Brazil’s National Data Protection Authority (ANPD) has imposed a $29.7 million fine on ByteDance, TikTok’s parent company, for failing to adequately protect the personal data of children and adolescents using the platform. The penalties also come with mandatory measures to strengthen safeguards for minors, marking the first major sanction against a big tech company under Brazil’s data protection framework.
What Happened
On a date following an investigation that began in 2021, the ANPD formally sanctioned ByteDance for violating Brazil’s General Data Protection Law (LGPD) by improperly collecting personal data from an estimated 8 million Brazilian children despite TikTok’s public claim that its service is not suitable for those under 13 years old. Although Brazil’s new child protection statute, ECA Digital, took effect in March 2026, the case covers conduct from before this legislation’s enactment.
The investigation found TikTok’s platform allowed access by children under 13, collected extensive personal data, and used that information for targeted advertising, which Brazilian law prohibits. TikTok acknowledged that between October 2022 and September 2023, the ANPD removed approximately 7.75 million accounts belonging to children. The agency estimated that about 20% of Brazilian children had their data collected improperly through the app.
In addition to the total R$153 million fine (approximately $29.7 million), the ANPD ordered TikTok to implement several requirements including deleting personal data of adolescents aged 13 to 18, expanding parental supervision tools, restricting access for users under 16 or those without an account, and suspending advertising to unregistered accounts.
Key Facts
The enforcement arose from a complaint triggered by a 2021 Vice Italy report that revealed TikTok gathering vast amounts of user data even without account registration, demonstrated through a data request under Europe’s GDPR. ANPD’s sanction is the regulator’s first major fine against a big tech company for LGPD violations.
Besides imposing financial penalties, the ANPD’s role has expanded under recent social media regulations in Brazil, including the Lula government’s decrees and ECA Digital, granting the agency authority to impose operational restrictions like suspending TikTok livestreams earlier in 2026.
TikTok has 10 days to appeal the ANPD’s decision. The company stated the fine concerned an earlier period and does not reflect subsequent compliance efforts presented to the ANPD in 2025. The fine coincided with a separate $400 million U.S. Department of Justice settlement for similar child privacy violations.
What This Means
This landmark fine illustrates Brazil’s growing assertiveness in enforcing digital privacy laws, especially concerning vulnerable users like children. By requiring TikTok to delete minor users’ data and enhance parental controls, the ANPD is setting a precedent that social media platforms must actively prevent underage data collection and stop targeted advertising to minors.
The case emphasizes the challenge platforms face in balancing open access with legal obligations to shield younger users from risks such as exposure to unsuitable content and privacy violations. For Brazilian users, it promises a safer digital environment, particularly for children’s online experiences. Globally, it signals that emerging digital rights regulators like the ANPD will hold powerful technology firms accountable and demand tangible changes, not just voluntary assurances.
Background
The ANPD is Brazil’s authority tasked with enforcing the LGPD since its 2020 enactment, overseeing data privacy compliance across sectors. The agency also implements the new ECA Digital law, which imposes stronger protections for children and adolescents online and was introduced in March 2026. This is the ANPD’s first major sanction against a large social media company, following complaints and prior investigative reporting revealing systemic data collection issues.
What Comes Next
Following its announcement, ByteDance has a 10-day window to appeal the fine and implementation orders. The ANPD’s regulatory actions demonstrate a readiness to leverage expanded powers granted by recent legislation and may encourage similar enforcement against other platforms. Ongoing monitoring and further rulemaking related to children’s data protections may follow as the agency enforces ECA Digital stricter.
Sources
This article is based on reporting and publicly available information from the following sources:
Read more Digital Policy stories on Goka World News.