Brazil’s data protection authority imposed a simple fine of R$153,769,671.33 on ByteDance Brasil for LGPD violations involving children and adolescents [E1][E2]. The published decision divides that total into R$63,176,686.67 for art. 7º, R$63,176,686.67 for art. 6º VIII and R$27,416,297.99 for art. 6º X [E2]. The regulator’s announcement says the case involved five violations across arts. 6º (VIII and X) and 7º [E1]. ByteDance Brasil is identified in the operative record under CNPJ 27.415.911/0001-36, in process 00261.006648/2024-02 [E2].
ANPD describes five violations across the listed provisions [E1]. The Diário Oficial prints three monetary lines, with the two R$63,176,686.67 amounts and the R$27,416,297.99 amount summing to the exact total [E2]. The R$153.7 million figure in the announcement is the rounded form of R$153,769,671.33 in Despacho Decisório 27/2026 [E1][E2]. Three monetary lines and five violations are separate counts in the published record [E1][E2].
The product order reaches TikTok before login [E1]. In Brazil, the logged-out experience must suspend advertising and cap use at 12 hours [E1]. It must block creation, comments, direct messages and live broadcasts, while limiting personalisation, using all-ages content and reducing data collection [E1]. Users under 16 must receive the most restrictive settings described by the authority [E1].
The publication layers do different work [E1][E2]. The ANPD news note describes the logged-out controls, while Despacho Decisório 27/2026 orders deletion of personal data from 13–18-year-olds whose legal representation had not been regularised [E1][E2]. ByteDance Brasil has 60 business days for that deletion, and the operative text attaches a R$137,081.49 daily fine to noncompliance [E2]. The logged-out controls sit in the regulator’s news explanation; the deletion deadline sits in the operative decision [E1][E2].
Notification came on 24 August, opening ten business days for an appeal [E1]. A separate route reduces the fine by 25% to R$115,327,253.49 if ByteDance waives the challenge and pays within 20 business days [E2]. The decision places a ten-business-day appeal clock beside a twenty-business-day waiver-and-payment clock [E1][E2]. The 60-business-day deletion deadline is another stated period in the same enforcement package [E2].
TikTok said the sanction concerns conduct from 2021 and that it had already presented a compliance plan in 2025 [E1]. The company’s response puts those earlier dates against a decision published in 2026; the amounts and deadlines printed in Despacho Decisório 27/2026 remain as stated [E1][E2]. The regulator’s published action still combines the simple fine with the logged-out controls and the deletion order [E1][E2].
The R$153,769,671.33 figure does not assign a price to each logged-out control [E1][E2]. Despacho Decisório 27/2026 assigns the simple fine across the listed LGPD provisions and separately states the deletion order and daily penalty [E2]. The logged-out restrictions are described as product remedies in the ANPD note [E1]. The cited record supplies no separate amount for suspending ads, capping logged-out use or blocking social functions [E1][E2].
Brazil’s order reaches both the data already held and the feed presented before login [E1][E2]. A logged-out user is supposed to see no ads, face a 12-hour cap, lose creation, comments, direct messages and live broadcasts, and encounter limited personalisation and reduced data collection [E1]. ByteDance Brasil also faces a 60-business-day deletion duty for the specified 13–18 data, backed by a R$137,081.49 daily fine [E2]. The order reaches the screen before the sign-up: in Brazil, TikTok’s logged-out feed now has a regulatory specification [E1].