In 2021, Vice Italy journalist Riccardo Coluccini filed a data request under Europe’s GDPR to see what TikTok had collected during his own brief use of the app. The response contained 381,264 data units, including his full watch history and every click he made within the app. Cross-referenced with IP addresses, the data could reconstruct not just what he watched but where he was when he watched it, including when he was away from home. “What I found in their data shocked me,” Coluccini told Tech Policy Press. He said he had no idea the investigation would end up as the basis for a complaint filed with a data protection authority in another country.
That complaint became the foundation of a five-year investigation by Brazil’s National Data Protection Authority (ANPD), which concluded this week with the agency’s first-ever sanction against a major technology company: a 153 million reais (approximately $29.7 million) fine against ByteDance for improperly collecting and processing data from children and adolescents. ANPD found that TikTok stated the platform was unsuitable for users under 13 while failing to prevent their access, and calculated that roughly 20% of Brazilian children, an estimated 8 million users, had their data improperly collected. TikTok itself acknowledged to the agency that it removed approximately 7.75 million child accounts between October 2022 and September 2023.
“This creates serious risks: the content children can access, the contacts they can have, for an environment that wasn’t designed for that audience,” ANPD director Lorena Giuberti Coutinho said in a statement.
Beyond the fine, ANPD ordered ByteDance to delete data collected from adolescents aged 13 to 18, restrict access for users under 16, expand parental supervision tools, restrict access for users without an account and suspend advertising to unregistered accounts. Coutinho said some of these changes exceed what the agency had originally requested. “The regulatory action led to concrete changes in the design of the service,” she said. “It is these changes that will bring real changes in the experience of children and adolescents in the digital environment and reduce the risks to which they were previously exposed.”
ByteDance has 10 days to appeal. TikTok said in a statement that child safety is “an absolute priority” and that the ruling “refers to an earlier period (2021) and does not reflect” the compliance plan it presented to the ANPD in 2025.
The case lands as ANPD’s authority is expanding well beyond its original data-protection mandate. Created as Brazil’s LGPD enforcement body, the agency has this year also taken on responsibility for implementing new social media regulation decrees under President Luiz Inácio Lula da Silva’s government, as well as the ECA Digital child protection law, which took effect in March 2026 but does not cover the conduct at issue in this ruling. That expanded toolkit is already in use elsewhere: this month, ANPD separately ordered Discord to suspend livestreaming after linking the feature to a suicide case.
Coluccini, assessing the ByteDance fine, called ANPD “one of the few data protection authorities willing to take on the big social media platforms to ensure that people’s rights are respected,” even as he noted TikTok’s claim that the data practices at issue are no longer in use.
Dragomir is a Serbian freelance blog writer and translator. He is passionate about covering insightful stories and exploring topics such as influencer marketing, the creator economy, technology, business, and cyber fraud.
A Brazilian regulator’s $29.7 million fine against ByteDance this week traces back to one reporter checking what TikTok knew about him.
In 2021, Vice Italy journalist Riccardo Coluccini filed a data request under Europe’s GDPR to see what TikTok had collected during his own brief use of the app. The response contained 381,264 data units, including his full watch history and every click he made within the app. Cross-referenced with IP addresses, the data could reconstruct not just what he watched but where he was when he watched it, including when he was away from home. “What I found in their data shocked me,” Coluccini told Tech Policy Press. He said he had no idea the investigation would end up as the basis for a complaint filed with a data protection authority in another country.
That complaint became the foundation of a five-year investigation by Brazil’s National Data Protection Authority (ANPD), which concluded this week with the agency’s first-ever sanction against a major technology company: a 153 million reais (approximately $29.7 million) fine against ByteDance for improperly collecting and processing data from children and adolescents. ANPD found that TikTok stated the platform was unsuitable for users under 13 while failing to prevent their access, and calculated that roughly 20% of Brazilian children, an estimated 8 million users, had their data improperly collected. TikTok itself acknowledged to the agency that it removed approximately 7.75 million child accounts between October 2022 and September 2023.
“This creates serious risks: the content children can access, the contacts they can have, for an environment that wasn’t designed for that audience,” ANPD director Lorena Giuberti Coutinho said in a statement.
Beyond the fine, ANPD ordered ByteDance to delete data collected from adolescents aged 13 to 18, restrict access for users under 16, expand parental supervision tools, restrict access for users without an account and suspend advertising to unregistered accounts. Coutinho said some of these changes exceed what the agency had originally requested. “The regulatory action led to concrete changes in the design of the service,” she said. “It is these changes that will bring real changes in the experience of children and adolescents in the digital environment and reduce the risks to which they were previously exposed.”
ByteDance has 10 days to appeal. TikTok said in a statement that child safety is “an absolute priority” and that the ruling “refers to an earlier period (2021) and does not reflect” the compliance plan it presented to the ANPD in 2025.
The case lands as ANPD’s authority is expanding well beyond its original data-protection mandate. Created as Brazil’s LGPD enforcement body, the agency has this year also taken on responsibility for implementing new social media regulation decrees under President Luiz Inácio Lula da Silva’s government, as well as the ECA Digital child protection law, which took effect in March 2026 but does not cover the conduct at issue in this ruling. That expanded toolkit is already in use elsewhere: this month, ANPD separately ordered Discord to suspend livestreaming after linking the feature to a suicide case.
Coluccini, assessing the ByteDance fine, called ANPD “one of the few data protection authorities willing to take on the big social media platforms to ensure that people’s rights are respected,” even as he noted TikTok’s claim that the data practices at issue are no longer in use.
Subscribe to Our Newsletter
Check Out Our Podcast