Brazil fines TikTok record US$30 million for profiting from children’s data

BEIJING, 26 AUGUST 2026 —

Brazil Slaps TikTok with Record US$30 Million Fine Over Children’s Data Handling

The ANPD found five breaches of Brazil’s data protection law, including processing personal data without a legal basis and failing to prevent harm to minors. ByteDance has 10 working days to appeal the decision, with a 20-day window to pay a reduced fine if it waives its right to contest the ruling.

Failure to comply with directives—such as erasing records of users aged 13 to 18 without verified parental consent within 60 working days—could result in daily fines exceeding US$26,000.

The investigation, which began in March 2021 after a federal lawmaker raised concerns over a Vice Italy report, revealed systemic failures in TikTok’s age verification and data collection practices. According to a 25-page technical note, users in Brazil could access personalized feeds immediately upon downloading the app without declaring their age or agreeing to terms of service.

Investigators replicated the process abroad and found that while Brazil allowed logged-out feeds, the United States and Europe restricted access to registered users only.

TikTok maintained that its terms of service set a minimum age of 13, asserting that children under that threshold were not authorized users and received no personalized content. However, the ANPD noted that between October 2022 and September 2023, TikTok removed 7.75 million children’s accounts in Brazil—762,493 in July 2023 alone.

The agency estimated that this amounted to roughly one in five Brazilian children under 13 having their data processed by the platform in a single year.

The ANPD criticized TikTok’s age gate mechanism as “cheap, easy to implement and simple to circumvent.” The system, which required users to input a date of birth, relied on third-party tools like Yoti only when users attempted to alter their birthdate or appeal a ban—after data had already been collected. ByteDance argued that teenagers clicking through terms of service constituted a valid contract, implying parental consent.

The ANPD rejected this, citing Brazil’s civil code, which denies minors under 16 the capacity to enter contracts without guardianship.

Investigators also accused ByteDance of providing “untrue information” about default registration methods, noting that users typically stick with preset options. When questioned about the fate of data from banned children shared with advertising partners, TikTok stated such data would not be shared commercially—a response the ANPD dismissed as a “semantic maneuver” that prolonged the investigation and harmed societal interests.

The fine is structured into three penalties: two US$12.27 million charges for processing data without legal basis and failing to prevent harm, plus US$5.32 million for non-compliance with transparency requirements. ByteDance has until early September to decide whether to appeal or accept the reduced penalty.

Global Regulatory Scrutiny Intensifies The ANPD’s ruling follows a wave of penalties against TikTok by other regulators. In April 2026, the U.S. Justice Department secured a US$400 million settlement over allegations that TikTok collected data from under-13s without parental consent—the largest recovery under the Children’s Online Privacy Protection Act (COPPA).

Ireland’s Data Protection Commission fined TikTok €530 million (US$619 million) in May 2025 for illegally transferring European user data to China, a penalty upheld by the Irish High Court in June.

The European Commission has also opened four investigations under the Digital Services Act (DSA), including allegations of addictive design features such as infinite scroll and autoplay, as well as inadequate protections for minors’ accounts. In July 2026, the commission found that TikTok’s settings allowed strangers—including non-users—to view minors’ content.

Britain’s Ofcom is separately probing whether TikTok’s age estimation models comply with the Online Safety Act, while Australia banned under-16s from 10 platforms, including TikTok, in December 2025, leading to the removal of 4.7 million accounts.

Diplomatic Tensions Escalate The fine comes amid heightened diplomatic friction between Brazil and China. In May 2025, during a state dinner in Beijing hosted by Chinese President Xi Jinping for Brazilian President Luiz Inácio Lula da Silva, Lula raised concerns about digital platform regulation and invited China to send an envoy to discuss the matter.

First Lady Rosângela da Silva, known as Janja, then criticized TikTok for exposing children to harmful content, breaking diplomatic protocol and unsettling Chinese officials. The exchange, later leaked, prompted Lula to blame his team for disclosing private discussions. Janja reiterated her stance at a subsequent government event, declaring, “There is no protocol that will make me stay silent.”

TikTok responded by writing to Brazil’s foreign ministry, acknowledging awareness of the concerns raised.

Malaysia and Southeast Asia Watch While the ANPD’s penalty does not directly affect Malaysia, regional regulators are closely monitoring global enforcement trends. Malaysia’s Personal Data Protection Commissioner (PDPC) has previously issued fines for data breaches, including a RM500,000 (US$107,000) penalty against a telecoms company in 2023. Industry observers suggest that Malaysia may adopt a more stringent approach to child data protection, particularly as social media platforms face growing scrutiny over their handling of minors.

TikTok’s operations in Malaysia remain active, with the platform reporting over 20 million monthly active users as of 2025. The company has emphasized its commitment to safety features, including age verification tools and restricted modes for younger users. However, the ANPD’s ruling underscores the challenges platforms face in balancing user experience with regulatory compliance.

Industry and Advocacy Reactions Privacy advocates welcomed the ANPD’s decision. “This fine sends a strong signal that companies cannot prioritize engagement over children’s safety,” said a spokesperson for Brazil’s Instituto Alana, a child rights organization. “The failure to implement age verification is inexcusable.”

ByteDance has not responded to requests for comment since the ruling was issued. The company’s next steps—whether to appeal or comply—will likely influence future regulatory actions in Latin America and beyond.

Outlook: Compliance and Consequences The ANPD’s decision marks a turning point in global enforcement against tech platforms over child data protection. With Brazil setting a precedent for high penalties, other jurisdictions may follow suit, particularly in regions where data protection laws are still evolving.

For TikTok, the immediate challenge is to overhaul its age verification and data handling systems to meet regulatory expectations. Failure to do so could result in further fines, operational restrictions, or even bans in key markets. As the company navigates these pressures, the broader question remains: Can social media platforms reconcile their business models with the imperative to protect children’s data? The answer will shape the future of digital regulation worldwide.

Related: Beijing