News summary. This article summarizes the ANPD decision sanctioning ByteDance for failures in the protection of children's and teenagers' data, based on the publication by gov.br.

Brazil's National Data Protection Authority (Agência Nacional de Proteção de Dados, ANPD) imposed a fine of R$153.7 million on ByteDance, TikTok's parent company, for five violations of Brazil's General Data Protection Law (LGPD) in the processing of children's and teenagers' personal data. The sanction was published in the Official Gazette of the Union on August 25, 2026, and includes the deletion of the unlawfully collected data. The penalty may be appealed to the ANPD Board of Directors within ten business days from notification; therefore, the decision is not presented as final.

The investigation examined two ways of accessing TikTok in Brazil: the feed without registration, available without creating an account, and the registered feed, linked to a registered profile. According to the ANPD, irregularities in the processing of this audience's data were identified in both experiences, including access to content without registration, account creation, and the absence of effective measures to prevent or stop children and teenagers from registering.

The reason for the decision was the finding that personal data had been processed without an adequate legal basis, in violation of Article 6, items VIII and X, and Article 7 of the LGPD. The technical area also found that the mechanisms adopted by the company had not demonstrated sufficient effectiveness to prevent improper processing from the outset or to demonstrate the operations' compliance. The sanction concerns past conduct and the period analyzed in the proceeding.

In addition to the fine, ByteDance undertook to implement a compliance plan approved by the ANPD Board of Directors on appeal, with a caveat regarding the age verification required by the Digital Statute for Children and Adolescents (Estatuto Digital da Criança e do Adolescente), in accordance with the Agency's schedule and guidance. The plan provides for more restrictive privacy settings for accounts belonging to users under 16, parental supervision, and stricter content filters. For the feed without registration, it includes suspending advertisements in Brazil, limiting the experience to 12 hours, blocking content creation, comments, direct messages, livestreams, and social interactions, providing access to content suitable for all ages, and reducing data collection and processing.

With information from gov.br.

This post was summarized from the original publication using artificial intelligence, with human review by Guilherme Goulart.