Brazil's ANPD fines TikTok R$153.7 million

Update September 5, 2026: The TikTok sanction was further detailed with a daily fine of about R$137,081.49 for each unmet obligation, including data deletion, report delivery and notice to third parties. The ANPD president also said the case is a warning for other apps and that the agency’s talks with companies now have limits.

Brazil’s ANPD fined ByteDance, TikTok’s parent company, R$153.7 million for irregular handling of children’s and adolescents’ data. At the same time, the agency has been tightening Brazil’s LGPD framework with new rules on security incidents, the encarregado, international transfers and administrative sanctions.

What did the ANPD decide in the TikTok case?

The agency imposed three fines on ByteDance Brasil totaling R$153.7 million, ordered the deletion within up to 60 business days of data from adolescents between 13 and 18 years old who lacked regularized legal representation or assistance, and required notice to third parties that had received that data. It also demanded a specific compliance plan and, once that deadline expires, a technical report within five business days with proof of compliance, audit logs and a signed statement from the encarregado.

According to the ANPD’s official notice, the case identified five LGPD violations tied to articles 6, items VIII and X, and 7, involving processing without a valid legal basis and a lack of adequate preventive measures. The Superintendência de Fiscalização also flagged irregular practices in both the feed sem cadastro and the feed com cadastro.

Agência Mestre reported that the three penalties were roughly R$63.1 million, R$63.1 million and R$27.4 million, based on violations related to processing without legal basis, failure to meet the prevention principle, and lack of accountability and reporting. O Globo added that the ANPD estimates TikTok processed data from at least 20% of Brazil’s children, although the real figure could be higher because of underreporting and traceability problems.

Despacho Decisório No. 27/2026, published in the Diário Oficial da União on August 25, 2026, also ordered the deletion of children’s and teens’ data collected irregularly and specific operational changes to how the app works in Brazil. Those include stricter default privacy settings for users under 16, parental supervision tools, and ad suspension for users who access the app without registering.

Agência Mestre said the enforcement action stemmed from Nota Técnica No. 50/2024, the administrative sanctioning process was opened in November 2024, and the decision was published in August 2026. It also said ByteDance will have 60 business days to regularize the legal representation of already registered accounts belonging to teens ages 13 to 18, or delete those accounts, and notify third parties that received that data so they can delete it as well.

The same outlet added that for TikTok’s feed sem cadastro in Brazil, the ANPD ordered the experience limited to a maximum of 12 hours, a complete ad ban, blocking of content creation, direct messages, live streams and personalized recommendations, and a reduction in data collection to language, region and basic device information.

Fronteira Livre said the sanctioning decision also sets a daily fine of about R$137,081.49 for each unmet obligation, whether that involves deleting data, submitting reports or notifying third parties that received information about the affected teens.

What is changing in the rest of the regulatory framework?

The ANPD is broadening and sharpening its regulatory toolkit with rules covering security incidents, international transfers, the encarregado and sanction sizing, along with a proposal to align the LGPD, ECA Digital and the Marco Civil da Internet.

Resolução CD/ANPD No. 15/2024 says that, when incident notification is required, it must be sent to the ANPD and affected data subjects within up to three business days from the moment the incident becomes known. The rule also allows the initial filing to be supplemented later and requires incident records, whether reported or not, to be kept for at least five years. Specialized sources note that this deadline differs from the GDPR’s standard of 72 consecutive hours.

For international transfers, Resolução CD/ANPD No. 19/2024 requires adequate protection, formally and materially equivalent to the LGPD, with safeguards against unauthorized third-party access or access compelled by foreign laws. After Brazil’s EU adequacy decision in January 2026, that standard effectively operates with parameters equivalent to European ones.

Resolução CD/ANPD No. 18/2024 also strengthens the obligation to publicly and clearly disclose the identity and contact information of the encarregado, preferably on the controller’s website. That framework was reinforced by the amendment to article 41 of the LGPD through Lei 15.352/2026, which now uses the word "Agência" instead of "Autoridade."

Where is the sanctioning power headed?

The review of Resolução CD/ANPD No. 4/2023 seeks to unify criteria for the LGPD, ECA Digital and the Marco Civil da Internet, with 19 provisions to be amended and an integrated framework for classifying violations, handling proceedings and setting penalties.

Parecer No. 00045/2026 from the ANPD’s Federal Special Prosecution Office found the proposal legally valid and cleared it to move forward to public consultation after review by the Conselho Diretor, but the changes are not yet in force. At the same time, 2026 analyses describe a strategy of enforcement at scale and a broader regulatory agenda for the digital environment.

That expansion is already visible in enforcement activity. According to a media review, the ANPD currently has at least 10 ongoing cases against seven big tech and digital platforms, including Meta, Google, Microsoft, Apple, WhatsApp, Telegram and X/Grok, with files tied to possible LGPD violations, child and adolescent protection, and the fight against illegal content. Eight are still pending and two have already been concluded.

The combination of resolutions, guidance and technical notes is turning the ANPD into a regulator with a more detailed compliance framework. In that setup, the TikTok case is the agency’s most visible decision so far, both because of the size of the penalty and because of how it tied prevention, accountability and formal proof of compliance together.

In comments cited by Poder360, the ANPD president said the TikTok sanction should be seen as a warning for other apps and that the authority’s dialogue with companies "has limits." He also said the guidance phase has now given way to a tougher enforcement stage in the face of repeat offenses and serious failures to protect children’s and adolescents’ data.

O Globo reported that the decision was published in the Diário Oficial da União on August 25 and that the platform was challenged for handling minors’ data without adequate legal backing, including in the no-registration experience. TecNois added that TikTok was not banned in Brazil, but that the ANPD closed an administrative case opened in 2021 in August 2026 and required 11 changes to the platform, including a full suspension of ads for users who access the feed without logging in.

That point has direct monetization implications, because the order affecting the no-registration feed limits content creation, direct messages, live streams, personalized recommendations and advertising. It also narrows data collection to language, region and device data, while authorities continue to compare those findings with other lines of oversight over content and targeted ads.