Brazil's National Data Protection Authority (ANPD) has fined ByteDance, the owner of TikTok, 153.7 million reais (roughly $28 million) for violations in how the platform handled data belonging to children and teenagers, according to G1. The ruling, issued Tuesday, is the first fine of this scale against a social media company in Brazil.
The ANPD found that TikTok processed minors' data in violation of Brazil's General Data Protection Law (LGPD, the country's equivalent of Europe's GDPR) and failed to adopt sufficient safeguards to prevent it. Investigators identified problems both among users who accessed the app without an account, who can still watch videos without logging in, and among registered accounts opened by minors. The violations cited include unlawfully collecting data from non-logged-in minors, failing to block underage account registrations, and not proving compliance with data protection rules.
The agency rejected TikTok's defense that data collection was justified under the legal basis of "contract performance," which applies when users accept a platform's Terms of Service. According to the ANPD, minors would need parental representation or consent for such a contract to be valid, something that did not happen in the cases reviewed. The agency stated: "The mechanisms adopted by the company were not sufficient to prevent, from the outset, the improper processing of personal data belonging to children and adolescents."
How the fine was calculated
The penalty was based on ByteDance's gross revenue in Brazil in 2025, excluding taxes; the exact revenue figure was not disclosed due to tax secrecy rules. The ANPD rejected mitigating factors requested by the company, which argued it had maintained a compliance plan since 2025. The agency said reducing the fine would have required proof that the plan's measures were already in effect.
Asked by G1, TikTok said child and teen safety is "an absolute priority" for the platform and that it maintains a "transparent and collaborative" dialogue with the ANPD. The company said the ruling "refers to an earlier period (2021) and does not reflect the actions envisioned" in the compliance plan approved by the agency in 2025, nor the measures "voluntarily implemented since then." ByteDance can appeal within 10 business days or pay the fine within 20 business days, with a 25% discount if it drops the appeal and pays on time.
Beyond the fine, the ANPD ordered TikTok to delete the improperly collected data and submit a strengthened compliance plan. For users under 16, the platform must apply the most restrictive settings, changeable only with parental authorization, and reinforce parental supervision tools. For the non-logged-in experience, TikTok must cap usage at 12 hours, block video posting, comments and messaging, prevent users from following or being followed, ban livestreaming, and limit data collection to the minimum necessary. The agency said it is already monitoring other platforms in the sector to mitigate risks to minors online.