Brazil Fines TikTok R$153.7 Million and Puts 22 Platforms on Notice: What Foreign Tech Companies Need to Know
ANPD fined TikTok R$153.7 million and notified 22 platforms, from Instagram to ChatGPT. Here is what foreign tech companies operating in Brazil must know.
9/3/20265 min read
If your company operates a social network, a messaging app, an app store, or a generative AI tool that Brazilian users can reach, Brazil's data protection authority may already have your name on a list. On August 21, 2026, the Autoridade Nacional de Proteção de Dados (ANPD) sent formal notifications to 22 digital platforms, from Instagram and WhatsApp to ChatGPT and Google Play, asking them to prove they can prevent criminal content and protect children, adolescents, and women. Four days later, ANPD fined TikTok's parent company ByteDance R$153.7 million, roughly US$30 million at current exchange rates, for failing to protect the personal data of Brazilian children. Together, these two events mark a real shift in how Brazil regulates foreign platforms, and companies that have never had a legal presence in the country are now squarely inside the enforcement perimeter.
The TikTok fine: what actually happened
ANPD found that TikTok may have collected personal data from close to 20% of Brazilian children over a one year period, through both its no-login feed and its logged-in feed, without the safeguards Brazilian law requires for minors. As part of the sanction, TikTok must suspend advertising, disable livestreaming, and turn off direct messages for users accessing the platform without an account, in addition to implementing a broader compliance plan. The company has 20 business days to appeal the decision or pay with a 25% discount, which would bring the fine down to R$115.33 million. The case is not final and TikTok may still contest it, but the size of the sanction and the specificity of the required remediation show that ANPD is willing to act on individual platforms, not just publish general guidance.
Who else is on ANPD's list
The August 21 notification went to two groups of companies. The first covers social networks and messaging platforms: Instagram, Facebook, WhatsApp, Telegram, TikTok, X, Discord, YouTube, Kwai, LinkedIn, Snapchat, Pinterest, and Reddit. The second covers app stores and generative AI tools: the App Store, Google Play, Copilot, Claude, DeepSeek, Gemini, ChatGPT, Meta AI, and Perplexity. Each company was given ten business days to answer a questionnaire about the mechanisms it uses to detect and prevent criminal content and to protect minors and women online. Private communications, such as direct messaging and email, are excluded from the scope of this particular round.
The list is a practical signal of where ANPD is looking first: platforms with large volumes of user-generated content, open access without registration, or AI tools capable of generating images and text involving real people. A company does not need to be Brazilian, or even have an office in Brazil, to be included.
The legal basis: three rules working together
This enforcement wave rests on three pieces of law that foreign companies should understand as a package, not as isolated headlines.
ECA Digital (Law 15.211/2025), took effect on March 17, 2026. It applies to any information technology product or service aimed at, or reasonably likely to be accessed by, children and adolescents in Brazil, including services provided by companies based abroad. It requires immediate removal of content related to child abuse or exploitation, mandatory reporting to authorities, and the adoption of parental control tools and age verification mechanisms. ANPD is the enforcing authority.
Decree 12.975/2026, signed on May 20, 2026 and in force since mid-July, amended the regulation of the Marco Civil da Internet. It created a presumption of platform responsibility for illegal content distributed through paid advertising, algorithmic amplification, or artificial engagement networks, regardless of whether the platform received a prior notification. This builds on a June 2026 Supreme Federal Court (STF) ruling that already narrowed the old rule requiring a specific court order before a platform could be held liable for third party content.
Decree 12.976/2026, signed the same day, created specific obligations around protecting women from violence enabled or amplified by digital technology, including non-consensual disclosure of intimate images and AI-generated sexual content.
Read together, these rules give ANPD both the mandate and the procedural tools to monitor platforms proactively, not only to respond to complaints after the fact.
What this means if your company is not on the list yet
ANPD has described August through November 2026 as a monitoring and adaptation period, with an update to its enforcement and sanctions regulations expected in November and structured enforcement actions planned from January 2027 onward. But the TikTok fine happened well before that timeline, and ANPD has been explicit that it can act sooner in cases involving complaints or high risk to children. A company that is not among the first 22 notified should not read that as a sign it is outside the scope of these rules. It is a sign that the notifications are likely to expand.
What foreign tech companies should do now
Companies with a product accessible to Brazilian users, even without a local subsidiary, should review a few things before ANPD asks. First, age verification and parental control mechanisms for any product that could plausibly reach minors. Second, content moderation and reporting workflows for user-generated content, including how quickly the platform can act on notifications about illegal content. Third, advertising and content amplification systems, given the new presumption of liability created by Decree 12.975/2026. Fourth, documentation showing these mechanisms actually exist and function, since ANPD's questionnaire approach suggests it wants evidence, not policy statements. Companies already navigating LGPD compliance in Brazil have a head start, since data mapping and accountability documentation done for LGPD purposes overlaps significantly with what ANPD is now asking under ECA Digital and the Marco Civil decrees.
FAQ
Does my company need a physical presence in Brazil to be subject to these rules?
No. ECA Digital explicitly applies to companies based abroad if their product is aimed at, or reasonably accessible to, children and adolescents in Brazil. The same extraterritorial logic applies to the Marco Civil decrees when a platform has users in Brazil.
Is the TikTok fine final?
No. TikTok has 20 business days from the decision to appeal or to pay with a 25% discount. The case could still change through Brazil's administrative appeal process.
What happens if my company was not one of the 22 platforms notified?
It means your company was not in this specific round. ANPD has signaled this is the start of a broader monitoring effort, not a closed list, and structured enforcement is expected to expand starting in 2027.
Does responding to ANPD's questionnaire require a Brazilian legal representative?
Companies without a local presence should still evaluate whether they need Brazilian counsel to respond accurately, since the questionnaire asks for specific evidence of compliance mechanisms rather than general statements, and errors in a formal regulatory response can create additional legal exposure.
How is this different from LGPD enforcement?
LGPD governs the processing of personal data generally. ECA Digital and the Marco Civil decrees add platform-specific obligations focused on content moderation, minors, and gender-based digital violence, enforced by the same agency but under a broader mandate than data protection alone.
Talk to a Brazilian IP and digital law team
If your company operates a platform, app, or AI tool accessible to users in Brazil, Reis Araujo Advogados can review your current compliance posture against ECA Digital and the Marco Civil decrees before ANPD sends a notification. Contact our team to schedule a review.
