Brazil’s National Data Protection Authority, or ANPD, fined TikTok’s parent company ByteDance R$153.7 million on August 25, 2026, after finding five violations of Brazil’s General Data Protection Law (LGPD) involving minors’ personal data. The case covered both registered TikTok accounts and the platform’s feed for people browsing without an account—and the regulator approved a compliance plan that turns the penalty into concrete product restrictions.
Brazil’s ANPD imposed a R$153.7 million sanction
The ANPD said ByteDance processed children’s and adolescents’ data without an appropriate legal basis, failed to prevent minors from registering for or using the platform, and could not demonstrate that its technical and organizational safeguards were effective.
The five violations involve Articles 6 and 7 of the LGPD, Brazil’s data-protection law. In practical terms, the case is not just about what TikTok collects. It is also about whether the platform can identify and protect younger users—and show that its protections actually work.
That distinction matters. A privacy setting buried in a menu is one thing; a default that starts restrictive and requires a parent’s authorization to change is another. Brazil’s response pushes toward the second model.
Why the case included TikTok’s logged-out feed
No, the sanction does not concern only people with TikTok accounts. The investigation examined two ways to use the platform: the standard registered-account experience and the feed available without registration.
That logged-out route is easy to overlook because it looks like casual browsing: open TikTok, watch videos and leave. But the ANPD’s findings treated it as part of the same data-protection problem. Minors could access the service without creating an account, while the regulator said ByteDance lacked a valid legal basis for processing minors’ data in both access modes.
The broader lesson is straightforward: removing the login screen does not remove the platform’s responsibility to address age, privacy and data collection. “No account” is not the same as “no data implications.”
What the compliance plan changes in Brazil
The ANPD-approved plan sets stricter defaults for accounts belonging to users under 16. Those accounts must receive the most restrictive privacy settings automatically, and changing those settings requires parental authorization. The plan also includes stronger parental supervision and content-filtering measures.
The logged-out experience faces a separate set of limits in Brazil:
- Sessions are limited to 12 hours.
- Advertising is suspended for unregistered users.
- Personalization and data collection are substantially reduced.
- Users cannot post, comment, send direct messages, follow accounts or watch live broadcasts without registration.
- Data collection is limited mainly to language, region, basic device information used for fraud prevention and information needed to operate the app.
These are more than legal abstractions. They change what a person can do without an account and reduce the amount of information the platform can use in that mode. The plan’s significance is that it connects child-safety enforcement to interface defaults and ordinary product behavior.
What the numbers do—and do not—prove
Several figures define the case, but they do not all carry the same meaning.
The confirmed sanction is R$153.7 million, imposed against ByteDance. The ANPD identified five LGPD violations, and ByteDance had 10 business days from its notification on August 24, 2026, to appeal to the agency’s Board of Directors.
An estimate tied to the case puts the number of potentially affected minors at at least 8 million. That is not a confirmed count of individually identified children or teenagers. It indicates the possible scale of the data-processing issue, not a precise victim list.
Keeping those distinctions intact matters. A fine amount is a regulatory decision; the 8-million figure is an estimate; the 12-hour limit is a compliance-plan condition. Treating all three as interchangeable facts would make the story sound cleaner—but less accurate.
What happens next
The sanction gives ByteDance a 10-business-day appeal window beginning with its August 24 notification. The ANPD also ordered data deletion and approved the compliance plan.
For users in Brazil, younger users are supposed to start with tighter privacy settings, while unregistered browsing is designed to become shorter, less personalized and far less interactive.
That is the important shift behind this case. Brazil is not treating child-data protection as a policy statement that lives only in a privacy notice. It is tying the obligation to defaults, access rules and the basic mechanics of the app.
