Brazil’s data protection regulator has ordered ByteDance, the China based company behind TikTok, to pay 153.7 million reais, about $27 million, over rules tied to the handling of children’s and teens’ personal data.
The decision comes days after the ANPD banned Discord from live streaming, following the regulator's determination that there were risks to Brazilian children — including dangers such as incitement to self-harm and even suicide.
The National Data Protection Authority, ANPD, said ByteDance broke Brazil’s General Data Protection Law, known as the LGPD. It pointed to two user paths inside TikTok. One is the logged out feed, which shows content without making an account. The other is the experience for people who have already registered.
According to the ANPD, in each situation TikTok collected or used personal data from minors without a sufficient legal reason. The regulator also said the company did not put in place steps that could stop that kind of processing in a real way.
The ANPD listed five separate breaches. These included using minors’ data with no proper legal basis, not doing enough to reduce the chances that minors would access or sign up on the app, and not being able to prove that its privacy steps actually worked.
The regulator also told ByteDance to remove the data it gathered in the wrong way. ByteDance may contest the fine before the ANPD board. It has 10 business days from when it gets the notice to file.
In addition to the payment, ByteDance agreed to roll out a compliance plan. The goal is to improve how TikTok protects kids and teens.
The plan says that accounts for people under 16 will be set to the tightest privacy options right away. Those settings cannot be changed unless a parent gives approval. TikTok will also add stronger controls for parents and apply tighter content checks.
If someone uses TikTok in Brazil without creating an account, ByteDance will pause ads for that group. It will also keep the service limited to material meant for all ages. The company will collect and handle less personal data.
When you are signed out, the time window is capped at 12 hours. During that period, you cannot post new content. You also cannot leave comments, send private messages, or follow other users. You cannot be followed either. Live streams will not be available to you. Content suggestions will be reduced too.
In the signed out mode, the firm will collect only the data it says it needs. It will cite content matching, fraud checks, and how the app runs.
In a separate decision, the ANPD board approved ByteDance’s compliance plan on appeal. The board also required ByteDance to meet age checks set out under Brazil’s Digital Child and Adolescent Statute.
Rules are tightening in Brazil and other places as agencies look harder at how social media sites treat kids’ private information and safety online.
People have also raised concerns about TikTok as more teens and young adults use it. They point to how the app gathers data, how it runs ads tied to user behavior, and how its feed chooses content based on each person.
Brazil’s ANPD said the steps it agreed on with ByteDance are meant to lower the earlier risks it noted. It said this includes stopping ads and turning off live video and direct messages for anyone using TikTok without making an account.
