Brazil’s data protection authority has issued one of its most significant child-privacy enforcement actions to date, fining ByteDance, the parent company of TikTok, R$153.7 million over the unlawful processing of children’s and adolescents’ personal data. According to Brazil’s Autoridade Nacional de Proteção de Dados, or ANPD, the sanction was published Aug. 25 in the Diário Oficial da União and also includes an order to eliminate data collected irregularly. ByteDance also committed to a compliance plan aimed at correcting the identified issues and improving how TikTok handles the personal data of minors in Brazil.
The ANPD said the case centered on two ways users could access TikTok: the “feed without registration,” which allowed anyone to browse content without creating an account, and the “feed with registration,” which involved the creation and use of a TikTok account. In both settings, the authority found that TikTok processed the personal data of children and adolescents without a valid legal basis under Brazil’s Lei Geral de Proteção de Dados, better known as the LGPD.
According to the regulator, the sanction corresponds to five violations of the LGPD, specifically involving Articles 6 and 7. The ANPD said TikTok allowed children and adolescents to access the unregistered feed without a valid legal basis, failed to adopt adequate measures to prevent that data processing, processed children’s and adolescents’ personal data in the account-registration experience without a valid legal basis, failed to adopt effective measures to prevent those minors from registering on the platform, and failed to demonstrate effective measures capable of proving compliance with data protection rules across both experiences.
That last point is especially important. The ANPD said the company’s existing safeguards were not sufficient to prevent improper processing from the outset, and the agency’s technical area found that concrete evidence was lacking regarding the effectiveness of TikTok’s technical and organizational measures. In other words, the case was not only about whether TikTok had policies or controls on paper, but whether it could actually prove those controls were effective in practice for protecting minors’ data under the LGPD.
The compliance plan attached to the matter is just as important as the monetary penalty. The ANPD said ByteDance committed to applying the most restrictive privacy settings automatically to accounts belonging to users under 16, with any changes requiring authorization from parents or guardians. The company must also strengthen parental supervision features and implement stricter content filters to improve child and teen protections on the platform. For TikTok’s no-registration experience, the ANPD outlined even more specific safeguards. Under the plan described by the authority, TikTok must suspend ads in Brazil for the unregistered feed, limit the experience to age-appropriate content, and reduce the processing of personal data. The regulator said this version of the service will also be subject to a 12-hour experience limit, no ability to create content, comment, send direct messages or socially interact, no following functions, no live-stream posting or viewing, and only very limited personalization. The ANPD also said data collection should be reduced to minimal information such as language and region for content relevance, basic device information for fraud protection, and limited data for app performance improvement.
The case also intersects with Brazil’s evolving age-assurance expectations. The ANPD said that, in a separate decision published the same day, its Conselho Diretor approved ByteDance’s compliance plan on appeal, but with an important caveat: the company must comply with age-verification requirements established by the Estatuto Digital da Criança e do Adolescente, following the implementation schedule and related guidance issued by the authority. The regulator said these commitments help reduce previously identified risks to children and adolescents, including by fully suspending ads and disabling live-streaming and direct messages for TikTok users accessing the platform without registration.
TikTok still has procedural options. The ANPD said ByteDance may appeal the penalty to the agency’s Conselho Diretor within 10 business days from notification of the sanction. That means the enforcement story may continue to evolve, but the agency’s message is already clear: platforms serving children and adolescents in Brazil must be able to identify the legal basis for processing, implement effective protective measures, and demonstrate that those measures actually work.
This enforcement action is a major reminder that child-data compliance is becoming an operational issue, not just a policy issue. For companies operating under the LGPD, especially digital platforms with open-access experiences, guest-user flows, profiling capabilities, advertising systems, or youth-facing features, the ANPD’s action signals that regulators are looking closely at how minors gain access, what data is collected before or during that access, whether privacy settings default to the highest protections, and whether the company can prove accountability. The failure to show effective safeguards may be just as damaging as the underlying collection itself.
For privacy, legal and product teams, the bigger lesson is straightforward: if a platform may be used by children or adolescents, it is not enough to rely on generic privacy notices or broad platform rules. Organizations should be evaluating age-related access paths, legal bases for processing, parental controls, ad delivery, content personalization, account creation, default privacy settings, and audit evidence showing how those controls function in practice. That is particularly true where minors may access a service without full registration, because regulators may still view that experience as personal-data processing that requires an adequate legal basis and demonstrable safeguards under the LGPD.
At a broader level, the TikTok ruling shows how child privacy is becoming one of the clearest enforcement priorities in Brazil’s digital regulation landscape. The ANPD did not limit its response to a fine. It also required structural changes to privacy settings, parental supervision, ads, functionality, and data minimization. That combination of monetary penalty plus operational remediation is exactly the kind of outcome other platforms should be studying closely right now.