Brazil’s National Data Protection Authority (ANPD) has fined ByteDance, the parent company of TikTok, 153.7 million Brazilian reais (€25.57 million) for irregularities surrounding the processing of personal data belonging to children and adolescents.
The regulatory decision was published in the *Diário Oficial da União* following the conclusion of an administrative procedure that spanned nearly two years.
In an official statement, the regulatory body noted that ByteDance’s practices failed to comply with the nation’s General Data Protection Law (LGPD) across two platform access modes: the “unregistered feed”—accessible to any user without creating an account—and the “registered feed,” tied to an active profile on TikTok.
Throughout the investigation, the ANPD determined that TikTok’s mechanisms were insufficient to prevent the improper processing of minors’ personal data at the source. Technical evaluations concluded that the platform lacked concrete evidence demonstrating the effectiveness of its technical and organizational measures to ensure LGPD compliance.
Read more: European Commission accuses TikTok of failing to ensure safe accounts for minors
Beyond the monetary sanction, ByteDance must erase all data collected improperly and has agreed to execute a comprehensive compliance plan to upgrade protection standards for young users.
Key requirements under the enforcement order include:
Automatically applying the most restrictive privacy settings to accounts held by users under 16, requiring explicit parental or guardian approval for any modifications. Strengthening oversight tools available to parents and implementing stricter content filters.
Suspending targeted advertisements nationwide for guest browsing, restricting accessible content to all-ages material, capping screen time at 12 hours, and blocking posting privileges and live-stream viewing for non-registered users.
Read more: EU, Meta and TikTok join forces to combat disinformation on Ceuta
During a press conference, ANPD President Waldemar Gonçalves Ortunho Júnior emphasized that the agency operated under a strictly technical approach grounded in existing statutory authority.
Fabrício Guimarães Madruga Lopes, Superintendent of Enforcement at the ANPD, highlighted that ByteDance failed to implement necessary safeguards preventing unauthorized access by minors. The regulator noted that ByteDance processed data belonging to children and young adolescents despite the platform’s internal terms recognizing its service as unsuitable for users under the age of 13.
The ANPD also confirmed it has launched two monitoring proceedings targeting 22 digital platforms to assess compliance with the digital provisions of the country’s Child and Adolescent Statute (ECA Digital).
