Brazil’s ANPD fines TikTok R$153.7 million, starting with the feed nobody logs into

What happened

Brazil’s data protection authority, the Agência Nacional de Proteção de Dados (ANPD), has fined ByteDance Brasil Tecnologia Ltda, the controller of TikTok in Brazil, R$153,769,671.33 (about US$29.8 million) for processing children’s and adolescents’ personal data without a valid legal basis. The first-instance decision, Despacho Decisório nº 27/2026/CGS/SFI, was signed by ANPD’s Superintendent of Inspection on 24 August 2026, notified to the company the same day, and published in the Diário Oficial da União on 25 August 2026. It is the largest fine ANPD has imposed to date. For scale, the agency’s first LGPD fine, in 2023, was R$14,400.

The total is made up of five infractions across three provisions of the LGPD: R$63,176,686.67 under Article 7 (no valid legal basis), R$63,176,686.67 under Article 6, VIII (the prevention principle) and R$27,416,297.99 under Article 6, X (accountability).

Two ways in, the same defect

The case began with ANPD’s Technical Note nº 50/2024/CGF/ANPD, which examined two ways of using TikTok: the feed available to anyone without creating an account (the “feed sem cadastro”) and the feed tied to a registered profile. ANPD found the same core problem in both.

In the logged-out feed, TikTok processed children’s and adolescents’ personal data without a valid legal basis and failed to adopt measures to prevent that processing. At registration, it processed minors’ data to create accounts without a valid legal basis, which the decision ties to the absence of a valid contract, and failed to take effective measures to stop minors signing up. Across both, it could not demonstrate that its safeguards actually worked. ANPD’s summary is blunt: the mechanisms in place were not enough to prevent unlawful processing of minors’ data “from the origin”.

On scale, ANPD’s investigation report records that TikTok itself removed more than 7.75 million child accounts in Brazil between October 2022 and September 2023. That figure is the basis for the “about 8 million children” widely cited in coverage.

Why the logged-out feed is the part to notice

A common posture treats age checks and legal basis as a sign-up problem: solve it at registration, and whatever happens before is out of scope. ANPD rejected that. A visitor with no account is still a data subject, and a feed that profiles them is still processing. If there is no legal basis and no safeguard on that path, the absence of a login screen is not a defence. It is the gap.

The principle is the same one that governs cookie and tracker consent: the basis has to exist at the moment the processing happens, not after. A consent banner that renders after the analytics script has already fired does not cure the write that already happened. ANPD applied that logic to an entire product surface rather than a single tracker.

What TikTok’s logged-out feed now has to look like makes the point concrete. Under a compliance plan ByteDance committed to, which ANPD’s Board of Directors approved in a separate decision published the same day, the logged-out experience in Brazil carries no advertising at all, shows only content suitable for all ages, offers very limited personalisation, is capped at 12 hours, and disables posting, comments, direct messages, following and live streams. Data collection is cut to language and region, basic device information for fraud protection, and app performance data. For registered users under 16, the most restrictive privacy settings apply by default and can only be changed with a parent or guardian’s authorisation, alongside stronger parental supervision and content filters. The Board also required TikTok to meet the age-verification obligations of Brazil’s Digital Statute of Children and Adolescents (ECA Digital) on ANPD’s implementation schedule.

The deletion order

Beyond the fine, ANPD ordered deletion of the personal data of registered adolescents aged 13 to 18 whose legal representation or assistance is not regularised within 60 business days. ByteDance must pass that obligation on to every third party it shared the data with, then file a technical report backed by system logs and signed by its Data Protection Officer. ANPD set a daily fine of R$137,081.49 for non-compliance and reserved the right to require an independent external audit.

Appeal and what comes next

The decision gave ByteDance 10 business days to appeal to ANPD’s Board of Directors. Alternatively, it could waive the appeal and pay within 20 business days for a 25 percent reduction, bringing the fine to R$115,327,253.49. We have not seen a public update from ANPD on which route the company took.

In its public response, TikTok said the safety of minors is “an absolute priority”, that the fine refers to an earlier period dating to 2021, and that it does not reflect the compliance plan presented to ANPD or measures the company has introduced since.

The India read-across

India’s DPDPA points the same way. Section 9 of the Digital Personal Data Protection Act, 2023 requires verifiable consent of a parent before processing a child’s personal data, and prohibits tracking, behavioural monitoring and targeted advertising directed at children. Rule 10 of the DPDP Rules, 2025 sets out how that consent is to be verified. These obligations take effect in May 2027, and building verifiable parental consent into an existing product typically takes six to twelve months, which puts the start of that work now. Under the DPDPA, as in Brazil, a surface that tracks visitors before anyone signs in does not sit outside the children’s data rules simply because no account exists.

The practical question

List every surface a visitor reaches before authenticating: a preview feed, a public storefront, a guest checkout, a marketing site running analytics and ad pixels. For each, ask what is collected, on what legal basis, and what stops it when the visitor may be a child. If the honest answer is “nothing happens until they sign up”, check that the scripts on that page agree.

Sources

• ANPD press release, 25 August 2026 gov.br
• Despacho Decisório nº 27/2026/CGS/SFI (sanction decision) gov.br
• Technical Note nº 50/2024/CGF/ANPD gov.br
• ANPD Board of Directors vote approving the compliance plan (CD 22/2026) gov.br
• Conjur, “O recado de R$ 153 milhões da ANPD ao mercado”, 16 September 2026 conjur.com.br
• TechPolicy.Press, “Understanding Brazil’s $29.7 Million TikTok Fine Over Children’s Data” techpolicy.press