Brazil’s National Data Protection Authority, known as ANPD, fined TikTok parent company ByteDance R$153.7 million on August 25, 2026. The regulator found five violations of Brazil’s General Data Protection Law, or LGPD, involving minors’ personal data across both registered accounts and TikTok’s feed without registration.
The decision matters because it goes beyond a conventional penalty. ANPD also approved a compliance plan that puts safety and privacy controls directly into the product experience: stricter defaults for users under 16, parental authorization for changes, reduced data collection and sharp limits on logged-out browsing in Brazil.
The case reached TikTok’s logged-out feed
No, the sanction does not concern only people with TikTok accounts. ANPD examined two access modes: the standard experience for registered users and the feed available to people browsing without registration.
According to ANPD, ByteDance processed minors’ data without an appropriate legal basis in both modes. The regulator also found that TikTok did not adequately prevent children and adolescents from registering or using the service, and could not demonstrate that its technical and organizational safeguards were effective.
That distinction is important. A logged-out feed can look like a low-commitment way to watch a few clips, but it is still a product environment that may involve personalization, device information and other data handling. In this case, Brazil’s regulator treated that access path as part of the platform’s responsibility—not as a loophole outside the account system.
The confirmed controls TikTok must apply
The compliance plan approved by ANPD requires TikTok to make the following changes in Brazil:
- Accounts belonging to users under 16 must receive the most restrictive privacy settings by default.
- Changing those settings requires parental authorization.
- The under-16 experience must include stronger parental supervision and content filtering.
- The unregistered experience is limited to 12 hours.
- Unregistered users cannot post, comment, send direct messages, follow accounts or watch live broadcasts.
- Advertising is suspended for unregistered users.
- Personalization and data collection are substantially reduced. The remaining collection is mainly tied to language, region, basic device information used for fraud prevention and information needed to operate the app.
This is the practical shift behind the fine: the regulator is not merely saying “protect minors better.” It is requiring product-level defaults and restrictions that reduce what an unregistered user can do and what data the service can collect in that mode.
What the numbers do—and do not—prove
The confirmed sanction consists of five violations involving Articles 6 and 7 of the LGPD. ByteDance was notified on August 24, 2026, and ANPD says the company could appeal to the agency’s Board of Directors within 10 business days of that notification.
Separate reporting describes an ANPD estimate that data from at least 8 million minors may have been processed. That figure is a potential exposure estimate, not a confirmed count of individually identified children or teenagers. It should not be read as a tally of proven victims.
The official penalty is R$153.7 million. Other currency conversions are less useful here because exchange rates vary and the sanction itself was imposed in Brazilian reais.
Why the logged-out experience matters
Age assurance—methods used to determine or estimate whether a user is old enough to access a service—is difficult to implement without creating additional privacy concerns. But the ANPD findings show why regulators are scrutinizing more than the sign-up screen.
If minors can reach a platform through an account-free route, checking age only during registration will not address the whole product. Brazil’s response therefore links age protections with defaults, parental controls, data minimization and feature restrictions. That combination is more demanding than adding a warning or asking users to confirm a birth date.
What happens next
The sanction gives ByteDance an appeal route and sets out a compliance plan, but the supplied decision details do not establish the company’s current appeal status or the current state of implementation. The confirmed takeaway is narrower—and more useful: ANPD has imposed a major penalty over past conduct and approved concrete controls intended to change how TikTok handles minors’ access and data in Brazil.
For users and parents, the most consequential provisions are not the headline figure. They are the defaults and restrictions: under-16 accounts must start with the strongest privacy settings, while unregistered browsing loses advertising and several social features. Brazil is treating privacy for younger users as a design requirement, not merely a policy promise.
