On August 25, 2026, the Brazilian National Data Protection Authority (“ANPD”) imposed a BRL 153.7 million fine on ByteDance Brasil Tecnologia Ltda., the controller of the TikTok platform, in connection with irregularities in the processing of children’s and adolescents’ personal data. In addition to the fine, the decision required the adoption of measures aimed at strengthening privacy and data protection on the platform.
Among the irregularities identified, the ANPD highlighted the processing of children’s and adolescents’ personal data without an appropriate legal basis and the insufficiency of the mechanisms adopted to prevent such processing, both in connection with access to the platform without registration and with the creation of accounts.
More than the amount of the fine itself, the decision draws attention to the importance attributed to the effectiveness of compliance measures. The ANPD assessed not only the existence of mechanisms intended to protect children and adolescents, but also their practical effectiveness in preventing unlawful processing.
In this regard, the decision reinforces that the mere existence of policies, procedures and controls is not, in itself, sufficient to ensure compliance. Organizations must be able to demonstrate that the measures adopted are appropriate to the risks identified and are effective in practice.
This is particularly relevant in light of the recent entry into force of Law No. 15,211/2025, known as the “Digital Statute for Children and Adolescents” (“ECA Digital”), which established new obligations relating to the protection of children and adolescents in the digital environment.
In this context, age assurance mechanisms, parental controls, privacy settings, advertising and content personalization require even greater attention, particularly from providers of digital products and services, such as social media platforms, online games, applications and e-commerce websites.
The adoption and ongoing monitoring of these measures should therefore form part of product and service governance, particularly when they are directed to or likely to be accessed by children and adolescents.
For further information or clarification, Salusse, Marangoni, Parente e Jabur Advogados’ Privacy and Data Protection team is available at privacidade@smabr.com or at +55 (11) 3146-2400.
