Brazil fines TikTok record US$30 million for profiting from children’s data

Brazil’s data protection authority fined ByteDance US$30 million on Tuesday over its handling of children’s data on TikTok, the largest penalty it has imposed since it was created in 2020.

The National Data Protection Authority, known as the ANPD, found five breaches of Brazil’s data protection law and gave ByteDance 10 working days to appeal.

The company must also erase the records of users aged 13 to 18 whose parental authorisation is not regularised within 60 working days, instruct every partner it passed those records to do the same, and report back with system logs signed off by its data protection officer. Failure on any of those counts carries a daily fine of over US$26,000.

According to Technical Note 50, the 25-page document that underpins the sanction, a user who downloaded TikTok in Brazil reached the personalised feed at once, without declaring an age or reading the terms of service. Investigators at the agency’s inspection unit ran the same test abroad.

The note says the logged-out feed was available in Brazil but was barred in the United States and Europe, and they filed screenshots of the sign-up screens they met overseas as evidence.

The document also cites a 2023 ruling by the European Data Protection Board recording that access to the app in the European Union was restricted to registered users.