Brazil's ANPD Fines ByteDance

Update September 1, 2026: ANPD adjusted the fine to 153.8 million reais and clarified that the challenged practices covered two access modes in TikTok, with five specific LGPD violations. It also made clear that ByteDance can appeal within 10 business days, and that the deletion order covers users ages 13 to 18 without parental representation or regularized authorization.

Brazil’s National Data Protection Authority fined ByteDance, TikTok’s owner, 153.8 million reais for alleged violations of Brazil’s LGPD in the handling of minors’ data. The ruling, published in the Official Gazette and cited by Reuters, also orders the deletion of data from users ages 13 to 18 whose parental representation or authorization has not been regularized, and requires notification of third parties that received that information.

What did ANPD decide?

ANPD imposed a financial penalty and corrective measures tied to the handling of children’s and adolescents’ data on TikTok. Reuters reported the fine was set at 153.8 million reais and said the order includes deleting personal data when ByteDance cannot prove the relevant legal basis.

Agência Brasil reported that the ruling required the deletion of data obtained irregularly. In the same vein, Noticias Argentinas published coverage from Buenos Aires on the improper handling of minors’ data on TikTok, citing Euronews and Brazil’s official news agency.

What access modes did the regulator review?

ANPD said ByteDance’s practices did not comply with the LGPD in two TikTok access modes, the feed without registration and the feed linked to an active profile. Plataforma Media detailed that distinction and tied it to the administrative review of minors’ data processing.

MLex reported that the authority identified two categories of irregularities, described as "feed without registration" and "feed with registration," following a complaint over alleged noncompliance with the 2021 General Data Protection Law. Al Jazeera reported that the regulator said TikTok violated privacy laws both on logged-in accounts and in guest browsing sessions, and that the offline feed allowed minors to use the service while bypassing age-verification controls.

What violations did ANPD identify?

ANPD identified five specific LGPD violations by ByteDance and TikTok, linked to Articles 6, subsections VIII and X, and 7. According to specialized analysis and summaries of the administrative ruling, those violations relate to the principles of security, accountability and responsibility, as well as the legal basis for processing the data.

Specialized analysis highlighted that ANPD explicitly applied the LGPD principles of security, accountability and responsibility, saying TikTok did not adopt sufficient and proactive measures to prevent underage access before data processing began. Tech Policy Press added that ANPD may have warned TikTok could have collected data from 8 million Brazilian children.

How is the fine structured?

The penalty is broken into three main fines, according to financial reports that cite the text of the decision published in the Official Gazette. Two are roughly 63.18 million reais each, for violations of Articles 7 and 6, subsection VIII, of the LGPD, and the third is about 27.42 million reais for violating Article 6, subsection X.

PPC Land said the total in simple fines recommended by ANPD was 153,769,671.33 reais and that the decision was signed on August 24, 2026. Reuters, in its Spanish-language coverage, also reported the fine was 153.8 million reais.

What additional obligations did the order set?

The ruling also imposes compliance, notification and reporting duties to third parties, and includes a daily penalty regime if ByteDance does not comply. Reuters reported that the sanction included a daily fine of 137,081.49 reais for failure to meet those obligations, while Agência Brasil reported a daily amount of 137,000 reais.

Beyond the financial penalty, ANPD ordered ByteDance to delete data from users ages 13 to 18 whose parental representation or authorization has not been regularized within 60 business days, and to instruct all third parties that received that data to do the same, then report back with system logs signed by its DPO. PPC Land said ByteDance has 60 business days from notification to regularize legal representation or supervision of adolescent users registered before the required deletion takes effect.

What happens with the appeal?

ByteDance has 10 business days to appeal the decision before ANPD’s Conselho Diretor. Regional coverage emphasized that the deadline confirms the sanction can still be reviewed administratively.

CADE’s report also said the penalty notification was sent on August 24, 2026, and that the agency found the company had not taken sufficient measures to stop the irregular processing. According to that update, ByteDance must implement a compliance program to protect users under 18 in Brazil.

What did ByteDance say?

TikTok and ByteDance responded publicly by saying the safety of minors is an "absolute priority" and arguing that the ruling refers to an earlier period, 2021, which would not reflect the compliance plan submitted to ANPD in 2025. The company signaled a defense centered on improvements already implemented.

MLex and the CADE update agreed that the measure goes beyond the fine and requires the company to adopt internal controls to prevent the processing of minors’ data without a legal basis. Specialized coverage also said ANPD concluded that ByteDance had not taken sufficient measures to stop that irregular processing.