TikTok may be suspended in the country; action reinforces regulations on privacy of children and young people

The National Data Protection Authority (ANPD) initiated an administrative sanctioning process against TikTok to investigate possible irregularities in the processing of personal data of children and adolescents. The authority suspects that the social network has violated the personal data protection law.

The authority asks the social network to take the “feed without registration”, which allows anyone, including minors, to access the platform’s content.

Tests carried out by the government authority itself show that this practice does not happen in places like the United States and Europe. “There is a double standard of protection”, says Isabella Henriques, CEO of Instituto Alana and senior advisor to the National Council for the Protection of Personal Data and Privacy (CNPD).

Alana helped the National Authority raise references for the case against ByteDance – a Chinese company that operates content platforms, including TikTok. The institute's analysis showed that browsing without registration is the default feed of TikTok, in which registration is a voluntary action by the user.

The platform's design option favors audience capture, but fails to protect the principle of the best interests of children and adolescents, present in the General Data Protection Law (LGPD).

According to this principle, the rights of children and adolescents must be observed as a priority, prevailing over other interests, in order to guarantee adequate protection for their personal data.

The authority gave TikTok 10 days to withdraw the feature feed without registration and 20 days for ByteDance to “improve age verification mechanisms”. If it does not meet these requirements, the network may suffer more serious sanctions, such as fines and even suspension. In other words, stay off the air.

Infringement involving children and adolescents' data is considered serious, with aggravating factors under both the LGPD and the Federal Constitution. If this happened, it would be an unprecedented case of action by the ANPD.

According to the Authority, TikTok “processes the personal data of minors in view of the fragile mechanism for identifying the age of users at the time of registration”.

In an article published by Fast Company Brazil On April 8 of this year, professor in the computing department at the Federal University of Pernambuco George Valença classified the lack of friction in TikTok registration as “purposely flawed”. According to the expert, more registration steps could make the network safer for teenagers.

FOR OVER AND UNDER 13

The ANPD's decision is the result of an inspection process that began in 2021. At the time, the research revolved around how the social network handled data from people under 15 years of age. In documents sent to the ANPD itself, ByteDance states that the network is not aimed at children under 13 years of age.

Survey data ICT Kids Online from 2023 indicate that 63% of Brazilian children and teenagers have access to TikTok. The survey carried out by the Internet Steering Committee in Brazil shows that more than 30% of young people between the ages of nine and 10 have TikTok as the most used platform, behind only YouTube.

ByteDance reported that from October 2021 to September 2023, it took down 7.75 million accounts of children under the age of 13. The company, however, does not reveal the number of users in Brazil – some research estimates this number at 98 million. According to Isabella, from Instituto Alana, it is not possible to measure the proportionality of TikTok's actions to protect children.

The campaign that TikTok ran to show that the platform was not suitable for children under 13 years old had language and elements appealing to children, such as drawings and childish language. Instituto Alana analyzed the campaign and noticed that the majority of comments on the videos were made by children, questioning the recommendation of the app itself.

In a statement, TikTok informed that it is working with the ANPD and civil society to strengthen age control mechanisms and that it has “a firm commitment to security and privacy”.

“Improving age control mechanisms is an industry-wide challenge, and we will continue to strengthen our approach, collaborating with the ANPD and industry and civil society partners to find other solutions,” the network said in a statement.

INTERNATIONAL CONTEXT

The Brazilian decision follows similar actions by international authorities, such as the European Union, which recently imposed a fine of €345 million (more than R$2.1 billion) on TikTok for inadequate data protection practices for minors.

In March, TikTok was ordered to pay US$11 million (R$63.5 million) by Italy's competition watchdog for insufficient content verification.

TikTok has 10 days to remove the feed without registration feature and 20 to improve age verification mechanisms.

Last year, it was fined US$16 million (R$92 million) by the UK data privacy regulator for inappropriate handling of children's personal information, in addition to a fine of US$1 million (R$5.8 million ) in the Netherlands and US$5.7 million (R$33 million) in the United States in 2019.

TikTok resorted to European fines, but set aside US$1 billion (R$5.8 billion) of its cash for provisions, according to Bytedance's third-quarter financial results. In both the United States and Europe, the network does not have the ability to feed without logging in.

Lawyers linked to the case say that, if TikTok manages to comply with the premises, there will be progress in the protection of children in other digital environments. The ANPD's intention is to ensure the compliance of technology companies, so that they act proactively to protect the online audience – especially with regard to types of content.

The impacts could go beyond TikTok. “This action opens the door to inspection on other platforms, such as bets”, says Isabella Henriques.

---