In short
On 25 August 2026 Brazil's Autoridade Nacional de Proteção de Dados fined ByteDance, which controls TikTok, 153.7 million reais over irregularities in processing the personal data of children and adolescents. Five violations of the LGPD, Brazil's data protection law, were identified.
The point: the user declares their own age
The authority found the platform relied exclusively on self-declared age, a method users manipulate easily. It is the same design choice found in thousands of European services: a dropdown with a birth year, no verification, problem considered solved. In Brazil it is no longer considered sufficient.
The violations cover both the feed accessible without registration — browsing the app without creating an account — and the one reserved for signed-up users. That distinction matters: many companies treat the unregistered visitor as a non-user, therefore outside the scope of their obligations. That is wrong: if the service profiles and tracks, the absence of an account takes nothing away.
What the company must do, beyond paying
- Delete all data collected irregularly
- Implement reliable age verification mechanisms, following the Digital Statute for Children and Adolescents (ECA Digital)
- Automatically default accounts of users under sixteen to the most restrictive privacy settings
The question to put to clients who run an app
If the service states a minimum age in its terms, someone must be able to answer two questions: how does the system notice the user lied, and what happens when it does. If the answer to the first is "it doesn't", the minimum age in the terms is not a protective measure: it is a clause shifting responsibility onto the minor.
Why a Brazilian decision concerns Europe
The LGPD is built on the GDPR's architecture and the ANPD tends to move in dialogue with European authorities. The age question, moreover, is converging everywhere: the UK requires highly effective age assurance, the EU is debating child protection under the Digital Services Act, and the Italian DPA has already intervened repeatedly on minors' access to platforms. A decision qualifying self-declaration as inadequate is bound to be cited outside Brazil too.
A note of realism: verifying age properly means collecting more data, not less — a document, a biometric, an intermediary that certifies. That is the unresolved tension in this whole area, and none of the authorities demanding verification has yet explained how it squares with the minimisation principle. It is the problem the next two years will have to solve.
Official source:ANPD - Multa ao TikTok por falhas na proteção de dados de crianças e adolescentes (25 agosto 2026)Looking for a workspace for your DPO work?
DPO Workspace is built by a certified DPO. 30-day free trial.
Start free
