Brazil's ANPD Fines ByteDance Over Minors' Data

Update September 10, 2026: The ANPD fine against ByteDance is now tied to two additional scrutiny fronts in Brazil, an MPF recommendation over mercury ads aimed at garimpeiros and an interview in which an ANPD director said the agency is preparing an artificial intelligence center and is also looking at infinite scroll on platforms.

Brazil's National Data Protection Authority fined ByteDance, TikTok's parent company, R$ 153.7 million for irregularities in the handling of children's and adolescents' data. The administrative decision also ordered the deletion of personal data obtained irregularly and required a compliance plan to strengthen protections for minors, with measures covering the no-account feed and the recommendation system.

What did the ANPD find on TikTok?

The ANPD concluded that the platform processed minors' data without proper legal basis and used information collected during browsing, including in the no-account feed, to feed its recommendation system and ad display. According to the notice published in the Diário Oficial da União, the case also identified violations of articles 6, items VIII and X, and 7 of the LGPD.

Specialized Brazilian privacy outlets said the fine fits into a framework that now goes beyond the LGPD. In their view, Law No. 15,211/2025 and Decree No. 12,880/2026 add specific design and governance obligations for platforms aimed at children and teens, including age-verification mechanisms and limits on commercial profiling of minors.

The authority also criticized ByteDance for giving generic and incomplete answers during the investigation. In coverage of the case, that point was treated as an aggravating factor in the enforcement process.

What corrective measures were imposed?

The sanction did not stop at the fine. The ANPD ordered the deletion of personal data from children and adolescents obtained irregularly and set a specific compliance plan to strengthen protection for minors, including changes to the no-account feed and the recommendation system.

Other reports said the authority also ordered the removal of data from adolescents ages 13 to 18 without a properly regularized legal guardian within a maximum of 60 business days. Biometric Update also said the company would have 10 days to appeal the decision.

International coverage placed the amount at about R$ 153.8 million, or roughly $29.8 million. The case was described as the toughest regulatory test yet in child safety for digital platforms.

How does this fit into the ANPD's new agenda?

The fine comes as the ANPD broadens its institutional reach. In September 2026, it opened two public calls for input to define its next regulatory agenda and its regulatory outcome assessment process. That effort is taking place as the authority expands its powers beyond the LGPD, with regulation and enforcement of the ECA Digital.

Its enforcement posture is also visible on other fronts. The ANPD ordered the immediate suspension of facial recognition used to register student attendance in public schools in Paraná, a case that ended with the system discontinued in July 2026 after the contract with Valid expired. After the order, schools went back to calling roll the traditional way.

Compliance sources consulted in Brazil recall that the LGPD allows administrative fines of up to 2% of a company’s gross revenue in Brazil, capped at R$ 50 million per violation, in addition to warnings, public disclosure of the infraction and partial or total suspension of processing activities. They also note that the ANPD can order partial bans on campaigns, the deletion of entire databases and other measures provided for in Article 52.

Within that framework, the cited analyses stress that formal LGPD compliance is not enough on its own. For minors, biometrics, health or marketing, the authority has been demanding specific governance mechanisms, with attention to proportionality, legal basis and technical standards.

The MPF also publicly linked the ANPD's fine against ByteDance to its own recommendation aimed at TikTok over mercury ads directed at garimpeiros. Brazilian general-interest media reported that the agency issued that recommendation after finding the ads, which shows a new front of official scrutiny over the platform in Brazil.

In another recent interview, an ANPD director said the authority is preparing an artificial intelligence center and that, alongside landmark cases like TikTok's, its enforcement agenda is also looking at practices such as infinite scroll on platforms. The signal broadens the regulatory focus toward interface design patterns and their impact on data protection and rights holders.