Brazil’s data protection authority, ANPD, has fined ByteDance 153.8 million reais ($29.81 million) for allegedly violating the country’s General Data Protection Law. According to a report by Reuters, the decision was published in the official gazette on Tuesday.
ANPD said ByteDance’s local unit processed personal data of teenagers aged 13 to 18 without a valid legal basis. ByteDance Brasil did not immediately respond to a request from Reuters for comment.
Under the ruling, ByteDance must delete the personal data of teenagers whose legal representation or assistance is not regularised within 60 business days, and notify third parties with whom the data was shared. It must also submit a technical report signed by its data protection officer, along with system audit logs demonstrating compliance, within five business days after that deadline expires.
The company faces daily fines of 137,081.49 reais if it fails to meet the data deletion, reporting, or notification requirements. The total fine could be reduced by 25% if ByteDance waives its right to appeal within 10 business days and pays the penalty within 20 business days.
The decision is part of increased scrutiny by Brazilian authorities of online platforms’ safeguards for children and teenagers, according to Reuters. Earlier this month, ANPD ordered chat platform Discord to suspend livestreaming features over concerns about young users’ exposure to harmful content. Other countries, including Australia, France, and China, have also imposed or considered stricter rules on minors’ use of social media.