de Proteção de Dados, the national data protection law that establishes strict rules for handling sensitive personal information, particularly concerning minors.
Investigation into platform access modes
The fine followed an administrative investigation conducted by the ANPD's Superintendence of Enforcement. Regulators identified data handling practices that breached agreed standards under the privacy law across two distinct ways of accessing the social network.
Investigators examined both the unregistered feed, which allows anyone to view content without creating an account, and the registered feed linked to user profiles. In both modes, the agency determined that TikTok processed personal data belonging to children and teenagers without an adequate legal basis under Brazilian privacy rules.
ByteDance was formally notified of the penalty on Monday. The company has up to 10 business days from the notification date to lodge an appeal with the ANPD Board of Directors, the agency's top governing panel.
Approved compliance plan and parental controls
In response to the regulatory action, ByteDance committed to implementing a comprehensive improvement plan to upgrade data protections for young users. The ANPD Board of Directors approved the compliance proposal on appeal, publishing the decision in Tuesday's official gazette.
Under the approved plan, TikTok must automatically apply its most restrictive privacy settings to accounts registered to users under 16 years of age. These default settings can only be altered with explicit authorization from a parent or guardian.
The company is also required to strengthen parental control tools across the application. Additionally, TikTok must introduce stricter content filters to prevent underage users from viewing inappropriate material.
Strict limits on unregistered browsing
Major changes are also mandated for users who browse TikTok without creating an account. On the unregistered feed, the platform must completely suspend advertisements, limit displayed content to material suitable for all ages, and significantly curtail personal data processing.
The compliance plan imposes strict operational restrictions on unregistered access. Unregistered browsing will be capped at 12 hours, while content creation, social interactions, following other profiles, and being followed by others are entirely prohibited.
Unregistered users will also face restrictions on broadcasting or watching live streams on the platform. Furthermore, ByteDance must align its operations with Brazil's Digital Statute of the Child and Adolescent, known as ECA Digital, by implementing mandatory age verification systems for platform access.
ByteDance reported that privacy configuration changes will ensure only parents can modify account settings for young users. Brazilian news outlet CNN Brasil contacted ByteDance for comment regarding the ruling and is awaiting a response.
