Brazil has imposed a 153.8 million reais fine, equivalent to about $29.8 million, on ByteDance, the Chinese technology company that owns TikTok, over the alleged unlawful processing of personal data belonging to teenagers. The penalty was issued by Brazil’s data protection authority, the Autoridade Nacional de Proteção de Dados, or ANPD, as regulators increase pressure on social media platforms to strengthen protections for children and young users.
The decision, published in Brazil’s official gazette on Tuesday, August 25, states that ByteDance’s Brazilian operation processed personal information belonging to users between the ages of 13 and 18 without what the regulator considered a valid legal basis. The case highlights growing concerns about how technology companies collect, process and share information from minors who use social media platforms.
The ANPD’s action comes at a time when governments around the world are taking a closer look at the relationship between social media companies and younger users. Regulators are increasingly questioning whether existing safeguards are strong enough to protect children and teenagers from privacy risks, harmful content and inappropriate use of their personal information.
For platforms such as TikTok, the issue is particularly significant because teenagers represent a large and highly active part of the social media audience. Users routinely provide information through account registration, interactions, viewing habits and other activity on these platforms. Even when users are simply watching or scrolling through content, their digital activity can generate information that companies may use to operate and personalize their services.
Brazil’s data protection authority said the problem involved the processing of personal data belonging to teenagers aged 13 to 18. According to the regulator’s decision, the processing did not have an adequate legal foundation under Brazil’s General Data Protection Law. The law establishes rules governing the collection and use of personal information and places additional responsibilities on organizations handling data.
The decision also includes requirements beyond the financial penalty. ByteDance has been instructed to delete the personal information of teenagers whose legal representation or assistance is not properly regularized. The company has been given 60 business days to carry out the required deletion. It must also notify third parties with whom the relevant information was shared.
The additional requirements make the decision more significant than a straightforward financial penalty. Data protection regulators increasingly expect companies to demonstrate that corrective measures have actually been implemented rather than simply paying a fine and continuing with existing practices. For ByteDance, this means providing evidence that its systems have been adjusted to meet the regulator’s requirements.
The company must also submit a technical report signed by its data protection officer. The report must be accompanied by system audit logs demonstrating compliance with the measures ordered by the Brazilian authority. These documents must be submitted within five business days after the initial compliance deadline expires.
Failure to meet the requirements could create further financial pressure on ByteDance. The company faces a daily penalty of 137,081.49 reais if it does not comply with the data deletion, reporting or notification obligations set out in the decision. Such daily penalties can quickly increase the cost of regulatory action if a company fails to complete corrective measures within the required timeframe.
ByteDance also has an option to reduce the financial impact of the original penalty. According to the ANPD decision, the fine can be reduced by 25% if the company gives up its right to appeal within 10 business days and pays the penalty within 20 business days. Whether ByteDance accepts those conditions could determine how the dispute develops from here.
ByteDance Brasil had not immediately responded to a request for comment when the decision was reported. The absence of an immediate response means the company’s position on the findings and penalty was not available at the time of publication.
The Brazilian action is part of a wider international shift toward tighter regulation of social media services used by children and teenagers. Governments are increasingly examining whether platforms are doing enough to verify users’ ages, protect minors’ personal information and limit their exposure to harmful material.
Australia, France and China are among the countries that have introduced, considered or debated stricter measures concerning minors and social media. Although the approaches differ from one country to another, the underlying concern is similar: young users may face risks that require stronger safeguards than those applied to adults.
Brazil has already taken other enforcement steps involving digital platforms. Earlier in August, the country’s data protection authority ordered Discord to suspend livestreaming features because of concerns about children and teenagers being exposed to harmful content. The move demonstrated that Brazilian regulators are willing to intervene when they believe online services may create significant risks for younger users.
The growing regulatory attention also reflects a broader change in how governments view responsibility in the digital economy. Social media companies have traditionally focused heavily on user growth, engagement and the development of personalized services. Regulators, however, are increasingly demanding that privacy and child safety considerations form a central part of those systems rather than being treated as secondary concerns.
For teenagers, the consequences of data collection may not always be obvious. A young person may understand that a social media platform requires certain information to create an account, but may not fully appreciate how personal information can be processed, retained or shared. This makes transparency and appropriate safeguards especially important when companies handle data belonging to minors.
