ByteDance’s Brazilian subsidiary was fined 153.8 million reais, equivalent to $29.81 million, by the National Data Protection Authority for processing personal data of teenagers aged 13 to 18 without valid legal authorization.
The penalty, announced in the official gazette on August 25, requires ByteDance Brasil to delete the personal data of minors whose legal representation or assistance was not properly documented. The company must also notify any third parties that received the data and submit a technical report, including system audit logs, within five business days after the 60-day compliance window.
Failure to comply will result in daily fines of 137,081.49 reais. ByteDance may reduce the total penalty by 25% if it chooses not to appeal within 10 business days and settles the payment within 20 business days.
The fine follows broader regulatory scrutiny of online platforms’ handling of minors’ data in Brazil. Earlier this month, the same authority ordered Discord to suspend its livestreaming features over concerns about exposing children and teenagers to harmful content.
ByteDance Brasil had not responded to requests for comment at the time of publication.
