Conceptual still life featuring books and technology.
Brazil has fined TikTok’s owner over the way it handled children’s data, and the ruling covers people who never had an account.
The National Data Protection Agency imposed a penalty of 153.7 million reais on ByteDance on Tuesday, worth about $29.9m. It cited irregularities in the processing of data belonging to children and adolescents.
TikTok breached data privacy law across both logged-in accounts and guest browsing sessions, the regulator said in its ruling. It collected and processed young users’ personal information without a valid legal basis or adequate safeguards.
Mauricio Savarese reported the decision for the Associated Press. Agence France-Presse carried the agency’s figures.
The guest-session finding is the part that travels
Most child-safety enforcement to date has turned on accounts. Regulators ask how old a user said they were, what the platform did to check, and what settings applied afterwards.
Brazil has gone further. Its regulator found that the data problem existed for people browsing without signing in at all.
That reading does not depend on age verification working. It treats the collection itself as the breach, whoever is at the other end.
What TikTok has to do
The agency ordered ByteDance to delete the data it collected in violation of the rules. It also told the company to produce a plan for protecting minors better.
TikTok has committed to a compliance plan, the agency said. The platform will have to apply stricter privacy settings automatically to accounts belonging to under-16s.
It must also strengthen parental supervision systems and put in place stricter content filters.
ByteDance has 10 days to appeal. It did not comment to the AP and did not respond to AFP.
What the ruling does not do
Brazil has not suspended TikTok, blocked it or restricted what it publishes. The remedies all concern data and settings.
That is a narrower action than the one the first lady called for, and a narrower one than the country has taken before against a platform.
It is also the kind of order a company can comply with and keep operating, which is why the appeal is worth watching rather than assuming.
The same regulator moved on Discord this month
This is the second time in three weeks that Brazil’s data protection agency has acted against a platform over child safety.
It told Discord to suspend livestreaming after the death of a 13-year-old girl. Discord appealed on Monday and the agency has that appeal under review.
The two wire accounts differ slightly on that order. AFP describes the agency as having ordered the suspension, and the AP describes it as a recommendation.
An agency that was issuing recommendations three weeks ago is issuing fines now, whichever word applies.
Brazil has been building to this
A recent Brazilian law requires platforms to link accounts held by under-16s to a parent’s account, and to verify how old users are.
The country has form on enforcement. X was blocked in Brazil for 40 days in 2024 until it complied with Supreme Court orders to remove accounts accused of spreading disinformation.
Regulators there have also had to deal with newer problems. Brazil banned Jair Bolsonaro from speaking during an election, and his AI avatar spoke anyway.
President Luiz Inacio Lula da Silva’s government and the Supreme Court have both pushed to regulate how minors use the internet, with mixed results. The first lady, Rosangela Lula da Silva, said on 6 August that TikTok should be taken offline.
Where this sits against Europe
The European Commission charged TikTok in July with failing to protect children’s privacy under the Digital Services Act. That case is still open and no fine has landed.
Brazil has reached a penalty and a remedy first, on a narrower legal basis. The DSA case is about systemic risk assessment, while this one is about a lawful basis for processing data, which is the same test European regulators apply under the GDPR.
The practical difference matters for anyone watching Brussels. A data protection authority can fine a company for how it collects information without having to prove the design of the product caused harm.
European regulators have the same instrument to hand. Every EU country has a data protection authority, and the lawful-basis test Brazil applied is written into the GDPR.
Every jurisdiction is trying something different
Australia, Canada and Indonesia are all working on similar rules. TikTok and YouTube cut 4.7 million under-16 accounts in Indonesia in June.
New Zealand joined the push to keep under-16s off social media on Monday. The UK has proposed a curfew, Australia has an outright ban, and Hong Kong educators want one.
The approaches are not converging. Bans, curfews, parental linking, age assurance and data protection fines all target the same problem through different law.
It landed on the same day as Oakland
A former Meta data scientist told a jury in California on Tuesday that Instagram had rejected a default setting for a teen safety tool, because the cost to the app’s core metrics was not desirable.
The two cases test different things. The US trial is about whether a company lied about a feature. Brazil did not have to argue about statements at all.
It asked whether there was a lawful basis for holding the data, decided there was not, and set a price.
What happens next
The first thing is the appeal. ByteDance has until early September, and its response will show whether it treats a $29.9m penalty as a cost or as a precedent worth fighting.
The second is the deletion order. Deleting data collected from guest sessions is harder than deleting an account, because there is no account to point at.
The third is whether other data protection authorities read the guest-browsing finding and try it. That is the part of this ruling with the longest reach, and it is the part TikTok has the most reason to contest.
Get the TNW newsletter
Get the most important tech news in your inbox each week.
