In Brazil, asking for an age and believing the answer cost 153.7 million reais

The point: the user declares their own age

The authority found the platform relied exclusively on self-declared age, a method users manipulate easily. It is the same design choice found in thousands of European services: a dropdown with a birth year, no verification, problem considered solved. In Brazil it is no longer considered sufficient.

The violations cover both the feed accessible without registration — browsing the app without creating an account — and the one reserved for signed-up users. That distinction matters: many companies treat the unregistered visitor as a non-user, therefore outside the scope of their obligations. That is wrong: if the service profiles and tracks, the absence of an account takes nothing away.

What the company must do, beyond paying

• Delete all data collected irregularly
• Implement reliable age verification mechanisms, following the Digital Statute for Children and Adolescents (ECA Digital)
• Automatically default accounts of users under sixteen to the most restrictive privacy settings

Why a Brazilian decision concerns Europe

The LGPD is built on the GDPR's architecture and the ANPD tends to move in dialogue with European authorities. The age question, moreover, is converging everywhere: the UK requires highly effective age assurance, the EU is debating child protection under the Digital Services Act, and the Italian DPA has already intervened repeatedly on minors' access to platforms. A decision qualifying self-declaration as inadequate is bound to be cited outside Brazil too.

A note of realism: verifying age properly means collecting more data, not less — a document, a biometric, an intermediary that certifies. That is the unresolved tension in this whole area, and none of the authorities demanding verification has yet explained how it squares with the minimisation principle. It is the problem the next two years will have to solve.