Brazil’s national data protection agency, the ANPD, has fined TikTok’s parent company ByteDance R$153.7 million (about USD 29 million) for violating children’s privacy rules, marking the largest penalty ever imposed on a big‑tech firm in Brazil and the first under the ECA Digital law. The agency found that TikTok allowed users under 18 to register without adequate age verification and processed teenagers’ data without a legal basis, contravening Articles 6 and 7 of the LGPD.
The fine and its basis
The decision, published in the official gazette on Tuesday, follows an investigation that began after civil‑society groups raised concerns about the platform’s handling of minors’ data. According to the Folha de S.Paulo report, the ANPD concluded that ByteDance failed to obtain proper consent for processing adolescents’ personal information and did not implement sufficient safeguards to prevent under‑18 sign‑ups.
Experts interviewed by the newspaper said the ruling sends a clear message that the protection of children and adolescents must take precedence over the commercial interests of social‑media platforms. Maria Mello, manager of the Instituto Alana, which participated as amicus curiae in the case, described the fine as a result of a lengthy investigation and civil‑society involvement.
Expert reactions
She added that the sanction will force TikTok to change its tools and functionalities, and should serve as a warning to other platforms that neglect child‑privacy obligations. “It’s not only TikTok that violates children’s rights to privacy; the Digital ECA is a powerful ally for companies to make the necessary adjustments and, if needed, face sanctions,” Mello said.
Luiz Augusto D’Urso, a digital‑rights lawyer, noted that while the violations cited by the ANPD are real, the size of the fine seems high for a first sanction. He argued that administrative penalties should be graduated, starting with warnings and lower amounts, and predicted stricter oversight of other platforms in the future.
Criminal lawyer Helio Ramos pointed out that the conduct outlined by the ANPD does not directly match traditional crimes under the ECA, such as the production or distribution of sexual images of minors. He said a police inquiry could be opened to verify whether any criminal conduct occurred, but responsibility would likely fall on individuals rather than the corporation.
Implications for age verification
The case has revived debate over age‑verification mechanisms. Mello advocated for solutions that confirm a user’s age with minimal data collection, citing zero‑knowledge proofs as a way to prove age without revealing underlying data. She also noted that the Brazilian government is developing a public age‑verification tool that smaller firms could adopt at low cost.
The Instituto Alana said it will monitor TikTok’s compliance plan submitted to the ANPD and advised families affected by possible violations to seek redress through the justice system.