ANPD fines ByteDance Brazil over TikTok

Brazil’s National Data Protection Authority, the ANPD, sanctioned ByteDance Brasil Tecnologia Ltda., the company responsible for TikTok in Brazil, in administrative case 00261.006648/2024-02. The decision, published in the Diário Oficial da União, found five violations of the LGPD and imposed administrative fines totaling about R$153,769,671.33, plus a daily penalty for noncompliance.

What did the ANPD decide in the TikTok case?

The ANPD concluded that ByteDance processed data without a valid legal basis, failed to adopt preventive measures, and did not demonstrate compliance with the data protection framework. The authority also ordered the deletion of data collected irregularly and left open the possibility of requiring an independent external audit if the company’s compliance evidence proves insufficient.

The sanction directly affects the handling of personal data from teenagers between 13 and 18 years old who are registered on the platform without properly regularized parental representation or legal assistance. The ANPD ordered that information deleted and also required notice to third parties with whom the data had been shared so they can remove it from their own databases. DNALaw said the decision can be appealed to the ANPD’s governing council and that the sanction included a compliance plan to strengthen protections for children and adolescents.

What changes in ANPD enforcement?

The TikTok case fits into a tougher phase of LGPD enforcement, with structural measures that go beyond fines. Legal press coverage describes the authority as using data deletion orders, external audits, and daily penalties tied to compliance obligations as central supervision tools.

ANPD leadership told Veja that the TikTok fine was the harshest imposed by the authority to that point and that fines are a last resort in the sanctioning process. At the same time, StartSe analysis argues that the ANPD already has authority to impose sanctions and fines related to the improper use of artificial intelligence systems, as well as to issue certification rules and regulate algorithmic impact assessments under the LGPD.

How does this connect to ECA Digital?

The tougher posture coincides with the first year of ECA Digital implementation, a program under which the ANPD has already monitored 37 companies and opened enforcement cases covering another 22 digital platforms, according to the MJSP. The authority also opened two new monitoring actions on platforms, app stores, and generative AI tools to review complaint channels, internal response workflows, and measures to prevent and mitigate risks for children and adolescents.

The ANPD stressed that the fact that the program is still being implemented does not prevent it from opening enforcement cases or issuing preventive measures. The MJSP added that the authority adopted preventive precautionary measures and administrative sanctions against platforms that failed to meet requirements for protecting children and adolescents online.

The regulatory agenda has already reached another operational milestone. The ANPD said providers of apps aimed at children and adolescents, or likely to be used by that audience, had to publish the first ECA Digital semiannual transparency report by Sept. 17, with minimum content on complaints, moderation, and preventive measures. UOL reported that platforms with more than 1 million users under 18 had to meet that deadline, while Brazil’s Senate clarified that the count should begin from the date the law reached its first anniversary and that the initial report should cover the first half of 2026.

The ANPD also said it opened a dedicated ECA Digital complaints channel in June and had already received about 200 reports, mostly about the absence of security measures to prevent access to content inappropriate or prohibited for minors. In that same context, Folha and UOL reported that Discord published its first transparency report and classified the risk of suicide and self-harm among teenagers as low, in contrast to the ANPD’s assessment, which said it found strong evidence of insufficient safeguards. The authority also confirmed that its ECA Digital enforcement already included a monitoring process on Discord and preventive measures.