Understanding Brazil’s $29.7 Million TikTok Fine Over Children’s Data

Tatiana Dias is a fellow at Tech Policy Press.

For the first time, a major big tech company has been fined in Brazil for misuse of personal data. Brazil's National Data Protection Authority (ANPD) imposed a $29.7 million sanction on ByteDance, TikTok's parent company, for failing to protect children and adolescents.

Although ECA Digital, Brazil's new child and adolescent protection law, has been in effect since March 2026, the case predates it, stemming from a proceeding that began in 2021. The ANPD investigated allegations that, despite TikTok stating the platform was unsuitable for users under 13, the company failed to prevent their access and improperly collected data from 8 million Brazilian children.

The fine in Brazil also came in the same week that the Department of Justice (DOJ) reached a $400 million settlement with TikTok for violating federal child privacy protection laws in the US. As in Brazil, the investigation concluded that TikTok and ByteDance, its China-based parent company, violated the law by allowing the collection of data from children under 13.

The suit, filed under the Biden administration's DOJ in 2024, accused TikTok of allowing children to create regular accounts to share videos and messages with adults and others on the platform, and of collecting and retaining emails and other personal information.

In Brazil, the original complaint to the ANPD was based on a 2021 report by Vice Italy that showed that TikTok was collecting a massive volume of user data even without any account registration. Using a data request filed under Europe's GDPR, the reporter got 381,264 data units recording his short-lived experience on the app.

"What I found in their data shocked me: not only my watched video history was there but also all the clicks I did within the app,” the reporter Riccardo Coluccini told Tech Policy Press. “It was possible to recreate the way I interacted with the app and also given the IP addresses it was possible to check when I was watching videos away from home.” Coluccini said he had no idea his investigation ended up in a complaint for a data protection authority in another country.

In Brazil, TikTok itself acknowledged ANPD removing roughly 7.75 million child accounts between October 2022 and September 2023. Based on Brazilian demographic data, the agency calculated that about 20% of Brazilian children had their data improperly collected by the platform.

"This creates serious risks — the content children can access, the contacts they can have — for an environment that wasn't designed for that audience," said Lorena Giuberti Coutinho, director of ANPD. According to the investigation, TikTok used the data to serve targeted advertising, which is prohibited, and the company failed to demonstrate that its use of the information complied with the law.

Besides paying three separate fines totaling R$153 million (approximately $29.7 million at current exchange rates), calculated based on its revenue, TikTok and implement a series of measures:

• Delete personal data of adolescents aged 13 to 18
• Restrict access for users under 16
• Expand parental supervision tools
• Restrict access for users without an account
• Advertising was suspended for accounts without registration

According to ANPD’s director, some of these changes go beyond the agency’s request. “The regulatory action led to concrete changes in the design of the service. It is these changes that will bring real changes in the experience of children and adolescents in the digital environment and reduce the risks to which they were previously exposed,” she noted.

ByteDance now has 10 days to appeal. In a statement to the press, TikTok said the safety of children and adolescents is "an absolute priority" and that the company presented a compliance plan to the ANPD in 2025. "The decision imposing the fine refers to an earlier period (2021) and does not reflect the actions outlined in that plan, nor the measures voluntarily implemented since then.”

“The fines imposed by the ANPD are certainly significant and, although linked to a system that TikTok apparently claims it no longer uses, they show how the ANPD is one of the few data protection authorities willing to take on the big social media platforms to ensure that people’s rights are respected,” Coluccini says.

This is the first time the ANPD has sanctioned a big tech company for violating LGPD, Brazil's data protection law. Created as a data protection regulator, the ANPD has also become responsible for implementing the new social media regulation decrees introduced by the Lula government this year, as well as the ECA Digital. In this expanded role, the ANPD ordered the suspension of livestreaming on the platform in August.

Now, the case marks a new milestone in the consolidation of the ANPD's role within Brazil's regulatory ecosystem. In recent months, the agency has accumulated new powers — and it now signals its intent to use this expanded arsenal more assertively, at a moment when Brazil is trying to balance the protection of children and adolescents online with platforms' long-standing resistance to any form of accountability.