TikTok $27.4 Million Fine Signals New Era of Data Protection Enforcement in Brazil

Brazil’s move to fine TikTok’s parent, ByteDance, 153.7 million reais, about $27.4 million, is a warning to firms that run online, says digital-law specialist Filipe Ribeiro Duarte.

Duarte says the point is not only that companies claim they have data safeguards. Regulators will want proof that those safeguards actually work in real situations.

The matter started with Brazil’s National Data Protection Authority, ANPD. It centered on how TikTok handles data from children and teens.

The regulator said TikTok’s first age check was not enough. TikTok had used a user’s own claimed date of birth. The company said it closed around 7.75 million child accounts in Brazil from October 2022 through September 2023. The ANPD felt that number pointed to many kids getting through the first step. In their view, those users were able to watch and act on the app before the system caught them.

Duarte argued that age assurance should be handled with testing and follow up. He said checks need to be reviewed in light of the risks of the service. He added that the choice should not depend only on whether the method relies on self reported data or on newer tools. He said some platforms may have to use more than one layer. That can include verification, monitoring, and a clear response when issues show up.

The ruling also looked at TikTok’s feature called “feed without registration.” It lets people watch content without making an account. At the same time, details about video actions and device data could be used to tailor what the user sees.

Duarte said this outcome shows privacy risk checks should happen across the full user journey, not just during sign-up. He also said companies should treat features, screens, navigation steps, personalization tools, and ways users gain access as parts of their data protection plan.

The penalty was split into three parts. One part was 63.17 million reais. It covered the legal grounds used to handle the data. Another 63.17 million reais was tied to weak prevention. The last portion, 27.4 million reais, related to accountability and who is responsible.

Duarte said companies should look at the case in three ways. First, why they were permitted to process the data. Second, what controls they used to lower the risks. Third, how they can show those controls were put in place in practice.

The rules in Brazil are also being influenced by the Digital Child and Adolescent Statute, called ECA Digital. It is pushing more duties around age checks and safety steps for kids and teens when they go online. Duarte said that firms offering products or services that children and teenagers can reach should look again at what they do now. This includes their preventive steps, the legal grounds they rely on, and how they run their governance. He added that this is most important for tools that people can use without signing up.

“The ruling marks a clear shift in how enforcement works,” Duarte said. “The issue is not only whether a company has some control in place. It is also whether the control fits the risk, actually works day to day, and can be proven to do that.”

TikTok Fined $27 Million in Brazil Over Child Data Privacy Violations

Brazil’s data protection regulator has ordered ByteDance, the China based company behind TikTok, to pay 153.7 million reais, about $27 million, over rules tied to the handling of children’s and teens’ personal data.

The decision comes days after the ANPD banned Discord from live streaming, following the regulator's determination that there were risks to Brazilian children — including dangers such as incitement to self-harm and even suicide.

The National Data Protection Authority, ANPD, said ByteDance broke Brazil’s General Data Protection Law, known as the LGPD. It pointed to two user paths inside TikTok. One is the logged out feed, which shows content without making an account. The other is the experience for people who have already registered.

According to the ANPD, in each situation TikTok collected or used personal data from minors without a sufficient legal reason. The regulator also said the company did not put in place steps that could stop that kind of processing in a real way.

The ANPD listed five separate breaches. These included using minors’ data with no proper legal basis, not doing enough to reduce the chances that minors would access or sign up on the app, and not being able to prove that its privacy steps actually worked.

The regulator also told ByteDance to remove the data it gathered in the wrong way. ByteDance may contest the fine before the ANPD board. It has 10 business days from when it gets the notice to file.

In addition to the payment, ByteDance agreed to roll out a compliance plan. The goal is to improve how TikTok protects kids and teens.

The plan says that accounts for people under 16 will be set to the tightest privacy options right away. Those settings cannot be changed unless a parent gives approval. TikTok will also add stronger controls for parents and apply tighter content checks.

