Brazil Fines TikTok Over Minors’ Data

Update August 30, 2026: ANPD confirmed the fine against ByteDance Brasil was about 153.8 million reais and said the irregularities affected both the no-account feed and the account-based feed. TikTok said the penalty refers to a period before a compliance plan that the company says was approved in 2025.

Brazil’s National Data Protection Authority fined ByteDance Brasil, TikTok’s local controller, about 153.8 million reais for alleged violations of the General Data Protection Law (LGPD) tied to the handling of personal data from teenagers aged 13 to 18 without a valid legal basis. The decision also ordered the removal of data collected irregularly and tighter controls over minors’ accounts.

What did ANPD order besides the fine?

ANPD ordered TikTok’s local subsidiary to delete data collected irregularly and apply a specific compliance plan for protecting children and adolescents on the platform. The authority said the sanction was formalized in the Diário Oficial da União on August 25, 2026.

Reuters and Euronews reported that the measure includes stricter privacy controls for accounts belonging to users under 16, more parental oversight, and the introduction of tougher content filters. The original note also said the decision required the deletion of data from teenagers whose legal guardian had not been identified.

What did ANPD find on TikTok?

ANPD concluded that personal data from children and adolescents was processed without an adequate legal basis on two fronts, the no-account feed and the account-based feed. In its official statement, it attributed five specific violations to articles 6, items VIII and X, and 7 of the LGPD.

The decision covered both use of the platform without creating an account and use with a registered account. Reuters also reported that the authority linked part of the problem to flaws in the platform’s age verification system.

How large was the case, according to ANPD?

Reuters reported that ANPD estimated TikTok may have processed data from at least 8 million children and linked part of the issue to flaws in the platform’s age verification system. O Globo cited an even broader estimate from the authority, which calculated that TikTok may have collected data from at least 20% of Brazil’s girls and boys, although the agency itself said this was a minimum and the number could be exponentially higher.

That estimate was not presented as a complete count. The figure appears in press coverage based on the reading of the sanction and statements attributed to ANPD, not as a closed audit of the full universe of affected users.

What did TikTok say after the fine?

TikTok said the fine refers to a period before joint work with the authority and that ANPD reportedly approved a compliance plan in 2025 that, according to the company, ensures LGPD compliance on the platform. With that position, the company sought to narrow the retroactive scope of the sanction in relation to its recent compliance efforts.

The Star also reported that ByteDance was given 10 business days to appeal and must delete user records for people aged 13 to 18 whose parental authorization is not regularized within the deadline. Reuters and The Star agreed that the subsidiary must remove data collected irregularly and meet the deadlines set by the authority.

Why does the case matter beyond Brazil?

The LGPD has extraterritorial reach and applies to any company, including foreign firms, that offers goods or services to people in Brazil or processes the personal data of individuals in Brazilian territory, even without a physical presence or a CNPJ in the country, according to specialists cited in research material.

That reach makes the sanction relevant for Argentine companies operating in Brazil or processing data from Brazilian residents. Recent analyses of ANPD also say the authority has expanded its regulatory role and received powers to oversee content-moderation obligations for digital platforms, with the ability to impose fines of up to 10% of revenue in Brazil for systemic failures in that area.

What factors did the sanction take into account?

Valor International said the fine considered, among other factors, the company’s revenue in Brazil, a relevant criterion for assessing the financial and regulatory risk of platforms with local operations. Agência Brasil, for its part, described the case as a fine against ByteDance Brasil Tecnologia for violations related to children’s and teenagers’ profiles.

Folha added that the decision was published in the Diário Oficial da União and that the case was handled as an administrative enforcement proceeding. Reuters and The Star agreed that the subsidiary must remove the data collected irregularly and comply with the authority’s deadlines, while the company retains the option to appeal within the indicated term.