Brazil fines TikTok over minors’ data

Brazil’s Agência Nacional de Proteção de Dados (ANPD) published a decision on 25 August 2026 in the Diário Oficial da União imposing administrative sanctions on ByteDance, the owner of the TikTok platform. The ruling comprises three fines that together amount to R$153,769,671.33 — widely reported as R$153.7 million and equivalent to roughly €25.57 million or just under US$30 million in contemporary conversions.

According to the ANPD notice, the authority identified five violations of Brazil’s General Data Protection Law (Lei Geral de Proteção de Dados, LGPD). The findings cite breaches of core principles under article 6 and of the legal bases for processing under article 7: specifically, the processing of personal data of children and adolescents without a valid legal basis. The violations relate to both TikTok’s so‑called “feed without registration” (content available without an account) and “feed with registration” (personalized content for registered users).

Beyond the financial penalties, the ANPD ordered ByteDance to remove data collected irregularly. The ruling sets out precise compliance requirements: the company must supply technical reports and audit logs and implement a compliance plan. The decision includes particular provisions for users aged 13 to 18 if their legal representation is not regularized within specified deadlines — in those cases, the ANPD requires deletion of the data.

For the anonymous feed — the experience available without registration — the ANPD prescribes a series of product changes: suspension of advertisements in Brazil for that mode, disabling live streams and direct messages for anonymous access, limiting the duration of anonymous sessions (the authority mentions a 12‑hour limit as an example), reducing personalization and data collection, and applying stricter default settings and parental controls for under‑16 accounts. These measures are explicitly intended to reduce the amount of personal data processed in non‑authenticated contexts.

The ANPD’s announcement emphasizes that the sanctions relate to conduct in the period under review and are thus directed at past processing activities. ByteDance was formally notified and, according to the ANPD, has ten business days to file administrative appeals with the authority. That procedural window leaves room for challenges and could extend the matter into further administrative proceedings.

In addition to appeals, the ANPD requires documentary proof of remedial actions: technical records and auditable logs must be produced to demonstrate compliance. This demand puts the burden on ByteDance not only to change product features but also to provide verifiable evidence that data deletions and other adjustments have taken place.

Brazil’s LGPD has become the principal legal framework governing personal data processing in the country. It enshrines principles that limit processing and sets heightened protections for the data of children and adolescents. The ANPD, as the enforcement body, has the authority to apply fines and order corrective measures when breaches occur.

The decision underlines that the ANPD is prepared to impose both monetary and operational constraints on widely used digital platforms to secure compliance with child‑protection provisions. In practical terms, enforcing stricter defaults and curbing data collection for minors are among the remedies the authority will use to reduce legal risk and protect vulnerable groups.

The product changes ordered for anonymous users — notably the suspension of ads and the disabling of live features — strike at revenue and engagement channels central to TikTok’s business model. If enforced, these changes could reduce opportunities for advertisers to reach Brazilian audiences in anonymized contexts and diminish direct income streams associated with live interactions.

For creators and advertisers operating in Brazil, the ruling may necessitate adjustments to content strategies and monetization approaches. The decision also signals to other global platforms that national regulators will use the LGPD’s provisions to demand both fines and specific product modifications when minors’ data are at stake.

Several practical and legal uncertainties remain. It is unclear whether ByteDance will lodge appeals within the allotted ten business days and, if so, on what grounds. An administrative appeal could lead to a prolonged adjudication process inside the ANPD and potentially further judicial review afterwards.

Technically, some of the ANPD’s directives — for example, imposing a hard limit on anonymous sessions or segregating data for users whose legal guardianship has not been established — require substantial engineering work and ongoing auditability. It will be important to monitor whether the company can and will document compliance to the satisfaction of the regulator. The ruling may also have international reverberations: other data protection agencies and lawmakers watching the enforcement of the LGPD could adopt similar approaches to platform governance where children’s data are concerned.