Brazil's National Data Protection Authority, the ANPD, fined ByteDance R$153.7 million in August 2026 over how TikTok handled children's and adolescents' data, the largest penalty issued under the Lei Geral de Protecao de Dados since the law took effect in 2020. The fine landed three years after the ANPD's first-ever LGPD sanction, a R$14,400 penalty against a small telemarketing firm, and it arrived alongside a broader shift: in June 2026 the ANPD opened more new sanctioning cases in a single month than it had in its first five years combined.
That jump is not a one-off. It follows a February 2026 law that turned the ANPD into a full regulatory agency with its own budget and staff, and a December 2025 priority map that named children's data, AI, and public-sector processing as the authority's top enforcement targets. Below is what the ANPD's own numbers show: the record fine, the enforcement case count, how fines are calculated, and where the regulator is focused next.
What is the largest LGPD fine ever issued?
The ANPD's largest confirmed fine is R$153.7 million, issued against ByteDance on August 25, 2026, and published in the Diario Oficial da Uniao the same day. The decision found five violations of LGPD Articles 6 and 7 tied to how TikTok processed data belonging to children and adolescents, both in its registration-required feed and in a no-registration feed that let users browse without creating an account.
The ANPD's decision requires ByteDance to delete personal data collected irregularly, apply the most restrictive privacy settings by default to accounts belonging to users under 16, strengthen parental-control systems, add age-verification mechanisms tied to Brazil's Digital ECA (the country's statute on children and adolescents), and suspend advertising entirely within the no-registration feed. ByteDance has 10 business days from publication to appeal the decision to the ANPD's Board of Directors, the same appeal window the authority applies to its other sanctioning decisions.
| Fine | Company | Date | Violation |
|---|---|---|---|
| R$153.7 million | ByteDance (TikTok) | August 2026 | Children's and adolescents' data processed without legal basis |
| R$14,400 | Telekall Infoservice | July 2023 | No legal basis, no data protection officer, ignored ANPD requests |
Figure 1: The two confirmed monetary LGPD fines against private-sector companies to date, three years apart. Source: ANPD official announcements, gov.br.
What was Brazil's first LGPD fine?
The ANPD's first-ever monetary LGPD fine, issued in July 2023, totaled R$14,400, split into two separate R$7,200 penalties against Telekall Infoservice, a telemarketing company based in Vila Velha, Espirito Santo. The investigation began after a complaint that the company was offering lists of voters' WhatsApp contacts for use in political campaign messaging, without a valid legal basis for that processing.
The ANPD found Telekall violated LGPD Articles 7 and 41, and Article 5 of the authority's own Inspection Regulation, for processing personal data without a lawful basis, operating without a designated data protection officer, and failing to respond to the ANPD's information requests during the investigation. At R$14,400, the fine was symbolic rather than punitive, but it was pioneering: it marked the first time Brazil's data protection law, in force since September 2020, produced an actual monetary penalty against a private company.
Figure 2: Eight years from statute to record fine. Source: ANPD gov.br announcements, Trench Rossi Watanabe, Daniel Law client alerts.
How many LGPD sanctioning cases has the ANPD brought?
The ANPD's enforcement volume was modest for most of the LGPD's history, then accelerated sharply in 2026. The authority opened just 5 administrative sanctioning processes across its first five years, from its 2020 creation through the end of 2024. By early 2026, legal trackers counted at least 9 sanctioning processes concluded, most against public-sector agencies for failing to report security incidents. Then, in June 2026 alone, the ANPD opened 19 new sanctioning processes, more than triple its entire prior five-year count in a single month, and referred 21 data processing agents for sanctions review, 19 of them public entities and 2 private.
Figure 3: Of the 21 data processing agents the ANPD referred for sanctions review in June 2026, the large majority were government agencies. Source: Daniel Law client alert, June 2026.
Figure 4: The ANPD opened more sanctioning processes in June 2026 alone than in its first five years combined. Source: Daniel Law client alert, June 2026; turivius.com case tracker.
Separately from sanctioning cases, the ANPD's Painel da Fiscalizacao dashboard, launched in November 2025 to publish aggregated oversight data, showed 81 fiscalização proceedings opened, according to the authority's first Integrated Management Report, published in May 2026. That same report recorded 12,701 data subject requests answered during 2025. Fiscalização proceedings are broader oversight and inspection actions and are a distinct category from the formal sanctioning processes that can end in a fine, so the two counts should not be added together.
How much can the ANPD fine a company under the LGPD?
LGPD Article 52, unchanged since the law's original 2018 text, caps a simple fine at 2% of the offending company's, group's, or conglomerate's revenue in Brazil for its most recent fiscal year, excluding taxes, limited in total to R$50 million per infraction. Because the cap applies per infraction rather than per case, a single administrative process covering multiple violations, like the five findings in the ByteDance decision, can produce a combined penalty well below the theoretical R$50 million-per-infraction ceiling but still reach nine figures once fines for each violation are added together.
Figure 5: How the ANPD's fine ceiling is calculated under LGPD Article 52. Source: LGPD Law 13.709/2018, Article 52; ANPD sanctioning decisions.
Beyond the simple fine, Article 52 gives the ANPD five other sanction types it can apply instead of or alongside a monetary penalty: a warning with a deadline for corrective action, a daily fine also capped at R$50 million total, public disclosure of the violation once it is confirmed, blocking of the personal data involved, and permanent deletion of that data. Most of the ANPD's concluded cases against public agencies have used warnings and public disclosure rather than a monetary fine, since Article 52's own text (paragraph 3) restricts monetary fines against public-sector bodies.
