Brazil has imposed one of its biggest digital-privacy penalties yet: a 153.8 million-real fine—about $29.8 million—against TikTok owner ByteDance over alleged failures involving children’s and teenagers’ personal data.
The decision, announced Tuesday, August 25, 2026, goes beyond a financial penalty. Brazil’s National Data Protection Authority, known as ANPD, also ordered ByteDance to delete certain affected data and strengthen the safeguards TikTok uses to identify and protect younger users.
What Brazil’s regulator found
According to Reuters, ANPD said ByteDance’s Brazilian operation processed personal data belonging to teenagers ages 13 to 18 without a valid legal basis. The regulator estimated that TikTok may have processed data connected to at least 8 million children during the period it examined.
The Associated Press reported that the alleged violations involved both registered accounts and guest browsing sessions. Regulators said the platform collected or processed young users’ information without sufficient legal justification or safeguards.
A central concern was TikTok’s “logged-out feed,” which lets people watch videos without creating an account. ANPD said that setup made it easier for children and teenagers in Brazil to use the service without effective age checks. Reuters reported that the regulator said this guest-access feature is available in Brazil but not in the United States or Europe, where users must register.
The order is bigger than the fine
The 153.8 million-real penalty is the headline number, but the required corrective steps may have a longer-lasting effect.
ByteDance must delete the personal data of teenage users when the necessary parental, guardian or other legal arrangements are not properly documented within 60 business days, according to Reuters. The company must also meet reporting and notification requirements. Failure to comply could bring daily penalties of 137,081.49 reais.
AP reported that ByteDance has 10 days to appeal the ruling. The company may also receive a 25% reduction in the fine if it gives up its appeal and pays promptly, Reuters said.
What TikTok says
TikTok said the case concerns conduct dating to 2021 and does not account for a compliance plan approved by ANPD in 2025 or additional protections introduced since then. The company said its current measures comply with Brazilian data-protection rules for both logged-in and logged-out users and that it is evaluating possible legal action.
That response means the penalty may not be the final word. An appeal could test the regulator’s findings, the size of the fine and the scope of the deletion order.
Why this decision matters beyond Brazil
The action lands as governments worldwide place tougher demands on social-media platforms to verify ages, reduce data collection and apply stricter default privacy settings for minors.
Brazil’s Digital Child and Adolescent Statute took effect in March. ANPD Director Lorena Giuberti Coutinho said the agency is separately monitoring TikTok’s compliance with that law. The regulator also opened proceedings covering 22 digital platforms and social networks to examine their protections for young users.
For families and technology companies, the case turns an abstract privacy debate into a concrete question: what data should a platform be allowed to collect before it knows whether the person watching is an adult?
Brazil’s answer, at least for now, is that weak age checks and guest access do not excuse a platform from protecting young users—and that the consequences can include both a multimillion-dollar fine and an order to erase improperly handled data.
