Brazil fines TikTok owner ByteDance 153.7 million reais over minor data violations

Regulatory ruling and penalty

Brazil's National Data Protection Authority (ANPD) fined TikTok parent company ByteDance 153.7 million reais (approximately $29.8 million) on 25 August 2026. The decision, published in the country's official gazette, concluded an administrative inquiry lasting nearly two years into the platform's handling of children's and teenagers' personal data. Investigators identified five distinct infractions under Articles 6 and 7 of Brazil's General Data Protection Law (LGPD). The regulator established that ByteDance collected and processed the information of young users aged 13 to 18 without securing a valid legal basis or providing adequate safeguards. Under the terms of the administrative ruling, ByteDance can lower the total penalty by 25% to 115.3 million reais if it agrees to waive its appeal rights within 10 business days and completes payment within 20 business days.

Scope of guest and registered violations

The administrative ruling targeted two distinct ways users interact with the video-sharing platform across Brazil. The investigation found systemic compliance failures across registered user profiles as well as the unregistered guest feed, which allows video browsing without creating an account. In both operational modes, ANPD determined that ByteDance failed to prevent unauthorized access and processed minor data from the initial point of contact. The authority noted that initial inquiries began in 2024 after discovering that children could access the application without passing age-verification mechanisms. In an official communication detailing the enforcement measure, the regulatory body clarified the legal foundation of the fine.

The sanction applied corresponds to past conduct and data processing carried out without a valid legal basis during the analyzed period.

ANPD President Waldemar Gonçalves Ortunho Júnior and enforcement superintendent Fabrício Guimarães Madruga Lopes confirmed during a press conference that the agency took action because ByteDance lacked concrete evidence demonstrating technical compliance.

Mandatory remedies and daily fines

Beyond financial penalties, the regulator ordered ByteDance to implement structural technical changes and purge illicitly gathered records. ByteDance Brasil must delete all personal data belonging to users aged 13 to 18 whose legal representation remains unregularized within 60 business days, while notifying any third parties that received that information. Within five business days following the expiration of that period, the company must submit a compliance report signed by its data protection officer alongside technical system audit logs. Failure to execute the deletions or submit verification records will trigger ongoing daily fines of 137,081.49 reais. For registered accounts belonging to users under 16, TikTok must automatically apply the most restrictive privacy settings, requiring explicit parental authorization for any modifications, alongside enhanced parental supervision tools and stricter content filters.

Guest mode restrictions and wider scrutiny

The enforcement decision imposes sweeping operational limits on TikTok's logged-out browsing mode throughout Brazil. ByteDance must suspend all advertising in the unregistered feed, disable live streaming features and user posting, limit algorithmic recommendations strictly to all-ages content, and cap guest viewing sessions at 12 hours. The agency chose not to block or suspend the platform entirely, focusing instead on data governance and architecture adjustments. The ruling follows earlier regulatory action in Brazil, where ANPD ordered chat service Discord to suspend livestreaming features in August 2026 over child safety concerns.