Why Brazil fined TikTok $30 million over children’s data protection failures
São Paulo, Brazil – Brazil has fined TikTok owner ByteDance R$153.7 million ($29.8 million) for improperly processing the personal data of children and teenagers, the first financial penalty imposed on a social media company by the country’s data protection authority.
The National Data Protection Authority, known by its Portuguese acronym ANPD, said TikTok failed to prevent minors from having their data processed without a valid legal basis and lacked sufficient safeguards to stop children and teenagers from accessing parts of the platform.
The regulator estimates that the personal data of at least 8 million minors may have been processed because of inadequate age verification mechanisms.
The news came the same week that Tik Tok’s competitor, Meta, which owns Facebook and Instagram, agreed to a $17 billion settlement in a US court for child safety allegations.
The penalty, announced on August 25, comes as Brazilian authorities are taking a closer look at how some of the world’s largest technology companies protect their young users. Days before announcing the TikTok fine, the ANPD opened monitoring proceedings involving 22 digital services, including social networks, artificial intelligence platforms and app stores.
The TikTok investigation focused on two ways people can use the platform in Brazil.
- One involves registered users with accounts.
- The other, known as the “logged-out feed,” allows people to watch videos without creating an account.
The ANPD identified violations of Brazil’s data protection law in both forms of access.
“The mechanisms adopted by the company were not sufficient to prevent, from the outset, the improper processing of personal data belonging to children and adolescents,” the ANPD said, citing the findings of its enforcement division.
According to the regulator, TikTok committed five violations of Brazil’s General Data Protection Law (LGPD), including processing minors’ data without an adequate legal basis and failing to demonstrate that its safeguards were effective.
The platform’s response
TikTok argued during the proceedings that processing some of the information was permitted because users accepted its terms of service, creating a contractual relationship. The ANPD rejected that reasoning in the cases involving minors, finding that children and teenagers would need parental representation or assistance for such a contract to be valid.
The regulator also found that TikTok had not done enough to prevent minors from registering for accounts or to prevent their data from being processed when they accessed the platform without one.
TikTok said that the penalty relates to conduct from 2021 and does not reflect changes the company has made since then. “The decision imposing the fine refers to an earlier period (2021) and does not reflect the actions provided for in this plan or the measures voluntarily implemented since then, which ensure compliance with the LGPD in both the logged-in and logged-out experiences.” The statement was provided to Brazilian news outlet G1.
The company said the safety of children and teenagers is an “absolute priority” and that it has maintained a “transparent and collaborative” dialogue with the regulator. “We will continue engaging with the ANPD while we assess the appropriate measures,” the company said.
ByteDance can appeal the decision. The company has 10 business days from notification to file an appeal and 20 business days to pay the fine. It can receive a 25% reduction if it gives up its right to appeal and pays within the required period.
The size of the penalty was calculated using ByteDance’s gross revenue in Brazil in 2025, excluding taxes. The company’s revenue figures were not disclosed because they are protected by tax confidentiality. The ANPD also ordered ByteDance to delete data collected in violation of the law.
A different TikTok for users without accounts
The ANPD also ordered changes to how TikTok handles younger users in Brazil. ByteDance must implement a compliance plan that changes how TikTok operates for children and teenagers in Brazil, particularly for people who access the service without creating an account.
For registered users under 16, TikTok will have to automatically apply its most restrictive privacy settings. Those settings can only be changed with authorization from a parent or guardian. The platform must also strengthen parental supervision tools and introduce stricter content filters.
Users accessing the platform without an account will be limited to 12 hours of use. They will not be allowed to publish videos, comment, send direct messages or use other social features. They will also be unable to follow accounts, gain followers, post livestreams or watch them.
Now, TikTok must stop showing advertisements entirely to logged-out users in Brazil and restrict the feed to content considered appropriate for all ages. Personalization will also be sharply limited.
The platform will still be able to process a narrower set of information, including language and regional data used to select relevant content, basic device information used for fraud prevention, and data needed for the application to function properly.
TikTok’s logged-out feed allows people to browse videos without providing an age during account registration. According to Reuters, the feature is not available in the United States or Europe. Brazilian regulators had already challenged the feature before imposing this week’s fine. In 2024, the ANPD ordered the suspension of the logged-out feed as part of its investigation into whether TikTok was adequately protecting children and teenagers.
ByteDance later presented a compliance plan to the regulator. The ANPD’s board approved it, while requiring the company to comply with new age verification obligations under Brazil’s Digital Statute for Children and Adolescents. The company positioned itself and said that the plan had been presented to and approved by the ANPD in 2025 and said measures implemented since then ensure that both its registered and logged-out services comply with Brazilian data protection law.
According to the ANPD, ByteDance sought a reduction based partly on its compliance plan, but the agency concluded that a reduction required evidence that the measures had actually been implemented.
Brazil increases scrutiny of online platforms
TikTok is one of several digital platforms currently under scrutiny by Brazilian regulators. Earlier in August, the ANPD ordered Discord to suspend livestreaming in Brazil as a preventive measure after identifying failures in safeguards intended to prevent serious violations involving children and teenagers.
Unlike the TikTok case, the Discord action was not a financial penalty. The platform was ordered to suspend livestreams and similar video-sharing features until it could demonstrate that it had adopted effective measures to protect minors.
On August 21, four days before announcing the TikTok fine, the ANPD began two monitoring actions covering 22 digital services. The regulator is examining whether companies are complying with rules intended to protect children, teenagers and women online.
ByteDance has 10 business days from notification to appeal the R$153.7 million fine. If it waives its right to appeal and pays within the required period, the company can receive a 25% reduction.
Featured image credit: ANPD Brazil.