Brazil's National Data Protection Authority (ANPD) has imposed a fine of 153.8 million reais (approximately $29.8 million) on ByteDance, the owner of TikTok, for processing personal data of teenagers aged 13 to 18 without proper legal authorization.
- ANPD fined ByteDance 153.8 million reais for illegal data processing of teens
- TikTok's logged-out feed heavily used by minors with weak age verification
- ByteDance must delete minors' data within 60 days or face daily fines
What happened
Brazil's data protection regulator, ANPD, fined ByteDance 153.8 million reais ($29.8 million) due to violations of its General Data Protection Law. The breach involved processing personal data of teenagers aged between 13 and 18 without a valid legal basis. The regulator's investigation revealed that TikTok may have handled data of over 8 million minors during the review period.
ANPD highlighted specific concerns about TikTok’s 'logged-out feed,' a feature available in Brazil that allows users to access content without logging in, effectively bypassing age verification. This feature is not available in other markets like the U.S. and Europe. In addition to the fine, ByteDance was ordered to delete the personal data of minors if adequate parental or legal authorization is not obtained within 60 days.
Why it matters
This enforcement action reflects a growing worldwide trend of regulators ramping up scrutiny over companies’ handling of children's data on social media platforms. Countries such as Australia, France, and China have introduced or proposed tighter rules to protect children from data misuse and harmful online content exposure. ANPD's move coincides with its broader mandate to enforce Brazil's Digital Child and Adolescent Statute, which took effect in March 2026.
The ruling emphasizes the importance of robust age-verification systems for tech companies operating in Brazil. Since TikTok’s feature enabling usage without logging in undermines these protections, the case could shape future regulatory standards and enforcement across the region. It also signals to other platforms the increasing regulatory risks related to minors' data privacy and content safety.
What to watch next
ByteDance has committed to compliance and has already implemented measures following an approved plan in 2025. The company stated the fine pertains to conduct prior to these improvements and plans to engage with ANPD regarding potential legal steps. Close attention will be paid to whether ByteDance meets the data deletion deadline and other compliance requirements to avoid accruing daily fines.
Meanwhile, ANPD is expanding its oversight, having opened monitoring procedures for 22 social media and digital platforms to ensure adherence to the new child protection law. Stakeholders should monitor regulatory developments and enforcement trends in Brazil and other markets to prepare for evolving compliance demands aimed at safeguarding children's digital rights.