Brazil has issued one of the most significant regulatory penalties yet against a major platform's use of artificial intelligence in shaping what children see online. The ANPD fined ByteDance 153.7 million reais, about $29.8 million, after identifying five violations of Brazil's General Data Protection Law tied to how TikTok collects and processes data belonging to children and teenagers.
At the center of the case is not simply data storage, but the AI system driving TikTok's personalized feed. According to the regulator's technical findings, new users in Brazil were dropped straight into the app's personalized feed without ever declaring their age or reading its terms of service. That distinction matters because TikTok's feed runs on a machine-learning recommendation system that continuously profiles behavior — what someone watches, how long they linger, what they skip — to decide what to serve next. Regulators effectively argued that children in Brazil were being profiled and served AI-curated content before any safeguard could confirm who they were.
Notably, investigators found this wasn't how TikTok operates everywhere. The same guest-access, algorithmically personalized feed available in Brazil was restricted in the United States and Europe, where access requires a registered account. In other words, the AI-driven personalization engine ran with fewer guardrails in Brazil than in markets with stricter tech regulation, a gap regulators flagged directly.
The scale involved is substantial: the ANPD estimated TikTok may have processed data belonging to at least 8 million children, pointing to systemic gaps in the platform's age-verification systems. Beyond the fine itself, ByteDance has been ordered to delete data belonging to users aged 13 to 18 whose parental authorization isn't properly on file within 60 working days, and to instruct any partners who received that data to do the same. Under the required compliance plan, accounts belonging to users younger than 16 will automatically get stricter privacy settings, alongside stronger parental controls and tighter content filters. Noncompliance carries a daily penalty of more than $26,000, and ByteDance has 10 business days to appeal.
ANPD leadership framed the decision as a message to the wider industry, describing it as a strong signal meant to make platforms take the agency's oversight seriously. That message arrives alongside other recent enforcement actions: the ANPD separately ordered Discord to suspend livestreaming and video calls in Brazil after a teenager was allegedly harmed during a broadcast, and the agency has opened compliance reviews covering roughly two dozen social media platforms.
TikTok's algorithmic personalization has drawn scrutiny well beyond Brazil. The European Commission has separately accused the platform of failing to adequately protect minors from risks including cyberbullying, and in the United States, TikTok agreed just days before Brazil's ruling to pay $400 million to settle allegations that it collected children's data without parental consent.
For an industry increasingly built around recommendation algorithms, the Brazil case is a reminder that AI systems trained to maximize engagement are now squarely inside the regulatory crosshairs. Much of the early AI-regulation debate has focused on chatbots and image generators, but this case shows that recommendation AI, the quieter engine running behind nearly every social app, is drawing just as much attention when it touches children's data. Brazil has shown a particular appetite for this kind of fight before: the country blocked X for 40 days in 2024 until the platform complied with Supreme Court orders, underscoring its willingness to take aggressive action against major platforms.
For AI companies and platforms running recommendation systems at scale, the takeaway is straightforward: age-gating, consent flows, and data minimization aren't separate from the AI system itself. They need to be engineered into it, market by market, rather than layered on afterward as an afterthought.
