Brazil’s National Data Protection Authority (ANPD) fined ByteDance approximately US$29.8 million (153.7 million Brazilian reais) for illegally processing the personal data of minors on its TikTok platform, the agency announced on August 25, 2026 [1, 2, 3]. The fine was imposed for violations of Brazil’s General Data Protection Law (LGPD) related to data collected primarily from children and teenagers aged 13 to 18 without a legal basis or parental consent [4, 2, 5].
The ANPD found that TikTok processed data of at least 8 million minors in Brazil, a figure that underscores the scale of the breach [2, 5]. Key violations included allowing minors access to personalized TikTok feeds without effective age verification, notably through the "logged-out feed" feature available only in Brazil. This feature lets users browse TikTok content without registering or providing age information, unlike in the US or Europe where only registered users can access the platform [4, 2, 5]. ANPD Director Lorena Giuberti Coutinho said, "The logged-out feed feature allows Brazilian children and teens to use TikTok widely without effective age verification, raising serious protective concerns" [5].
ByteDance must delete data collected from underage users without parental authorization within 60 working days or face daily fines of about US$26,000 (137,000 reais) [4, 5]. The company also must submit reports confirming these deletions to ANPD regularly [4]. Beyond deletion, ByteDance is required to implement a stricter compliance plan such as enhanced age verification, default privacy settings for users under 16, parental controls, content filters, and limits on ads, livestreaming, and messaging for unregistered users [1, 3].
TikTok noted the wrongdoing primarily pertains to practices from 2021 and claimed it does not reflect measures enacted in 2025 and after. The company said, "The fine relates mainly to 2021 behavior and does not reflect the compliance plan approved in 2025 and subsequent protective measures. We continue to engage with regulators" [6].
Brazil has stepped up digital protections for minors, including a Digital Child and Adolescent Statute law enacted in March 2026 requiring tighter controls on harmful content exposure [1, 5]. The government also recently ordered Discord to suspend livestreams that risked harming children [2, 5].
ByteDance has 10 working days from August 25 to appeal the ANPD’s decision [4, 1]. If the company fails to delete the unauthorized data within the mandated 60 working days, it will face daily fines until compliance is met [4].
