Brazil has imposed a $29.9 million fine on TikTok's parent company due to issues related to children's data, which includes the handling of guest sessions.

      Brazil has penalized TikTok’s parent company for its management of children's data, affecting individuals who didn't have an account. The National Data Protection Agency imposed a fine of 153.7 million reais on ByteDance, approximately $29.9 million, citing issues in how it handled the data of minors.

      The agency stated that TikTok violated data privacy laws for both logged-in users and those browsing as guests, collecting and processing personal information from young users without a valid legal basis or proper safeguards. Mauricio Savarese reported this decision for the Associated Press, with Agence France-Presse also distributing the agency's figures.

      The guest-session aspect of the ruling is particularly noteworthy. Most child safety enforcement efforts have focused on user accounts, assessing how old users claimed to be, how platforms verified this, and what measures were implemented thereafter. Brazil's regulator went further, finding that the data issues also pertained to individuals browsing without signing in.

      This interpretation does not rely on age verification and considers the act of data collection itself as the violation, regardless of the user’s identity.

      As mandated, ByteDance is required to delete the improperly collected data and develop a better plan for protecting minors. TikTok has agreed to a compliance plan, which includes applying stricter privacy settings to accounts belonging to users under 16 automatically. The platform must also enhance parental oversight and implement more rigorous content filters. ByteDance has 10 days to appeal the ruling but has not commented to the AP or responded to AFP.

      The ruling does not result in Brazil suspending, blocking, or restricting TikTok’s operations; all measures are focused on data and settings, representing a more limited action than what was previously proposed by the first lady or what the country has enacted against other platforms.

      This month, the same regulator took action against Discord following the tragic death of a 13-year-old girl by ordering the suspension of livestreaming on the platform. Discord has appealed this verdict, which remains under review by the agency. The agency's characterization of the order differs slightly, with AFP stating a suspension was mandated and the AP describing it as a recommendation.

      Brazil is moving towards stricter enforcement. A recent law mandates that platforms link accounts of users under 16 to a parent’s account and verify user ages. Brazil has a history of stringent enforcement; for instance, X was blocked in Brazil for 40 days in 2024 until it adhered to Supreme Court directives to delete accounts accused of spreading false information. The country continues to face newer challenges, such as the ban on Jair Bolsonaro speaking during an election campaign, which led to the use of his AI avatar.

      President Luiz Inacio Lula da Silva’s administration and the Supreme Court have advocated for regulations on minors' internet usage, though with mixed outcomes. The first lady, Rosangela Lula da Silva, called on August 6 for TikTok to be taken offline.

      Comparatively, the European Commission charged TikTok in July for failing to safeguard children’s privacy under the Digital Services Act, a case that remains open without any imposed fine. Brazil has managed to achieve a penalty and remedy first, based on a more limited legal framework. While the DSA case involves systemic risk assessment, this situation pertains to lawful data processing, aligning with the same standards European regulators use under GDPR.

      Countries such as Australia, Canada, and Indonesia are developing similar regulations. In June, TikTok and YouTube removed 4.7 million accounts for users under 16 in Indonesia. New Zealand joined efforts to keep minors off social media, while various proposals are circulating in the UK, Australia, and Hong Kong to impose curfews or outright bans on minors.

      The regulatory approaches are not converging, as bans, curfews, parental linking, age verification, and data protection fines aim to tackle the same issue through different legal frameworks.

      The developments coincided with a trial in California where a former Meta data scientist revealed that Instagram had discarded a default setting for a teenage safety feature due to the negative impact on core app metrics.

      Looking ahead, the appeal process will be the first priority, with ByteDance having until early September to respond, indicating whether it views the $29.9 million fine as a cost or as a precedent worth contesting. The second aspect involves the deletion order; erasing data from guest sessions poses more challenges than deleting an account, since no account exists for reference. Finally, it remains to be seen whether other data protection authorities will take note of the guest-browsing findings and try to implement similar measures, which is the ruling's most far-reaching aspect and the element TikTok has the greatest incentive to challenge.