Brazil's ANPD revises sanctions for ECA Digital

Update September 16, 2026: Brazil’s ANPD has moved ahead with revisions to its sanctioning rules to also cover the ECA Digital and changes to the Marco Civil da Internet. In September, the agency’s record fine of R$ 153,769,671.33 against TikTok also became public, tied to violations involving the processing of children’s and adolescents’ data.

The ANPD opened the review of its dosimetry and enforcement regulations in September 2026 so they would no longer be limited to LGPD violations. The process aims to also incorporate sanctions set out in the Estatuto da Criança e do Adolescente Digital (ECA Digital) and in decrees that update the regulation of the Marco Civil da Internet, with a public consultation open on Participa + Brasil through mid-September.

What is changing in the ANPD rules?

The authority is revising the Regulation on Dosimetry and Application of Administrative Sanctions, approved by Resolution CD/ANPD No. 4/2023, and the Regulation on the Inspection Process, approved by Resolution CD/ANPD No. 1/2021. Both were originally designed for the LGPD regime, but they will now also cover the sanction response to situations involving minors online.

That regulatory shift comes as the ANPD broadens its enforcement reach. In the Discord case, legal analyses published in September 2026 argue that the authority combined Article 45 of Law 9,784/1999, which governs federal administrative procedure, with Article 32 of Resolution CD/ANPD No. 1/2021 to adopt preventive measures not explicitly listed in the rulebook.

What does the Discord case show about the ANPD's scope?

The case made clear that the ANPD is operating with tools designed for the LGPD while the ECA Digital framework is still being adjusted. The IDP blog notes that the inspection rules, originally created for the data protection law’s powers, are being revised to fully incorporate the authorities stemming from the new statute for children and adolescents in digital environments.

The issue is not only regulatory. Articles about the blocking of Discord stress that Article 35, Section 5 of the ECA Digital reserves the power to apply suspension or ban penalties against platforms to the courts, while leaving the ANPD warnings and fines. That has raised debate over how far the agency’s precautionary measures can go under the LGPD and the ECA Digital.

What did the ANPD say about its powers and oversight agenda?

In an interview published by Folha de S.Paulo, the agency’s director said the ANPD is preparing an artificial intelligence center to strengthen its oversight capacity and is studying practices such as infinite scroll on digital platforms. The same interview noted that the ANPD can issue fines of up to R$ 50 million per LGPD violation, but that suspending a platform depends on a court order.

That reading matches other regulatory analyses. Araujo Policastro Advogados explained that when a single conduct violates more than one LGPD provision, the ANPD can impose a sanction for each violation, and that the R$ 50 million cap applies per infraction, not to the entire enforcement case. In that framework, the total can exceed that amount if multiple violations are stacked.

How is compliance becoming stricter?

Regulatory pressure is not limited to major platforms or headline cases. LEM Advogados said Resolution CD/ANPD No. 15/2024 also governs reporting security incidents in video surveillance settings, including condominiums, with steps that include containment, evidence preservation, identification of data and affected people, risk or harm assessment, documentation, the decision to notify, and correction of vulnerabilities.

Processei added that the ANPD has been emphasizing the need for incident response committees capable of mitigating data loss, assessing risks to data subjects, deciding whether to notify the ANPD and affected parties within RCIS deadlines, and documenting all actions for evidentiary purposes. That approach reinforces the expectation of formal data governance structures, including in operations that handle minors’ information.

What impact did the record fine against TikTok have?

On August 25, 2026, the ANPD imposed a total fine of R$ 153,769,671.33 on a major digital platform for violations related to the processing of personal data of children and adolescents, according to Migalhas. The amount was described as the largest monetary penalty the agency had issued to date.

GRCx3 reported that in the TikTok case, the simple fines total R$ 153,769,671.33 and include penalties for processing children’s and adolescents’ data without a valid legal basis, failing to adopt effective preventive measures, and failing to demonstrate LGPD compliance. The analysis points to Articles 7 and 6, subsections VIII and X, of the law.

What sanctioning criteria is the agency cementing?

The analysis published by Anderson Chipak says Law 15,352/2026 consolidates the ANPD as a regulatory agency. It also describes the sanctions rule as including aggravating factors such as specific or general recidivism and failure to comply with preventive or corrective orders, which can raise the fine by 5% to 90% of the initial amount.

The same text lists mitigating factors that can reduce the fine by 5% to 75%, including the adoption of governance measures, risk mitigation, or damage repair. It also provides for an additional 25% discount for those who give up the right to administrative appeal.

What is known about the ANPD's technical agenda?

The ANPD’s director said the authority is preparing its own artificial intelligence center and will direct part of its oversight to mechanisms such as infinite scroll, according to Folha de S.Paulo. The reference links child protection directly to algorithmic regulation.

That agenda is unfolding alongside an increasingly strict reading of documentary and substantive compliance. The debate around the TikTok case, the review of sanction and inspection rules, and the discussion over powers against platforms show the ANPD adjusting its tools while adding new oversight fronts.