One in five Brazilian children has been targeted by TikTok’s commercial profiling system without their families’ knowledge. This is the serious accusation that has led Brazil’s National Data Protection Authority, theANPD, to impose a fine on ByteDance 30 million dollars, the highest ever imposed by the organization since its inception in 2020.
According to the Brazilian authorities, this isn’t just a bureaucratic violation. At the heart of the investigation is how TikTok allegedly allowed millions of minors to access the platform without adequate age checks, while simultaneously collecting information useful for commercial profiling.
Access to minors without real age control
The ANPD’s technical report describes a system in which Brazilian users could enter the world of TikTok with extreme ease. Simply downloading the app was enough to immerse themselves in a stream of personalized videos, without prior registration, effective age verification, or adequate parental consent.
Brazilian inspectors also conducted comparisons with other markets, finding significant differences in the methods of accessing the platform. According to the ANPD, procedures that allowed anonymous use of the app and the collection of advertising identifiers associated with Apple and Google devices remained in place in Brazil.
The result, according to the authority, would have been a huge wealth of behavioral data that could also be traced back to underage users.
The numbers that emerged from the investigation are particularly significant. Between October 2022 and September 2023, TikTok would have deleted 7.75 million accounts belonging to children. In July 2023 alone, more than 100,000 accounts were removed. 762 thousand.
It is on the basis of these data that the Brazilian authority comes to a weighty conclusion: over the course of twelve months, the system would have involved a share equivalent to approximately one fifth of the Brazilian child population.
The “age gate” is not enough
One of the most delicate points of the investigation concerns the so-called age gate, the system through which TikTok is supposed to prevent unauthorized minors from using the platform.
However, the ANPD argued that the mechanism was not effective enough. The more sophisticated age estimation checks would have been activated primarily after the user challenged a block. In other words, according to the Brazilian technicians, the verification could have occurred after data collection had already begun.
It is precisely this aspect that makes the matter particularly delicate: It is not enough to subsequently prevent a minor from accessing the platform if in the meantime the platform has already collected and used his or her data.
ByteDance denies the accusations
ByteDance defended its actions, arguing that TikTok’s terms of service prohibit users under 13 from signing up.
The company also argued that a teenager’s use of the platform could be considered an ordinary act of daily life, thus presuming a form of parental authorization.
A thesis that the ANPD rejected.
According to the authority, Brazilian law does not allow presumed parental consent to be transformed into a kind of automatic authorization. For minors who do not have full legal capacity, parental representation remains essential.
Even more controversial was ByteDance’s response regarding the fate of the data collected before the account deletions. According to the ANPD, the company’s explanations did not satisfactorily clarify whether and how that information had been shared with third parties or advertising partners.
A fine that goes beyond the simple economic value
The sanction from 30 million dollars It therefore takes on a meaning that goes beyond the financial aspect.
LANPD contested three different issues: data processing without an adequate legal basis, insufficient prevention of potential harm, and failure to demonstrate full compliance with Brazilian regulations.
ByteDance would now have 60 days to take the measures required by the authorities and delete any non-compliant data. Failure to comply will result in additional daily penalties.
Brazil thus joins the growing group of countries that are putting pressure on TikTok on its most sensitive terrain: the protection of minors’ data.
The international front
The Brazilian measure is part of a growing international regulatory push against the platform’s data management practices.
In the United States, the Department of Justice has reached an agreement 400 million dollars relating, among other charges, to the collection of data from underage users. In the European Union, the Irish data protection authority has imposed a fine on TikTok 530 million euros for issues related to international data transfers.
Australia has also adopted a particularly strict line, introducing a ban on the use of social media by those under 16.
The picture that emerges is therefore increasingly clear: Large digital platforms can no longer consider the protection of minors as a simple clause in the terms of use.
When data becomes a business model
Finally, the Brazilian affair raises a broader question. The problem isn’t just about TikTok, but the entire economic model of digital advertising.
Every click, every video viewed, every time a piece of content is viewed, and every interaction can contribute to building an increasingly accurate behavioral profile. For platforms, this data represents enormous economic value because it allows them to predict users’ tastes, interests, and behaviors.
However, when the user is a child, the line between commercial personalization and data exploitation becomes particularly delicate.
Brasilia’s decision therefore sends a clear message to TikTok and other Big Tech companies: The profiling of minors cannot be treated as a normal operating cost of digital business.
For a platform that thrives on knowing its users, the real challenge won’t just be paying a $30 million fine. It will be demonstrating that child protection can truly come before the commercial value of their data.