Brazil fines TikTok owner ByteDance for unlawful processing of teenagers' data

Brazil's data protection authority (ANPD) has fined TikTok owner ‌ByteDance 153.8 million reais ($29.81 million) for allegedly violating the country's General Data Protection Law, according to a decision published in the official gazette on Tuesday. ANPD said that the local unit of China's ByteDance had processed personal data of teenagers aged 13 to 18 without a valid legal basis. Brazilian authorities are ‌stepping up scrutiny of online platforms' safeguards for children and teenagers, part of a broader global trend that has seen countries including Australia, France ‌and China impose or consider stricter rules on use of social media by minors. This month, ANPD ordered chat platform Discord to suspend livestreaming features over concerns about children's and teenagers' exposure to harmful content. ANPD Director Lorena Giuberti Coutinho said at a press conference on Tuesday that the agency was separately overseeing TikTok's compliance with Brazil's Digital Child and ⁠Adolescent Statute, a ​law that took effect in March. More ⁠companies may face scrutiny by the agency soon. On Friday, the regulator opened two new monitoring proceedings covering 22 digital platforms and social media networks to assess compliance with ⁠the new law to protect children. WEAK SAFEGUARDS ANPD highlighted concerns aboutTikTok's "logged-out feed", which allows users to browse content without creating an account, enabling widespread use of the platform ​by children and teenagers in Brazil without effective age-verification checks. The feature, the regulator said, is available in Brazil but not in the ⁠U.S. or Europe, where access is restricted to registered users. The regulator added that TikTok also lacked adequate safeguards to mitigate the risks associated with the large-scale processing of children and ⁠teenager ​data. ByteDance Brasil did not immediately respond to a request for comment, but ANPD Director Coutinho told reporters that ByteDance had committed to implementing a plan aimed at bringing TikTok into compliance with Brazilian law.

According to Tuesday's decision, ByteDance must delete the personal data of teenagers whose legal ⁠representation or assistance is not regularized within 60 business days and notify third parties with whom it shared the data. The company faces fines ⁠of 137,081.49 reais per day if ⁠it fails to comply with the data-deletion, reporting, or notification requirements. The total fine, the regulator added, could be reduced by 25% if ByteDance waives its right to appeal and swiftly pays the penalty.

($1 = 5.1597 reais)