Brazil fined ByteDance for data it took from users who never logged in

The deletion order is the only remedy in the package that reaches data from people without accounts ^[19]. The rest is account-shaped: automatic strict privacy settings for under-16 accounts, stronger parental supervision systems, tighter content filters ^[6]. Those govern people who signed up. The finding covers people who never did ^[2]. The enforcement theory is therefore wider than the fix, and that gap is where the next case sits.

Brazil's recent statute is account-shaped too. It requires platforms to link under-16 accounts to a parent's account and to verify how old users are ^[15]. A product can satisfy all of that and still be processing data from logged-out visitors with no valid legal basis, which is what the National Data Protection Agency says happened here ^[2]. The compliance artefact that answers the law does not answer the ruling.

For anyone reporting to Brussels rather than Brasilia, the transferable part is the instrument. The European Commission charged TikTok in July under the Digital Services Act over failing to protect children's privacy, and that case is open with no fine ^[11]. The DSA case turns on systemic risk assessment; Brazil's turns on lawful basis for processing, the same test written into the GDPR ^[12]. A data protection authority can fine on how information was collected without having to prove the design of the product caused harm ^[14], and every EU country has one ^[13].

Three weeks ago the same agency was telling Discord to stop livestreaming after the death of a 13-year-old girl, with AFP describing the action as an order and the AP describing it as a recommendation ^[10][20]. Discord appealed on Monday and the appeal is under review ^[10]. Whichever word applies, the agency has since moved to cash.

The order is survivable, which is the point. Brazil has not suspended or blocked TikTok and has not restricted what it publishes ^[8], less than the first lady asked for when she said on 6 August that the platform should be taken offline ^[9], and much less than the country did to X, blocked for 40 days in 2024 until it complied with Supreme Court orders ^[16]. ByteDance did not comment to the AP, whose Mauricio Savarese reported the decision, and did not respond to AFP ^[7][18]. Its ten days matter more than the sum ^[7]: contest the guest-session finding and you argue the interesting question in public, pay and comply and the reading stands for the next regulator to borrow.

Elsewhere the response has been account arithmetic. TikTok and YouTube cut 4.7 million under-16 accounts in Indonesia in June ^[17]. Deleting accounts does nothing at all about a logged-out surface.