The sanction stems from an ANPD enforcement proceeding into TikTok’s processing of children’s and adolescents’ personal data. In 2024, Technical Note No. 50/2024/FIS/CGF/ANPD identified possible irregularities in two ways of accessing the platform: the “logged-out feed,” available without creating an account, and the feed for registered users. The review looked, among other issues, at the legal bases relied on by the company, its age-verification mechanisms, and its ability to show that those controls were effective.
At the end of the sanctioning proceeding, the ANPD found five violations. For the logged-out feed, the Agency found that children’s and adolescents’ data had been processed without a valid legal basis and that the company had failed to take measures to prevent that processing. For registered users, it found that data had been processed to enable registration without a valid legal basis and that the measures in place were not effective in preventing minors from registering. Across both experiences, the company also failed to show that its controls were effective and complied with data protection rules.
For the logged-out feed, ByteDance relied on performance of a contract as the legal basis for certain personalization activities even though the user had not created an account. The ANPD’s technical team found that this legal basis did not fit that context. It also questioned how effective the company’s mechanisms were in preventing children from accessing the service and having their data processed. The age gate based on the date of birth entered by the user was not considered inadequate in itself, but it was found to be insufficient as the only barrier in TikTok’s case. According to the ANPD, the company had not provided enough data and methodological information to support a reliable assessment of how well those measures worked.
The BRL 153.7 million fine concerns conduct during the period under review. The ANPD also ordered the deletion of data collected unlawfully. The decision was issued at first instance and may be appealed to the ANPD’s Board of Directors.
Compliance plan
Alongside the sanctioning proceeding, the ANPD required ByteDance to submit a compliance plan to strengthen the protection of children and adolescents on TikTok. The 2024 Technical Note went as far as recommending the full suspension of the logged-out feed until measures capable of preventing improper processing were in place. The plan later approved by the Board kept this mode of access, but with a much more limited experience and less data processing. Other measures include more restrictive privacy settings for users under 16, stronger parental supervision tools, and stricter content filters.
For the logged-out feed, the plan introduces significant restrictions: the experience is limited to 12 hours; users cannot create content, comment, send direct messages, follow or be followed; live streams are unavailable; content personalization is significantly reduced; advertising is suspended in Brazil; and access is limited to content suitable for all ages. Data processing is also reduced to minimal information on language and region, basic device data for fraud prevention, and information needed for app performance.
Age assurance and the Digital ECA
In a separate proceeding, the ANPD’s Board of Directors approved ByteDance’s compliance plan on appeal, while making clear that the company must comply with the age-assurance requirements under the Digital ECA. Implementation must follow the ANPD’s timeline and guidance on reliable age-assurance mechanisms. The Agency has already issued preliminary guidance, while the final version of its Age Assurance Guidance is still being developed.
According to the ANPD, the commitments reduce risks previously identified for children and adolescents, including through the suspension of advertising, live streaming and direct messaging in the logged-out experience.