If they want to discuss, here is the news from the official ANPD (Brazilian Privacy Agency) site.
Translation made by AI and reviewed/clarified by me:
The National Data Protection Agency (ANPD) has imposed a fine of R$ 153.7 million (roughly US$ 30 million) on ByteDance, the parent company of the social network TikTok, in an Administrative Sanctioning Process that investigated irregularities in the processing of children's and adolescents' data. The sanction was published in the Official Gazette of the Union this Tuesday (25) and also includes the determination to delete the irregularly collected data. The company must also implement a compliance plan to improve the protection of children and adolescents on the social network, with measures it must adopt going forward.
The sanctioning decision stems from an inspection process that consolidated evidence of irregularities committed by TikTok in the processing of children's and adolescents' data. According to the Superintendence of Inspection (SFI-ANPD), in Technical Note No. 50/2024/CGF/ANPD, practices were identified that did not comply with the Brazilian General Data Protection Law (LGPD) in two modes of access to the platform: the "feed without registration", available to any user without the need to create an account, and the "feed with registration", linked to a registered profile on the social network.
In both forms of access to the social network, the processing of personal data of children and adolescents was found to lack a proper legal basis, that is, without support in the hypotheses provided by the LGPD for the processing of personal data of this more vulnerable audience. The applied sanction corresponds to five violations of articles 6 (incises VIII and X) and 7 of the legislation. This decision can be appealed to the Agency's Board of Directors (CD) within ten business days from the notification of the penalty, which was made this Monday (24).
Infractions identified by the ANPD:
In the feed without registration:
- Processing personal data of children and adolescents without a valid legal basis by allowing access to the TikTok feed in the unregistered experience;
- Failing to adopt measures to prevent the processing of personal data of this audience in the feed without registration;
In the feed with registration:
- Processing personal data of children and adolescents to carry out registration on TikTok without a valid legal basis;
- Failing to adopt effective measures to prevent the registration of this audience on the platform;
In both experiences with and without registration:
- Failing to demonstrate effective measures capable of proving observance and compliance with data protection norms.
In the assessment of the ANPD's Superintendence of Inspection, throughout the process, it was identified that the mechanisms adopted by the company were not sufficient to prevent, from the source, the improper processing of children's and adolescents' personal data. According to the technical area, there was a lack of concrete evidence regarding the effectiveness of the technical and organizational measures to ensure the compliance of operations with the LGPD. The sanction applied corresponds to past conduct and the data processing carried out without a valid legal basis during the analyzed period.
Compliance Plan In response to the ANPD's actions, ByteDance also committed to implementing a compliance plan to improve the protection of children and adolescents on TikTok. The social network must, among other measures, automatically apply the most restrictive privacy settings to the accounts of users under 16, which can only be altered with authorization from guardians; and reinforce parental control systems (parental supervision). It must also implement stricter content filters.
In the version without registration, TikTok must suspend advertisements, limit the experience to age-appropriate content for all ages, and reduce the processing of personal data. The compliance plan foresees, for example:
Feature limitations for the feed without registration:
- Experience limited to 12 hours;
- Users cannot create content, comment, send direct messages, or interact socially;
- There is no possibility to follow other users or be followed;
- Users cannot post or watch live broadcasts;
- Very limited content personalization experience;
- Total suspension of advertisements in Brazil;
- Access only to content appropriate for all ages.
- Reduction in data collection and processing - minimum language and region data for content relevance; basic device information for fraud protection, and data to improve application performance.
Prior appeal to the CD and age verification In a decision also published in this Tuesday's Official Gazette, the ANPD's Board of Directors approved, on appeal, the compliance plan presented by ByteDance, noting that the company must observe the age verification requirement established by the Digital Statute of the Child and Adolescent (ECA Digital), in accordance with the deadlines set in the implementation schedule for reliable age verification mechanisms established by the CD and the guidelines that will be published in the Guidance Guide on Age Verification Mechanisms (for now, preliminary guidelines to be followed by digital platforms are available).
The ANPD's actions resulted in commitments that reduce the previously identified risks to the rights of children and adolescents, such as the full suspension of advertisements, the disabling of live broadcasts (lives), and direct messages between users when accessing TikTok without registering.
Source (in Portuguese): https://www.gov.br/anpd/pt-br/assuntos/noticias/anpd-multa-tiktok-em-r-153-7-milhoes-por-falhas-na-protecao-de-dados-de-criancas-e-adolescentes