If someone uses TikTok in Brazil without creating an account, ByteDance will pause ads for that group. It will also keep the service limited to material meant for all ages. The company will collect and handle less personal data.

When you are signed out, the time window is capped at 12 hours. During that period, you cannot post new content. You also cannot leave comments, send private messages, or follow other users. You cannot be followed either. Live streams will not be available to you. Content suggestions will be reduced too.

In the signed out mode, the firm will collect only the data it says it needs. It will cite content matching, fraud checks, and how the app runs.

In a separate decision, the ANPD board approved ByteDance’s compliance plan on appeal. The board also required ByteDance to meet age checks set out under Brazil’s Digital Child and Adolescent Statute.

Rules are tightening in Brazil and other places as agencies look harder at how social media sites treat kids’ private information and safety online.

People have also raised concerns about TikTok as more teens and young adults use it. They point to how the app gathers data, how it runs ads tied to user behavior, and how its feed chooses content based on each person.

Brazil’s ANPD said the steps it agreed on with ByteDance are meant to lower the earlier risks it noted. It said this includes stopping ads and turning off live video and direct messages for anyone using TikTok without making an account.

Brazil’s ANPD Orders Discord to Stop Live Streaming Over Child Safety Risks

Brazil’s National Data Protection Authority (ANPD) said it has ordered the immediate stop of Discord’s live streaming option in the country, pointing to “robust evidence” that the platform did not sufficiently safeguard children and adolescents from serious dangers. Those dangers include things like incitement to self-harm, and even suicide.  

According to the G1, “Discord’s live streams were suspended in Brazil after the National Data Protection Authority (ANPD) found that the feature had been repeatedly used in cases involving violence, harassment, and the incitement of self-harm and suicide among children and adolescents.”

The death of a 13-year-old girl in June shocked Brazil and prompted investigations into Discord. She died by suicide after joining a virtual community on the platform that allegedly livestreamed abusive content and encouraged suicide. The impact was so significant that First Lady Janja Lula da Silva herself called for the social media platform to be deactivated.

The preventive move was announced today, and it basically gives the San Francisco-based communications service three business days to switch off its “Go Live” feature, or whatever they call it in practice. After that, the halt will stay active unless Discord can show concrete, effective actions that limit people’s exposure to harmful content and predatory contact happening inside its own private servers, at least in Brazil.

Regulatory Crackdown

The ANPD decision comes after they launched an investigation last week, while political pressure kept growing and there was a reported tragedy involving a 13-year-old girl who was allegedly pushed into suicide during a live broadcast on the platform. Brazil's First Lady, Janja Lula da Silva, said in public she wants a complete ban, on the app.  

"Discord is not being blocked entirely," said Fabrício Lopes, ANPD’s Superintendent of Oversight. "The preventive measure pauses the 'Go Live' function, that people use for streaming inside closed servers. The plan is to reduce the danger of serious or irreversible harm that children and adolescents are being put through."

Regulators said that Discord’s architecture kind of keeps the company from grabbing live video data in real time, so it becomes hard to see crimes right as they happen. Instead, the platform tends to use automated mechanisms and reports from users, but the ANPD judged that as not enough, or inadequate really.

Rising Scrutiny

The crackdown arrives while Discord is getting global heat about its safety protocols. In 2024, U.S. senators spoke directly to founder Jason Citron, regarding predatory groups on the platform. Russia and Turkey have already blocked, or limited the service, citing content moderation gaps and its refusal to share data with local officials.

In Brazil, the app’s second-largest market, complaints tied to Discord jumped 54% in the first seven months of 2026, versus the same span the year before, according to numbers from the NGO SaferNet Brazil.

Discord, which recently filed confidentially for an IPO in the U.S., said it has already spotted and deactivated the server tied to the recent tragedy. Still, Brazilian authorities are now discussing next steps, and they are mulling over fines that could reach as much as 50 million reais, about $9 million, plus even a complete suspension if the safety rules under the country’s Digital Child and Adolescent Statute aren’t complied with.