Key Points:
- Brazil’s National Data Protection Authority fined ByteDance 153.8 million reais ($29.8 million) for violating national privacy laws.
- Regulators determined that TikTok unlawfully collected and processed personal data of teenagers aged 13 to 18 without valid legal grounds.
- The regulatory ruling orders ByteDance to delete all unlawfully gathered data of minors within 60 business days.
- ByteDance faces additional daily fines of 137,081 reais if it fails to comply with data deletion and reporting mandates.
Data protection regulators in Brazil have leveled a massive financial penalty against Chinese technology conglomerate ByteDance, the parent company of short-form video giant TikTok. The National Data Protection Authority issued a formal fine of 153.8 million reais, equivalent to approximately $29.8 million, citing widespread violations of the country’s General Data Protection Law. The landmark penalty targets the platform’s unlawful handling and processing of personal information belonging to children and teenagers.
The formal decision, published in the national official gazette, concluded that the Brazilian subsidiary of ByteDance systematically gathered and analyzed personal data from young users aged 13 to 18 without establishing a valid legal foundation or implementing adequate technical safeguards. Regulators discovered that improper data collection occurred across both standard registered accounts and unregistered guest browsing sessions, capturing browsing habits, device telemetry, and personal identifiers without verifiable parental consent.
In addition to the multi-million-dollar financial penalty, the regulatory authority issued a strict corrective order requiring ByteDance to delete all illegally harvested personal records. The company must identify and permanently purge the data of all teenage users whose parental representation or legal authorization is not properly regularized within 60 business days. Furthermore, the tech platform must formally notify all third-party advertising brokers and data partners with whom it previously shared the improper datasets, ensuring that external tracking caches are wiped clean.
To ensure full compliance, regulators mandated that ByteDance submit an exhaustive technical compliance report signed directly by its designated Data Protection Officer, accompanied by verified system audit logs, within five business days following the 60-day deadline. The agency warned that failure to comply with data deletion, third-party notifications, or audit reporting requirements will trigger automated recurring fines of 137,081.49 reais per day until the platform proves complete remediation.
The administrative ruling provides ByteDance with a 10-business-day window to file a formal appeal against the penalty. Alternatively, regulators offered a structural settlement incentive: if the company waives its right to appeal within 10 business days and pays the full fine within 20 business days, the total penalty will be discounted by 25%, lowering the financial bill to roughly 115 million reais while keeping data deletion and compliance obligations strictly binding.
The heavy regulatory enforcement arrives amid an aggressive nationwide campaign by Brazilian authorities to hold social media platforms accountable for youth safety and digital well-being. Under the administration of President Luiz Inácio Lula da Silva and with backing from the Supreme Court, Brazilian lawmakers are aggressively enforcing digital privacy laws and exploring statutory age restrictions. The action follows a recent regulatory directive ordering the chat platform Discord to suspend livestreaming features after authorities linked unmonitored channels to severe adolescent safety harms.
Brazil’s decisive enforcement action mirrors an accelerating global push to rein in big tech platforms and protect minors online. Governments and regulatory bodies worldwide—including Australia, New Zealand, France, and various United States jurisdictions—are passing or debating strict statutory measures, such as blanket social media bans for under-16s and mandatory age verification protocols. Regulators are increasingly scrutinizing how recommendation algorithms, infinite scroll mechanics, and data-harvesting tools affect adolescent mental health.
The regulatory ruling forces significant operational changes in how the video-sharing platform operates in Latin America’s largest economy. Regulators previously mandated that TikTok disable its unregistered feed feature, which allowed anonymous web visitors to scroll through algorithmic video streams without logging in or completing age checks. Forcing platforms to gate content behind authenticated accounts and strict age verification challenges traditional growth models that rely on frictionless onboarding to maximize advertising impressions.
As ByteDance evaluates whether to appeal the ruling or accept the discounted settlement, the Brazilian enforcement action marks a major victory for digital consumer sovereignty in the Global South. By enforcing strict data deletion timelines backed by daily recurring fines, Brazil is demonstrating that global tech giants cannot treat underage user privacy as an afterthought. The landmark fine establishes a powerful precedent across Latin America, proving that protecting children’s data rights remains an enforceable legal obligation in the modern digital age.
