SÃO PAULO - Brazil's National Data Protection Authority imposed its largest fine since its establishment in 2020 on Tuesday, ordering TikTok parent company ByteDance to pay 153.7 million Brazilian reais, equivalent to approximately $29.9 million, for systematic failures in the handling of personal data belonging to children and teenagers. The decision also orders ByteDance to delete all data collected in violation of Brazilian law and to implement a structured compliance plan, making it one of the most comprehensive regulatory actions taken against a global social media platform over child data protection in the region.
Brazil's data protection authority, known as the ANPD, found five separate breaches of the country's General Data Protection Law and gave ByteDance ten working days to appeal. The regulatory body said in its ruling that TikTok had breached data privacy laws across both logged-in accounts and guest browsing sessions through the collection and processing of young users' personal information without a valid legal basis or adequate safeguards.
The ANPD estimated that TikTok may have processed the data of at least 8 million Brazilian children, highlighting what it described as systemic deficiencies within the platform's age-verification mechanism. TikTok did not immediately respond to media requests for comment.
The Evidence: A Personalised Feed Before an Age Is Even Declared
The technical foundation of the ruling is contained in Technical Note 50, a 25-page document that underpins the sanction and provides the evidentiary basis for each of the five violations found by the ANPD.
The document's most striking finding concerns the most basic interaction a new user has with TikTok. According to Technical Note 50, a user who downloaded TikTok in Brazil reached the personalised feed immediately upon opening the app, without having declared an age or read the terms of service. In other words, TikTok's personalised content algorithm, driven by engagement data and designed to maximise time spent on the platform, was active before the platform had any information about who the user was, how old they were, or whether they had consented to data processing in any form.
The violation extends across both registered accounts and guest browsing sessions. Children using TikTok without creating an account, simply browsing the platform as guests, were also subject to data collection that the ANPD found to lack a valid legal basis. The combination of the two categories produced the ANPD's estimate of at least 8 million affected children.
Brazil's First Lady and the Political Pressure Behind the Fine
The ANPD's decision does not operate in a political vacuum. Brazil's government under President Luiz Inácio Lula da Silva has been working, with mixed results to regulate the use of the internet by minors, through both executive action and the country's Supreme Court. The fine arrives at a moment of heightened political pressure on TikTok specifically.
Brazil's First Lady Rosângela Lula da Silva, known publicly as Janja, said on August 6 that the platform should be taken offline entirely, citing the child data case that eventually produced Tuesday's ruling. Janja has been a consistent and vocal critic of TikTok's protections for children and teenagers, and her August 6 statement, made eighteen days before the fine was formally announced, reflected the political temperature in which the ANPD was completing its deliberations.
The ANPD's action against TikTok was accompanied this month by a separate order against Discord. The agency ordered the popular streaming platform Discord to suspend livestreams and video calls after a teenage girl was allegedly encouraged to take her own life during a broadcast. The two decisions together paint a picture of a Brazilian regulatory authority that is taking an active enforcement posture toward major platforms on child safety grounds, not as a one-off action but as an ongoing enforcement programme.
A Global Pattern of Child Data Enforcement
Brazil's $30 million fine against TikTok places it within a growing international sequence of regulatory actions targeting the platform's handling of children's data.
The UK's Information Commissioner's Office fined TikTok £12.7 million (approximately $15.9 million) in April 2023, finding that the platform had failed to adequately prevent children under 13 from creating accounts and had processed their data without parental consent. The ICO found up to 1.4 million children under 13 on the app in 2020, despite terms of service requiring users to be at least 13. The US Federal Trade Commission had fined TikTok $5.7 million in 2019, under its prior name Music.ly in a case involving similar allegations about the unlawful collection of children's personal information.
Brazil's $30 million fine is the largest of the three in dollar terms and represents a significant escalation in both the financial scale and the operational demands placed on ByteDance to remediate the violations found.
Countries including Australia, Canada, and Indonesia have been undertaking similar regulatory efforts to govern how online platforms manage young users' data and exposure to content. The trajectory from the UK's 2023 action to Brazil's 2026 ruling suggests that child data enforcement against major platforms is not a temporary regulatory priority but an accelerating one, with each successive fine building on the factual and legal groundwork established by prior actions in other jurisdictions.
