Cybersecurity Policy Report, TikTok Faces Privacy Probe in Brazil Over Handling of Kids’ Data, (Nov 5, 2024)
By Tony Foley
The National Authority for Protection of Data (ANPD), Brazil’s data protection authority, has imposed corrective measures on TikTok and opened sanctioning proceedings against the company based on its alleged illegal processing of the personal data of children and adolescents.
The ANPD began investigating TikTok in 2021 and identified several potential violations of the country’s data protection law, Lei Gera de Protecçao de Dados Pessoai (LGPD), particularly regarding the law’s principle governing the best interests of children and adolescents, the ANPD said yesterday in a news release.
In addition, the investigation found evidence of irregularities related to the weakness of TikTok’s age-verification mechanisms, combined with irregular data processing in violation of article 14 of the LGPD.
Among the corrective measures ANPD ordered TikTok to institute are the following:
A complete deactivation of TikTok’s “feed without registration” feature in Brazil within 10 business days to ensure that children and adolescents do not use the platform without prior registration and age verification; and
Implementation of a compliance plan, within 20 business days, to improve age-verification mechanisms.
In addition, the sanctioning process will investigate the practices adopted by the company including the collection of data without age verification or registration, the processing of the data of children and adolescents that are registered on the platform as a result of the weakness of TikTok’s age-verification procedures, and the processing of data to personalize content in the “feed without registration” context based on an alleged legal basis of executing a contract. At the conclusion of the sanctioning process, LGPD may decide to impose sanctions.
The LGPD decision may be accessed from the news release, but is available only in Portuguese.
News: InternationalLegislation LitigationEnforcement DataPrivacy DataSecurity