Brazil: The National Data Protection Authority (ANPD) of Brazil has imposed a significant fine on ByteDance, the parent company of TikTok, amounting to 153.7 million Brazilian reais ($29.8 million). This action comes as a result of irregularities identified in the processing of personal data belonging to children and adolescents, as reported by the Official Gazette.
According to Anadolu Agency, the penalty was enforced following an administrative investigation that revealed breaches of Brazil's General Data Protection Law (LGPD). The ruling mandates ByteDance to eliminate data that was improperly collected and to establish a compliance strategy aimed at enhancing the protection of minors on its platform.
The ANPD's investigation highlighted issues with two specific types of access to TikTok: the 'feed without registration,' accessible without an account, and the 'feed with registration,' linked to registered profiles. In both scenarios, it was found that TikTok handled minors' personal data without a valid legal foundation as required by the LGPD and lacked sufficient measures to prevent such processing.
As part of the compliance requirements, TikTok is instructed to enforce its strictest privacy settings automatically for users under the age of 16. Any changes to these settings would require parental or guardian approval. Additionally, the company is expected to enhance parental control systems and apply more rigorous content filters, as per ANPD directives.
For users accessing TikTok without registration, the company will halt advertising operations in Brazil, restrict access to universally suitable content, and minimize the collection and processing of personal data. The new measures will also limit user access to 12 hours and disable features such as content creation, commenting, direct messaging, following other users, and livestreaming for those without registered accounts.
The ANPD emphasized that these actions are designed to mitigate risks to the rights of children and adolescents, including the complete suspension of advertisements and the deactivation of livestreams and direct messaging for unregistered users. The detailed findings were outlined in Technical Note No. 50/2024/CGF/ANPD by the ANPD's Supervision Department (SFI-ANPD), which identified discrepancies with the LGPD in both access forms to the platform.
ByteDance retains the option to challenge the fine by appealing to the ANPD's Board of Directors within 10 business days following the notification, the agency noted.