TikTok Fined R$153.7 Million in Brazil for Unlawfully Processing Data of Over 8 Million Minors

On August 25, 2026, Brazil's National Data Protection Authority (ANPD) imposed a substantial fine on TikTok's parent company, ByteDance, in the amount of R$153.7 million (approximately RMB 200 million), for unlawfully processing the personal data of children and adolescents without a valid legal basis, and for failing to effectively prevent minors from registering and using its platform.

The ANPD's investigation revealed that, during its operations in Brazil, TikTok processed the personal data of at least 8 million children, including information on adolescents aged 13 to 18. This data was used for commercial purposes such as targeted advertising, and the platform collected and processed such data without proper legal authorization. At the same time, TikTok's age verification system exhibited significant vulnerabilities, failing to effectively prevent minors from bypassing restrictions to register and browse content.

The investigation also examined TikTok's "browse without login" feature, which allowed users to view content without creating an account. This led to children and adolescents using the platform in the absence of effective age verification, while TikTok continued to collect browsing data from these users. The ANPD considered that the very design of this feature constituted a neglect of未成年人 data protection, and that platforms must integrate child protection as a core consideration in product design, rather than circumventing legal obligations under the guise of functional convenience.

The ANPD found that TikTok had committed five violations of Brazil's General Data Protection Law (Lei Geral de Proteção de Dados – LGPD), and the total fine was calculated based on ByteDance's revenue in Brazil. Specifically, the R$153.7 million penalty consists primarily of two separate fines of R$63.1 million each and one fine of R$27.4 million. Should ByteDance waive its right to appeal and pay the fine within the stipulated deadline, it may receive a 25% discount, reducing the actual payment to R$115.3 million. In addition, if TikTok fails to comply with corrective measures such as data deletion, it will face daily overdue fines of R$137,000.

Beyond the monetary penalty, the ANPD imposed a series of mandatory corrective measures on TikTok. TikTok must delete all personal data unlawfully collected from adolescents aged 13 to 18. For users without registered accounts, the platform must fully suspend advertising, disable live streaming and direct messaging, restrict content to all-age-appropriate material, and limit daily usage time to 12 hours. For users under 16, the platform must automatically enable the strictest privacy settings, and any changes to privacy levels will require parental authorisation.

The penalty comes at a critical time as Brazil strengthens its online protection for minors. The ANPD is currently reviewing 22 digital platforms for compliance with the new Digital Protection Law for Children and Adolescents, which imposes stricter requirements on how internet platforms handle minors' data. Meanwhile, TikTok faces mounting regulatory pressure globally, and has recently agreed to pay $400 million to settle a U.S. Department of Justice lawsuit concerning children's privacy.