ANPD Fines TikTok R$153.7 Million in Brazil

Brazil’s National Data Protection Authority, ANPD, fined ByteDance Brasil, which operates TikTok in the country, a total of R$153.7 million for irregularities in the processing of personal data belonging to children and adolescents. The decision also orders the deletion of data processed in violation of the LGPD and requires a specific compliance plan to strengthen protections for minors on the platform.

What did the ANPD find in TikTok?

The ANPD’s inspection superintendency identified practices that were incompatible with the LGPD in both the no-signup feed and the signed-in feed, as they related to the processing of data from children and adolescents. According to Technical Note No. 50/2024/CGF/ANPD, there were also serious failures in age-verification mechanisms, which allowed large-scale use of the platform by children under 13, even without registration.

Decision No. 27/2026/CGS/SFI, published in the Diário Oficial da União, says the authority imposed three simple fines on ByteDance Brasil. The document says the violations reached Article 7 of the LGPD, which covers lawful bases for processing personal data, and Article 6, item VIII, which sets out the prevention principle.

How was the penalty broken down?

The ANPD split the sanction into three simple fines, for a total of R$153.7 million, according to the decision published in the Diário Oficial da União. Exame reported that one of them amounts to R$63,176,686.67 for violating Article 7 of the LGPD, tied to the use of an invalid legal basis for registering minors.

Exame also said the company can get a 25% discount if it waives the appeal and pays within 20 business days, which would reduce the total to R$115,327,253.49. That same report added that the ANPD ordered the deletion, within up to 60 business days, of personal data belonging to adolescents ages 13 to 18 whose legal guardians have not regularized representation or assistance on the platform.

What else did the regulator require?

Beyond the fine and the deletion of irregularly processed data, the ANPD required ByteDance, or TikTok, to implement a specific compliance plan to improve the protection of children and adolescents, with future remediation measures under the regulator’s supervision. G1 placed the sanction within a broader enforcement pattern in which the authority imposes fines and orders data deletion when it identifies systematic LGPD violations.

Metropoles added that the ANPD technical note found serious age-verification failures and that this was treated as an aggravating factor in the penalty calculation. HDPO, meanwhile, said the authority observed a technical architecture that makes it harder to detect violations in real time, as well as a lack of reasonable prevention and mitigation measures for children and adolescents.

How does this case fit into the ANPD’s recent agenda?

The TikTok fine came just days after the ANPD launched two supervision actions targeting 22 digital services, including social networks, AI platforms and app stores. That thematic enforcement effort requires companies to report the measures they have adopted or are developing to comply with new protection rules focused especially on children, adolescents and women online.

Correio do Povo said the monitoring was formalized under Process No. 00261.005031/2026-23 and includes, among others, Discord, TikTok, Facebook, Instagram, Telegram, WhatsApp, X and YouTube. UOL Tilt said the focus is on criminal or unlawful content that could affect minors and women, while Cescon Barrieu and the Ministry of Human Rights linked the agenda to the Digital ECA, which requires semiannual reports in Portuguese from providers with more than 1 million registered minor users in Brazil.

According to Cescon Barrieu, that first Semestral Transparency Report must be published by Sept. 17, 2026. The Ministry of Human Rights said those reports must include data on complaints, content removal, parental control tools and other protection measures, in a framework that supplements LGPD obligations.

JusDocs also noted that the LGPD sets a cap of R$50 million per infringement for simple fines and that, in this case, the ANPD added multiple violations to reach the total penalty. That same analysis said that, after Resolution CD/ANPD No. 15/2024, incidents with the potential to cause relevant risk or harm must be reported within three business days, and incident records must be kept for at least five years, points the authority can require in audits or inspections.