Brazil fines TikTok $30 million over children's data processing
Brazil’s National Data Protection Authority (ANPD) has fined ByteDance, TikTok’s parent company, $30 million over its handling of children’s data. It is the largest fine imposed by the regulator since its creation in 2020, the South China Morning Post reports.
Violations and regulator’s requirements
ANPD identified five violations of Brazil’s data protection legislation and gave ByteDance 10 working days to appeal the decision. The company was also ordered to delete records of users aged 13 to 18 within 60 working days if parental consent for their processing is not properly regulated. ByteDance must require the same deletion from partners to whom it transferred these records and provide system logs signed by a data protection officer.
Failure to comply with each of these requirements carries a daily fine of more than $26,000. The penalty was divided into three components: $12.27 million each for processing data without a legal basis and for failing to prevent harm, plus another $5.32 million for failing to demonstrate compliance. The company may reduce the amount if it withdraws its appeal and pays the fine within 20 working days.
Review of access to the app
ANPD’s technical note states that in Brazil, a user could access a personalized feed immediately after downloading TikTok, without stating their age or reviewing the terms of use. Inspectors also checked access to the service abroad and found that the feed for users not logged into an account was unavailable in the United States and Europe.
More current news is available on the UA.News Telegram channel Telegram.
The regulator described the age-verification mechanism, which required only entering a date of birth, as easy to bypass. According to ANPD, age-estimation tools, including the third-party Yoti service, were used only when a user attempted to change their date of birth or appeal a suspension — after the data had already been collected.
Data from children’s accounts
During the investigation, TikTok stated that the minimum user age under its rules is 13 and that younger children are not authorized users. The company also reported deleting 7.75 million children’s accounts in Brazil from October 2022 to September 2023. ANPD noted that, according to 2022 census data, this represented approximately one-fifth of the number of children in the country.
The regulator also stated that ByteDance provided false information about the standard method of registration in the app. Separately, inspectors did not receive a complete response as to whether the feed for users not logged into an account collected Apple and Google device advertising identifiers. This issue was referred to the inspection unit for further consideration.
