Brazil's ANPD reviews rules, fines ByteDance

Brazil’s data protection authority, the ANPD, has opened a public consultation to revise its Fiscalization Regulations and expand their scope beyond the LGPD. The proposal adds oversight powers tied to the Digital Statute for Children and Adolescents, internet user rights, and measures against digital violence targeting women. At the same time, the authority has already fined ByteDance R$153.7 million over failures to protect children’s and teens’ data on TikTok.

What changes with the regulatory review?

The proposal would broaden the ANPD’s enforcement reach to digital service providers and platforms across Brazil’s online ecosystem, not just data processing covered by the LGPD. It also contemplates fines of up to R$50 million and aims to expressly incorporate rules on incident reporting and investigation under CD/ANPD Resolution No. 15/2024 into the enforcement process.

The update to the Fiscalization Process Regulation and the Administrative Sanctions Process also keeps formal participation channels open. The public consultation will accept comments until October 26, 2026, and a virtual public hearing is scheduled for September 24, 2026, with oral participation registration open until September 18 and channels available through Brasil Participativo and the ANPD’s YouTube channel.

How does this connect to the ByteDance fine?

The sanction against ByteDance, notified on August 24, 2026 and applied on August 25, serves as the backdrop for the regulatory review. According to Data Privacy Brasil Research, the amount totals R$153.7 million and is specifically tied to insufficient protection of children’s and teens’ data on TikTok.

Araújo Policastro’s analysis explains that, in this case, the total fine was split into three installments applied together for violations of different LGPD provisions, which allowed the total to exceed the R$50 million cap set for each individual infraction. Tech Regulation BR adds that the decision ordered the deletion of unlawfully collected data and the implementation of a compliance plan to strengthen protections for minors.

What precedents did the TikTok case leave?

According to Neoteo’s international coverage, the ANPD attributed five LGPD violations to the case, which involved both TikTok’s unregistered feed and registered feed. The company had 10 business days to appeal before the competent authority.

Tech Regulation BR also said the sanction was presented as the largest fine imposed by the ANPD, and that the administrative enforcement process led to a monitoring phase that began in August 2026 on digital platforms, app stores, and generative AI tools to verify compliance with the Marco Civil da Internet and the ECA Digital.

In that same context, Tech Policy Press reported that the ANPD adopted an order requiring digital platforms with more than 1 million users under 18 to publish their first semiannual transparency report by mid-September 2026.