Brazil’s data protection authority fined ByteDance US$30 million on Tuesday over its handling of children’s data on TikTok, the largest penalty it has imposed since it was created in 2020.
The National Data Protection Authority, known as the ANPD, found five breaches of Brazil’s data protection law and gave ByteDance 10 working days to appeal.
The company must also erase the records of users aged 13 to 18 whose parental authorisation is not regularised within 60 working days, instruct every partner it passed those records to do the same, and report back with system logs signed off by its data protection officer. Failure on any of those counts carries a daily fine of over US$26,000.
According to Technical Note 50, the 25-page document that underpins the sanction, a user who downloaded TikTok in Brazil reached the personalised feed at once, without declaring an age or reading the terms of service. Investigators at the agency’s inspection unit ran the same test abroad.
The note says the logged-out feed was available in Brazil but was barred in the United States and Europe, and they filed screenshots of the sign-up screens they met overseas as evidence.
The document also cites a 2023 ruling by the European Data Protection Board recording that access to the app in the European Union was restricted to registered users.
The inquiry began in March 2021, after a federal lawmaker complained about a report by Vice Italy describing the data the app collected from people who had never opened an account.
Throughout the inquiry TikTok maintained that its terms of service set a minimum age of 13. Children below that age were not authorised users, the company said, and nothing was personalised for them.
It also reported removing 7.75 million children's accounts in Brazil between October 2022 and September 2023, with 762,493 taken down in July 2023 alone.
Measured against the 2022 census, the agency wrote, that meant “the platform had handled the data of roughly one in five Brazilian children in a single year”.
Investigators had asked for a report on how effective those removals were, but ByteDance sent a table of monthly totals, with no explanation of how the figures had been reached.
Investigators traced the problem to the age gate, a screen that asked for a date of birth before letting the user through. They described the method as “cheap, easy to implement and simple to circumvent”.
Tools able to estimate age, including the third-party service Yoti, were switched on only when a user tried to change their date of birth or appealed a ban, by which point the data had been collected.
ByteDance argued that a teenager clicking through its terms of service formed a valid contract, describing use of the app as an ordinary act that parents could be presumed to allow.
The agency rejected that, pointing out that the civil code denies anyone under 16 the capacity to enter a contract without a parent or guardian. The presumption that parents had authorised it, investigators wrote, “finds no support in the Brazilian legal system”.
The document says ByteDance gave the inquiry “untrue information about which registration method the app offered by default”, a point investigators treated as material because users tend to stay with whatever option is preset.
Investigators separately asked what had become of the data of banned children that had already reached advertising partners. ByteDance answered that such data would not be shared with commercial partners, addressing future conduct in reply to a question about the past.
The agency called that a “semantic manoeuvre” and concluded that the company’s behaviour pointed to no attempt to fix the problem, serving instead to make the inspection “more drawn out, which ultimately harms society itself”.
ByteDance’s communications office did not immediately respond to a request for comment.
The company has 10 working days from Monday’s notification either to appeal or to give up that right and take the discount, leaving it a decision to make in the first week of September.
Investigators also recorded a question the company never answered, about whether the logged-out feed collected the unique advertising identifiers that Apple and Google assign to handsets. The reply they received was incomplete, the document says.
A second ruling published on Tuesday sent that question back to the inspection unit, which will pursue it while monitoring TikTok’s compliance plan and may propose new measures if the company breaks its commitments.
The decision splits the penalty into three fines rather than five, grouping the breaches by the article each offended.
Two of them come to US$12.27 million apiece, one for processing without a legal basis and one for failing to prevent harm, with a further US$5.32 million for failing to demonstrate compliance.
ByteDance can cut the total amount by waiving its right to appeal and paying within 20 working days.
Five regulators, one accusation
Even at the full amount, the largest penalty in the ANPD’s history is the mildest any major regulator has imposed on TikTok over its handling of children.
Four days earlier, TikTok agreed to pay US$400 million to settle a US Justice Department lawsuit accusing it of collecting data from under-13s without parental consent, one of the largest recoveries ever obtained under the American children’s privacy statute. The complaint dated from 2024 and rested on allegations close to Brasilia’s.
Ireland’s Data Protection Commission fined the company €530 million (US$619 million) in May 2025 over transfers of European user data to China, a penalty the Irish High Court upheld in June.
TikTok had told the regulator it held no European data on servers in China, then disclosed that it had found some there, conceding it had given the inquiry inaccurate evidence.
Brussels has opened four fronts under the Digital Services Act since 2024. In February, the European Commission preliminarily found TikTok in breach over addictive design, citing infinite scroll, autoplay and push notifications.
In July it said accounts held by minors failed the law’s safety standards because strangers, including people with no TikTok account, could see their content.
That same month, Britain’s Ofcom began investigating whether TikTok’s age checks satisfy the Online Safety Act, singling out the models that estimate a user’s age from viewing behaviour.
Australia went further, barring under-16s from 10 platforms including TikTok in December, after which providers cut off 4.7 million accounts.
A dinner in Beijing
TikTok became a diplomatic problem for Brazil in May 2025, at a state dinner Chinese President Xi Jinping hosted for President Luiz Inacio Lula da Silva in Beijing. Lula raised the regulation of digital platforms and asked whether China could send an envoy to Brasilia to discuss it.
First lady Rosangela da Silva, known as Janja, then asked to speak and criticised TikTok over harmful content reaching children, a break with protocol that officials in the Brazilian delegation said unsettled their hosts.
The exchange leaked days later, and Lula publicly blamed his own team for disclosing a private dinner conversation.
Days later, at a government event in Brasilia on preventing sexual violence against children, Janja returned to the subject. “There is no protocol that will make me stay silent,” she said.
The company wrote to Brazil’s foreign ministry saying it had become aware of the remarks and was open to dialogue, a letter Foreign Minister Mauro Vieira passed to Lula.
Xi never commented publicly and Chinese state media ignored the episode. The Chinese embassy in Brasilia did not immediately respond to a request for comment on Tuesday’s fine.
The note underpinning the fine was signed in November 2024, six months before the Beijing dinner, and already recommended the sanctioning process that ended this week.
Asked at a press conference on Tuesday whether the decision had been political, ANPD director-president Waldemar Goncalves Ortunho Junior said the agency had done nothing beyond apply the statute.
“It is a technical action, closely based on the law,” he said.
A law passed in February turned the ANPD into a regulatory agency with its own budget and staff and gave it authority over Brazil’s digital child protection statute.
Board member Lorena Giuberti Coutinho told reporters the TikTok file was not the last of its kind and that firmer enforcement “should be expected in coming months”. -- SOUTH CHINA MORNING POST
