Story perspectives

Brazil fines ByteDance 153.7 million reais over TikTok data

8/26/2026

Center

ByteDance Fined

Brazil’s National Data Protection Authority fined TikTok parent ByteDance 153.7 million reais (about $29.8 million) on August 25, 2026.
The compliance plan caps unregistered users at 12 hours daily and eliminates advertising for them.
Daily fines exceed US$26,000 for each day of non-compliance.
ByteDance can cut the penalty by 25 % if it waives its right to appeal.
Deletion of data for users aged 13-18 lacking parental consent must occur within 60 days.

Left

Brazil Fines ByteDance

Brazil’s National Data Protection Authority fined ByteDance 153.7 million reais (?$29.8 million) on August 25 2026.
The regulator said TikTok’s lax age-verification let it illegally collect data from at least 8 million children, a practice absent in United States and Europe.
TikTok breached laws by processing data from logged-in accounts and guest sessions without legal basis.
The authority ordered TikTok to delete all illegally collected data and build a youth-protection framework.

History

Historical Context

In January 2019, the European Union’s General Data Protection Regulation led French regulator CNIL to fine Google €50 million for opaque data practices. Google’s French subsidiary, Google France, settled the €50 million sanction within 30 days, marking the first major GDPR penalty. Similarly, Brazil’s National Data Protection Authority imposed a 153.7 million-real (?$29.8 million) fine on ByteDance’s TikTok in August 2026 for unlawful child-data collection. These enforcement actions signal a global shift toward stricter youth-privacy safeguards, prompting platforms worldwide to redesign verification systems and data-retention policies.

1 of 3

ByteDance Fined

Brazil’s National Data Protection Authority fined TikTok parent ByteDance 153.7 million reais (about $29.8 million) on August 25, 2026.
The compliance plan caps unregistered users at 12 hours daily and eliminates advertising for them.
Daily fines exceed US$26,000 for each day of non-compliance.
ByteDance can cut the penalty by 25 % if it waives its right to appeal.
Deletion of data for users aged 13-18 lacking parental consent must occur within 60 days.

1 / 3