Brazil's ANPD Fines TikTok R$153.7 Million

Brazil’s data protection authority, the ANPD, fined ByteDance Brasil, which operates TikTok in the country, a total of R$153.7 million for irregular handling of personal data belonging to children and adolescents. The ruling also orders the deletion of data processed in violation of the LGPD and requires a specific compliance plan to strengthen protections for minors on the platform.

What did the ANPD find on TikTok?

The ANPD’s enforcement division identified practices incompatible with the LGPD in both the feed without registration and the feed with registration, as they relate to the processing of children’s and adolescents’ data. According to Technical Note No. 50/2024/CGF/ANPD, there were also serious failures in age verification mechanisms, which allowed widespread use of the platform by children under 13, even without an account.

Decision Order No. 27/2026/CGS/SFI, published in the Official Gazette, says the authority imposed three separate fines on ByteDance Brasil. According to that document, the violations relate to Article 7 of the LGPD, covering lawful bases for personal data processing, and Article 6, item VIII, which establishes the principle of prevention.

How was the penalty broken down?

The ANPD split the sanction into three separate fines, totaling R$153.7 million, according to the order published in the Official Gazette. Exame reported that one of them amounts to R$63,176,686.67 for violating Article 7 of the LGPD, tied to the use of an invalid legal basis for child registration.

Exame also said the company can receive a 25% discount if it waives an appeal and pays within 20 business days, which would reduce the total to R$115,327,253.49. The same coverage added that the ANPD ordered the deletion, within 60 business days, of personal data belonging to adolescents ages 13 to 18 whose legal guardians have not regularized representation or assistance on the platform.

What else did the regulator require?

Beyond the fine and the deletion of irregularly processed data, the ANPD required ByteDance, or TikTok, to implement a specific compliance plan to improve protection for children and adolescents, with future remediation measures under regulator oversight. G1 placed the sanction within a broader enforcement pattern, in which the authority issues fines and deletion orders when it identifies systematic LGPD violations.

Metropoles said the ANPD technical note found serious age-verification failures, and that issue was treated as an aggravating factor in setting the sanction. HDPO, meanwhile, said the authority observed a technical architecture that makes real-time detection of violations difficult, along with a lack of reasonable measures to prevent and mitigate risks for children and adolescents.

How does this case fit into the ANPD's recent agenda?

The TikTok fine became public just days after the ANPD launched two supervisory actions targeting 22 digital services, including social networks, AI platforms and app stores. That thematic review asks companies to report measures adopted or under development to comply with new protection rules focused especially on children, adolescents and women in digital environments.

Correio do Povo said the monitoring was formalized in Case No. 00261.005031/2026-23 and includes, among others, Discord, TikTok, Facebook, Instagram, Telegram, WhatsApp, X and YouTube. UOL Tilt said the focus is on criminal or unlawful content that could affect minors and women, while Cescon Barrieu and the Ministry of Human Rights linked the agenda to the Digital ECA, which requires semiannual reports in Portuguese from providers with more than 1 million registered users under age 18 in Brazil.

According to Cescon Barrieu, that first Semiannual Transparency Report must be published by Sept. 17, 2026. The Ministry of Human Rights said those reports must include data on complaints, content removal, parental control tools and other protective measures, in a framework that complements LGPD obligations.

JusDocs also noted that the LGPD sets a ceiling of R$50 million per violation for separate fines and that, in this case, the ANPD added multiple violations to reach the sanctioned total. The same analysis said that, after Resolution CD/ANPD No. 15/2024, incidents that may cause relevant risk or harm must be reported within three business days, and that incident records must be kept for at least five years, points the authority can demand in audits or inspections.

More details from the case file and the scope of the sanction

The ANPD also ordered that third parties with whom the data was shared be notified so they can delete it as well. In addition, once the compliance deadline passes, ByteDance must submit a technical report within five business days with evidence of compliance, audit logs and a signed statement from the data protection officer.

According to the regulator’s official note, the case identified five LGPD violations tied to Articles 6, items VIII and X, and 7, involving processing without a valid legal basis and the absence of adequate prevention measures. The Superintendence of Inspection also found irregular practices in both the feed without registration and the feed with registration.

Agência Mestre reported that the three penalties were approximately R$63.1 million, R$63.1 million and R$27.4 million, and that they were based on violations linked to processing without legal basis, noncompliance with the principle of prevention, and failures in accountability and data governance. O Globo added that the ANPD estimates TikTok processed data from at least 20% of Brazil’s girls and boys, although the real number could be higher because of underreporting and traceability problems.

