Brazil’s move to fine TikTok’s parent, ByteDance, 153.7 million reais, about $27.4 million, is a warning to firms that run online, says digital-law specialist Filipe Ribeiro Duarte.
Duarte says the point is not only that companies claim they have data safeguards. Regulators will want proof that those safeguards actually work in real situations.
The matter started with Brazil’s National Data Protection Authority, ANPD. It centered on how TikTok handles data from children and teens.
The regulator said TikTok’s first age check was not enough. TikTok had used a user’s own claimed date of birth. The company said it closed around 7.75 million child accounts in Brazil from October 2022 through September 2023. The ANPD felt that number pointed to many kids getting through the first step. In their view, those users were able to watch and act on the app before the system caught them.
Duarte argued that age assurance should be handled with testing and follow up. He said checks need to be reviewed in light of the risks of the service. He added that the choice should not depend only on whether the method relies on self reported data or on newer tools. He said some platforms may have to use more than one layer. That can include verification, monitoring, and a clear response when issues show up.
The ruling also looked at TikTok’s feature called “feed without registration.” It lets people watch content without making an account. At the same time, details about video actions and device data could be used to tailor what the user sees.
Duarte said this outcome shows privacy risk checks should happen across the full user journey, not just during sign-up. He also said companies should treat features, screens, navigation steps, personalization tools, and ways users gain access as parts of their data protection plan.
The penalty was split into three parts. One part was 63.17 million reais. It covered the legal grounds used to handle the data. Another 63.17 million reais was tied to weak prevention. The last portion, 27.4 million reais, related to accountability and who is responsible.
Duarte said companies should look at the case in three ways. First, why they were permitted to process the data. Second, what controls they used to lower the risks. Third, how they can show those controls were put in place in practice.
The rules in Brazil are also being influenced by the Digital Child and Adolescent Statute, called ECA Digital. It is pushing more duties around age checks and safety steps for kids and teens when they go online. Duarte said that firms offering products or services that children and teenagers can reach should look again at what they do now. This includes their preventive steps, the legal grounds they rely on, and how they run their governance. He added that this is most important for tools that people can use without signing up.
“The ruling marks a clear shift in how enforcement works,” Duarte said. “The issue is not only whether a company has some control in place. It is also whether the control fits the risk, actually works day to day, and can be proven to do that.”
