Brazil fines TikTok $29.9 million over children's data, including guest sessions
Brazil's data protection agency penalized TikTok's owner for processing children's data without proper safeguards, covering even guest browsing.
1Penalty details
Brazil's National Data Protection Authority imposed a 153.7 million reais ($29.9 million) fine on ByteDance, TikTok's owner. The penalty addresses unlawful processing of children and adolescents' data without adequate protection. Notably, the ruling covers not just logged-in accounts but also guest sessions, demonstrating Brazil's strict stance on data protection. This comprehensive approach sets a new precedent in digital regulation.
2Guest session risks
Regulators found TikTok collected data even from users who never signed in, bypassing traditional age verification systems. Brazil treats the mere act of data collection as a violation, regardless of user identification. This interpretation creates new compliance challenges for platforms, differing significantly from regulations in other jurisdictions. The ruling particularly focuses on protecting minors in all browsing scenarios.
3Required measures
ByteDance was ordered to delete improperly collected data and implement automatic stricter privacy settings for under-16 accounts. The company must also enhance parental control systems and strengthen content filters. TikTok has committed to developing a compliance plan. These targeted measures focus on data practices rather than content restrictions, representing a more surgical regulatory approach compared to outright bans.
4Appeal process
ByteDance has 10 days to appeal the decision but hasn't commented yet. Notably, Brazil didn't suspend TikTok or block its content - remedies solely concern data handling. This contrasts with Brazil's previous actions against platforms, showing a more measured response. The government's focus remains on data protection rather than broader platform restrictions, setting this case apart from past interventions.
5Brazil's regulatory history
Brazil has precedent for tough digital platform regulation. In 2024, X (formerly Twitter) was blocked for 40 days for non-compliance with Supreme Court orders. During elections, Jair Bolsonaro was banned from speaking, though his AI avatar circumvented restrictions. These cases demonstrate Brazil's assertive digital governance approach. The current TikTok fine continues this pattern of stringent oversight, particularly regarding minors' online protection.
6Global implications
Brazil's ruling on guest sessions could influence other regulators. The EU already charged TikTok in July under the Digital Services Act for failing to protect children's privacy, though no fine has been issued yet. Brazil's decision, based on lawful data processing requirements, aligns with GDPR principles and may inspire similar actions in Europe. This case demonstrates how data protection laws can be applied to guest browsing scenarios.
7Indonesia and global trends
In June, TikTok and YouTube removed 4.7 million under-16 accounts in Indonesia. New Zealand recently joined efforts to keep minors off social media, while the UK proposed curfews and Australia implemented outright bans. Hong Kong educators are pushing for similar restrictions. These diverse approaches - from data fines to access bans - reflect global concerns about children's online safety but show no consensus on solutions.
8Industry significance
Brazil's ruling could fundamentally impact social media business models. Guest session data collection represents a significant revenue source for many platforms. If adopted globally, this precedent might force industry-wide operational changes. The focus on data collection methods rather than product design also signals a potential regulatory shift. Platforms may need to develop new compliance strategies that satisfy both business needs and evolving data protection standards.
Original article: The Next Web — TikTok'a çocuk verileri için 29.9 milyon dolar ceza