Brazil Fines ByteDance BRL 154 Million and Imposes New Minor Protection Rules
Nashnova编辑部
Brazil's data-protection authority fined TikTok 153.7 million reais (≈$29.8 million) for processing minors' data without a valid legal basis; ByteDance has 60 business days to delete the data or face daily compounding penalties.
Why was TikTok fined — what exactly went wrong?
Brazil's National Data Protection Authority (ANPD) ruled that ByteDance processed minors' personal data without a valid legal basis under the country's General Data Protection Law.
The violations span two scenarios: registered users during normal app use and unregistered users simply browsing content — in both cases, no effective safeguard was in place.
This means → the issue is not *what* sensitive data was collected, but that there was no lawful ground to collect it at all, and the technical protections fell short.
How does the fine work — is there room for a discount?
The total penalty is 153.7 million reais (≈$29.8 million), published in Brazil's official gazette on August 25, 2026.
ByteDance must delete all minors' data collected without parental consent within 60 business days, notify third parties that received the data, then submit a signed technical report and audit logs within 5 more business days.
Miss the deadline → a daily fine of 137,081.49 reais kicks in. But if ByteDance waives its appeal within 10 business days and pays within 20, the total drops by 25%.
In plain terms = pay fast and save a quarter, or drag it out and watch the bill grow daily — a carrot and a very visible stick.
What changes for users who never registered an account?
TikTok must impose extra restrictions on unregistered users: suspend ad delivery, disable livestreaming and direct messages, sharply reduce data collection, and cap session duration.
This means → regulators concluded that even without sign-up, the platform was harvesting substantial data — so they cut functionality at the source.
What do the new minor-protection rules require?
The ANPD separately approved a compliance plan ByteDance submitted, benchmarked to Brazil's Digital Children and Adolescents Regulation.
Accounts belonging to users under 16 must default to the strictest privacy settings; any change requires parental authorization.
The platform must also tighten content moderation and introduce stricter content-filtering mechanisms.
Is this a one-off case or part of a broader trend?
Earlier this month the ANPD ordered chat platform Discord to suspend its livestreaming feature after a teenager's death.
President Luiz Inácio Lula da Silva has separately pushed legislation requiring companies and digital platforms to limit minors' exposure to illegal or potentially harmful content.
This reflects a systematic tightening of online minor-protection regulation in Brazil — TikTok is simply the latest and largest case by fine amount.
As of publication, ByteDance's Brazil operation has not commented; whether it meets the compliance deadlines will determine the final penalty it actually pays.
Content is for reference only, not financial advice.