Brazil fines TikTok's parent $30 million for violating child data protection rules

Brazil’s National Data Protection Authority (ANPD) announced on Tuesday that it has imposed a fine of R$153.7 million (approximately US$29.9 million) on TikTok’s parent company ByteDance for failing to safeguard children’s personal data. The regulator also ordered the Chinese firm to delete any information it collected from users under 16 without proper consent and to implement stronger age‑verification and privacy‑by‑design measures across the platform in Brazil.

The penalty stems from a series of investigations launched after the ANPD received complaints that TikTok’s data‑handling practices violated Brazil’s General Data Protection Law (Lei Geral de Proteção de Dados, LGPD). Under the LGPD, companies must obtain explicit consent from parents or legal guardians before processing personal data of minors and must limit data collection to what is strictly necessary. The authority said TikTok’s algorithms continued to harvest location, browsing habits and biometric data from under‑16 users even after the company had been warned to halt such practices. ByteDance has said it is reviewing the findings and will appeal the decision, arguing that the platform’s privacy settings already comply with local regulations and that the fine is disproportionate to any alleged infractions.

Brazil, the continent’s most populous nation with more than 213 million inhabitants, has been tightening its data‑privacy framework since the LGPD took effect in 2020. The country’s federal structure—comprising 26 states and a Federal District—means that enforcement actions can have ripple effects across regional markets, especially in major urban centers such as São Paulo and Rio de Janeiro where TikTok enjoys a large user base. The ANPD, which operates under the Ministry of Justice, has positioned itself as a watchdog for digital rights, emphasizing that protecting children online is a priority in a market where social‑media usage among adolescents is among the highest in Latin America.

ByteDance’s response reflects a broader tension between global tech firms and national regulators seeking to impose stricter safeguards on digital platforms. While the company maintains that its “family‑friendly” features, including default privacy settings for younger users, meet international standards, Brazilian officials contend that the platform’s data‑mining practices expose minors to targeted advertising and potential manipulation. The ANPD’s decision also follows similar actions in Europe and the United States, where regulators have levied fines on TikTok for alleged violations of child‑protection rules, signaling a coordinated global push to hold the app accountable for its handling of youth data.

The ruling carries significant implications for the digital economy in Brazil and the wider South American region. As the world’s largest Portuguese‑speaking market, Brazil represents a key growth frontier for multinational technology companies, and compliance failures can trigger costly penalties and reputational damage. Moreover, the enforcement underscores the increasing weight of data‑privacy legislation in shaping how platforms design their services, potentially prompting a wave of reforms across neighboring countries that look to Brazil’s regulatory model as a benchmark. For Brazilian users, especially minors, the decision promises tighter controls over personal information, while for the tech industry it serves as a reminder that global platforms must adapt to divergent national standards to maintain market access.