Decision Order No. 27/2026, published in the Official Gazette on Aug. 25, 2026, also ordered the deletion of data from children and adolescents collected irregularly and specific operational changes in how the app works in Brazil. Those include stricter default privacy settings for users under 16, parental supervision tools and the suspension of advertising for users who access the app without logging in.

Agência Mestre said the inspection led to Technical Note No. 50/2024, the sanctioning process was opened in November 2024 and the decision was published in August 2026. It also said ByteDance must, within 60 business days, regularize legal representation for accounts of adolescents ages 13 to 18 already registered or delete those accounts, and notify third parties that received that data so they delete it too.

The same outlet added that, for TikTok’s so-called feed without registration in Brazil, the ANPD ordered usage to be limited to a maximum of 12 hours, advertising to be fully suspended, content creation, direct messages, live streams and personalized recommendations to be blocked, and data collection to be reduced to language, region and basic device information.

Fronteira Livre said the sanctioning decision also includes a daily fine of roughly R$137,081.49 for each unmet obligation, whether deleting data, delivering reports or notifying third parties that received information about the affected adolescents.

Resolution CD/ANPD No. 19/2024 requires adequate protection, formally and materially equivalent to the LGPD, for international transfers, with safeguards against access by unauthorized third parties or under compulsion from foreign laws. Following the Brazil-EU adequacy decision in January 2026, that standard now operates in practice with parameters equivalent to European ones.

Resolution CD/ANPD No. 18/2024 reinforces the obligation to publicly and clearly disclose the identity and contact details of the data protection officer, preferably on the controller’s website. That framework was reinforced by the amendment to Article 41 of the LGPD through Law 15.352/2026, which now uses the term "Agency" instead of "Authority."

The review of Resolution CD/ANPD No. 4/2023 seeks to unify criteria for the LGPD, the Digital ECA and the Internet Civil Framework, with 19 provisions to be amended and an integrated architecture for classifying violations, conducting cases and setting penalties. Legal Opinion No. 00045/2026 from the Federal Prosecutor’s Office attached to the ANPD found the proposal legally sound and cleared it to move to public consultation after the Board’s deliberation, but the changes are not yet in force.

According to a media review, the ANPD currently has at least 10 active cases against seven big tech and digital platforms, including Meta, Google, Microsoft, Apple, WhatsApp, Telegram and X/Grok, with files tied to possible LGPD violations, child protection and the fight against illegal content. Eight are still pending and two have already been concluded.

In comments quoted by Poder360, the ANPD president said the TikTok sanction should be read as a warning to other apps and that the authority’s dialogue with companies has "limits." He also said the guidance phase has given way to stricter enforcement against repeat offenses and serious failures in protecting children’s and adolescents’ data.

O Globo reported that the decision was published in the Official Gazette on Aug. 25 and that the platform was challenged for processing minors’ data without adequate legal support, even in the no-login experience. TecNois added that TikTok was not banned in Brazil, but that the ANPD closed an administrative case opened in 2021 in August 2026 and required 11 changes to the platform, including a complete suspension of ads for users accessing the feed without logging in.

That point has a direct impact on monetization, because the order for the no-login feed limits content creation, direct messages, live streams, personalized recommendations and advertising. It also reduces collection to language, region and device data, while authorities continue to cross-check those findings with other enforcement lines on content and targeted advertising.

The case now sits inside a tougher regulatory standard for digital services that operate with minors, because Law No. 15.211/2025 and Decree No. 12.880/2026 strengthen protections for children and adolescents in digital environments and push platforms to align with rules that sit alongside the LGPD.

According to Portal R7 and Portal EdiCase, that framework raises the compliance bar for companies like ByteDance, because adjusting privacy policies or legal bases under the LGPD is not enough. The regulatory reading now requires alignment between the general personal data regime and the specific rules for digital child protection.

In that sense, the ANPD fine does not appear as an isolated case, but as one piece of a regulatory environment that has been tightening controls over product design, data processing and monetization in services used by children and adolescents.

Resolution CD/ANPD No. 15/2024 says that, when reporting an incident is required, it must be sent to the ANPD and to affected data subjects within three business days of becoming aware of the event. The rule also allows the initial information to be supplemented later and requires incident records, reported or not, to be retained for at least five years. Specialized sources note that this deadline differs from the GDPR’s 72-hour standard.