Brazil's data protection authority, the ANPD, fined ByteDance 153.7 million reais over the handling of children's and teenagers' data on TikTok. The decision was published in the official gazette on August 25. Converted at the time, that is roughly 30 million dollars.1,2
The fine is the part that travels. The part that changes a teenager's phone is the compliance plan attached to it, which tells the company how the product must behave rather than only what it must pay.1,3
The proceeding is older than the law most people would expect it to rest on. Brazil's ECA Digital, the child protection statute, has been in force since March 2026, but this case began in 2021 and was decided under the general data protection law.1,3
What the regulator found
The ANPD identified five violations under articles 6 and 7 of the LGPD, Brazil's general data protection law. They divide into two situations that ordinary users experience quite differently: the feed available without logging in, and registered accounts.1
For the no-login feed, the authority found processing of minors' data without a legal basis and a failure to prevent that processing from happening. For registration, it found the same absence of legal basis and a failure to prevent minors from registering at all. The fifth violation is a failure to demonstrate that its compliance measures actually worked.1
Euronews reports the proceeding covered the data of at least eight million teenagers. The ANPD also ordered the deletion of data collected unlawfully, which is a materially different remedy from a fine and considerably harder to perform.1,2
The order that changes the product
The compliance plan is where the decision does its real work. Accounts belonging to users under 16 must have the most restrictive privacy settings applied automatically, and those settings may only be changed with a guardian's authorisation. The company must strengthen parental supervision systems and tighten content filters.1
For access without an account, the requirements are stricter still. The ANPD's plan calls for suspending advertising in that mode, limiting it to age-appropriate content, reducing data collection, capping access at twelve hours, and disabling live streams and direct messaging.1
That list is worth reading twice, because it describes a version of the app that a regulator considers acceptable for someone whose age is unknown. It is a rare public statement of what these products would look like if the default assumption were caution.1,3
Why the no-login feed is the interesting part
Most debate about children and social platforms concentrates on age verification at sign-up. The ANPD went after the state before sign-up, where a person is watching an algorithmic feed while the service knows nothing about them except what it is collecting.1,3
This is the mode a curious eleven-year-old actually uses, on a borrowed phone, without an account. Treating it as a regulated surface rather than a shop window is the genuinely novel move in the decision, and it is the part other regulators are most likely to copy.1,3
It also explains the twelve-hour cap, which otherwise looks arbitrary. A feed you can watch indefinitely without identifying yourself is a product. A feed that stops after twelve hours is a sample.1
What a parent outside Brazil can take from it
None of these requirements apply outside Brazil, and pretending otherwise would be useless. What is portable is the checklist. The ANPD has effectively published a specification for a cautious teenage account, and every item on it corresponds to a setting that already exists in the app in most countries.1,3
Restrictive privacy defaults, working parental supervision, tighter content filtering and no direct messaging for the youngest users are all things a guardian can set manually today. The regulator's contribution is not a new capability. It is a considered answer to the question of which settings matter, written by people who spent five years examining the product.1
The no-login finding has a household version too. A child watching an algorithmic feed without an account is not in a safer mode because nobody logged in. That is the mode with the fewest controls attached to it, and it is usually the one nobody in the family has thought about.1,3
What this does and does not settle
ByteDance had ten business days from notification, issued on August 24, to appeal. Until that runs its course the decision is not final, and reporting a fine as though the money has moved is a common error worth avoiding.1
The measures apply to Brazil. They do not change defaults for a teenager in another country, and there is no mechanism here that makes them travel. What travels is the argument: a regulator has now written down, in an enforceable document, what restrictive by default means for an account belonging to someone under 16.1,3
Read alongside the same month's settlement between Meta and 47 United States attorneys general, the direction is consistent even though the instruments are not. One is a negotiated agreement subject to court approval, the other an administrative sanction under appeal. Both end with hours, defaults and parental authorisation rather than with warnings about screen time.1,2,3
Sources and method
Figures, violation counts and compliance measures come from the ANPD's own announcement, published in the Diario Oficial da Uniao on August 25. Dollar and euro equivalents vary between outlets because they were converted on different days; we use the real figure and note the approximate conversion. ByteDance had ten business days from notification to appeal, so the decision may not be final. The count of at least 8 million teenagers is reported by Euronews from the proceeding.
- ANPD multa TikTok em R$ 153,7 milhoes por falhas na protecao de dados de criancas e adolescentes Autoridade Nacional de Protecao de Dados · August 25, 2026 · primary
- Brazil fines TikTok owner over misuse of children's and teenagers' data Euronews · August 25, 2026 · independent
- Understanding Brazil's 29.7 million dollar TikTok fine over children's data Tech Policy Press · August 26, 2026 · independent