Brazil Fines TikTok Over Minors' Data

Update September 1, 2026: the ANPD said ByteDance must notify third parties that received teen data, submit a technical report signed by the DPO and audit logs, and faces a daily fine of R$137,081.49 if it fails to comply. Reuters also reported that the penalty could be cut by 25% if the company gives up its appeal and pays within the deadline.

Brazil's National Data Protection Authority, the ANPD, fined ByteDance, TikTok's parent company, R$153.7 million for LGPD violations tied to the handling of children and adolescents' data. The ruling also orders the deletion of personal data collected irregularly and requires a specific compliance plan to strengthen protections for minors on the platform.

What did the ANPD find on TikTok?

The ANPD found violations in two access modes, the feed without registration and the feed with registration, and said both involved the handling of children's and teenagers' personal data without a proper legal basis under the LGPD. The official order cites five violations of articles 6, sections VIII and X, and 7 of the law.

According to the authority's text, TikTok may have processed data from at least 8 million children in Brazil during the investigation period, a figure MLex compared with about 20% of the country's child population in a year. Coverage also described the age-verification failures as systemic, especially in the no-registration feed, which makes it easier to use the platform without age barriers.

Later compliance analysis said the total sanction amounts to R$153,769,671.33 and was calculated using the company's revenue in Brazil, within LGPD limits that allow fines of up to 2% of local revenue, capped at R$50 million per violation. Another reading of the decision said the local operation processed data from users ages 13 to 18 without a valid legal basis.

What obligations did the ruling impose?

The ruling requires deleting the personal data of registered teens if, within 60 business days, no legal representation arrangements are documented, such as parents, guardians or another form of legal assistance. It also orders notice to all third parties that received those data, along with a technical report signed by the DPO and audit records proving compliance.

The order set a daily fine of R$137,081.49 for any failure to meet those requirements. Reuters also reported that the ANPD would cut 25% from the total if ByteDance gives up its appeal within 10 business days and pays within 20 business days, which would bring the penalty to about R$115.3 million.

Civil society groups said the case reinforces the idea of privacy by design for minors under the LGPD. European and Brazilian outlets added that the ANPD pointed to the lack of an adequate legal basis in both the account-based mode and the no-registration feed.

Why does the case go beyond Brazil?

The sanction was described by TechTimes as the largest enforcement action in Latin America focused on children's data to date, and by international coverage as the highest fine imposed by the ANPD since it was created in 2020. Valor International and France24 also said the move sends a signal to the rest of the platforms.

A wire report carried by U.S. media said the ANPD considered that ByteDance and TikTok's processing of data from teens ages 13 to 18 was also used to deliver targeted advertising. That reading makes the violation more serious under international child protection standards.

The Brazilian agency has started proceedings to check whether 22 social networks and platforms comply with the new Brazilian online protection law for children and adolescents. Metrópoles also reported that the ANPD has at least 10 open proceedings against other big tech firms and platforms, including Meta, Google, Microsoft, Apple, WhatsApp, Telegram and X, as well as TikTok and Discord.

How does this intersect with regulatory pressure in the United States?

A few days before the fine in Brazil, TikTok and ByteDance reached an agreement worth about US$400 million with the U.S. Department of Justice to resolve child privacy allegations. Reuters reported that the deal includes an immediate US$300 million payment and another US$100 million tranche contingent on the annulment of a 2019 consent decree with the FTC tied to Musical.ly.

ABC News said the agreement ranks among the largest child privacy cases in the United States. Specialized outlets added that it includes data-governance and product-design obligations, with tighter limits on personalized advertising, age verification and parental controls. Spanish-language coverage noted that the parallel action in Brazil and the United States raises regulatory exposure for platforms with significant operations in that market.