ByteDance Brasil was fined R$153.8 million (US$29.81 million) by Brazil’s data protection authority, ANPD, for processing the personal data of adolescents aged 13 to 18 without proper legal authorization, according to an announcement published in the Official Gazette on Tuesday.
The fine stems from violations of Brazil’s General Data Protection Law (LGPD), which requires explicit consent or legal basis for processing personal data of minors. ANPD found that ByteDance Brasil failed to ensure adequate documentation of legal representation or assistance for these users.
As part of the penalty, ByteDance Brasil must delete the personal data of affected adolescents within 60 business days. The company is also required to notify any third parties that received this data about the violation. Additionally, ByteDance must submit a technical report signed by its data protection officer, along with system audit logs proving compliance, within five business days after the 60-day deletion period concludes.
Non-compliance with these requirements will result in daily fines of R$137,081.49. ByteDance Brasil has the option to reduce the total fine by 25% if it chooses not to appeal within 10 business days and pays the penalty within 20 business days.