Figure 6: The procedural path of an ANPD administrative sanctioning process, from investigation to closure. Source: LGPD Article 52; ANPD decision announcements.
You can generate an LGPD-ready privacy policy covering the legal basis, data subject rights, and children's data disclosures the ANPD checks first in an investigation, whether your business operates in Brazil directly or simply processes data belonging to Brazilian users.
What are the ANPD's enforcement priorities for 2026 and 2027?
The ANPD published its Priority Issues Map for the 2026-2027 biennium in December 2025 through Resolution CD/ANPD No. 30, naming four declared focus areas for oversight and sanctioning activity. The same month, Resolution CD/ANPD No. 31/2025 updated the agency's broader regulatory agenda, adding three new topics tied to Brazil's Digital ECA, the statute governing children and adolescents online.
Figure 7: The four enforcement priorities the ANPD named for 2026-2027. Source: ANPD Resolution CD/ANPD No. 30, December 2025.
The children's data priority is the one already producing results: the R$153.7 million ByteDance fine, the largest in LGPD history, was a direct enforcement action under this same priority area, and the ANPD has signaled that complex new topics such as age verification will first get regulatory guidance before enforcement actions follow, the same sequencing it used for international data transfers in 2024.
What is the ANPD's rule for international data transfers?
The ANPD approved its International Data Transfer Regulation through Resolution CD/ANPD No. 19/2024 on August 23, 2024, introducing a standard contractual clauses framework with 24 mandatory clauses set out in the resolution's Annex II. Covered organizations had a 12-month grace period to incorporate the ANPD-approved clauses into their international data transfer agreements, ending August 22, 2025. From that date forward, an international transfer of personal data out of Brazil is valid only if it uses the ANPD's standard contractual clauses or another mechanism the authority has separately approved.
This rule matters for any organization that sends Brazilian user data to servers or vendors outside Brazil, including US-based SaaS tools, and it mirrors the same legal-basis-and-transfer-mechanism scrutiny that has driven the largest fines under other countries' privacy laws, including the privacy laws tracked across dozens of jurisdictions and the enforcement trends emerging under Australia's reformed Privacy Act.
The Bottom Line
Brazil's LGPD enforcement moved from largely symbolic to genuinely consequential within a single year. A regulator that spent five years issuing just five sanctioning cases and one R$14,400 fine opened 19 new cases in a single month and then issued a R$153.7 million penalty two months later, all under a newly independent regulatory agency with its own budget and a declared focus on children's data, AI, and public-sector processing. For any business handling data belonging to people in Brazil, the practical signal is that the ANPD's historically low enforcement volume is no longer a reasonable basis for treating LGPD compliance as low-risk, particularly around legal basis for processing, children's and adolescents' data, and international transfer mechanisms, the exact categories driving the ANPD's biggest 2026 actions. Compare that trajectory with enforcement patterns under China's PIPL, another major non-EU privacy regime that has moved from limited early enforcement toward larger, more frequent penalties.
Frequently Asked Questions
What is the largest LGPD fine issued so far? R$153.7 million, issued by Brazil's ANPD against ByteDance, the parent company of TikTok, on August 25, 2026, for five violations tied to how the platform processed children's and adolescents' data. It is by far the largest monetary penalty issued under the LGPD since the law took effect in 2020.
What was Brazil's first LGPD fine? R$14,400, issued in July 2023 against Telekall Infoservice, a telemarketing company in Vila Velha, Espirito Santo. The Ministry of Justice and Consumer Protection, acting through the ANPD, applied two separate R$7,200 fines for processing personal data without a legal basis, lacking a data protection officer, and failing to respond to ANPD requests.
How much can the ANPD fine a company under the LGPD? Article 52 of the LGPD caps a simple fine at 2% of the offending company's, group's, or conglomerate's revenue in Brazil for its last fiscal year, excluding taxes, limited in total to R$50 million per infraction. A single administrative process can cover several infractions, so the effective ceiling on one case can exceed R$50 million.
How many LGPD sanctioning cases has the ANPD opened? The ANPD opened only 5 administrative sanctioning processes across its first five years, from creation in 2020 through the end of 2024. In June 2026 alone it opened 19 new sanctioning processes, more than triple its previous five-year total in a single month, following its transformation into a regulatory agency.
Where the Numbers Come From
- ANPD, gov.br. (2026). "ANPD multa TikTok em R$153,7 milhoes por falhas na protecao de dados de criancas e adolescentes." Official decision announcement, published 25 August 2026.
- Daniel Law. (2026). "ANPD imposes fine of R$153.7 million for failures in the processing of children's and adolescents' data." Client alert, August 2026.
- Poder360. (2026). "ANPD abriu 81 processos de fiscalizacao em 2025." Citing the ANPD's 1st Integrated Management Report, published May 2026.
- ANPD, gov.br. (2026). "ANPD publica balanco das atividades no 1o Relatorio Integrado de Gestao." First Integrated Management Report announcement, May 2026.
- Daniel Law. (2026). "ANPD abre 19 novos processos administrativos sancionadores." Client alert, 29 June 2026, reporting 19 new processes opened in June 2026 against a total of 5 opened from 2020 through 2024.
- Turivius. "Multas LGPD 2026: quem a ANPD ja sancionou e por que." Legal case tracker, accessed August 2026.
- Trench Rossi Watanabe. (2025). "ANPD Publishes Map of Priority Issues (2026-2027 Biennium) and Update of the Regulatory Agenda (2025-2026 Biennium)." Legal alert, December 2025.
- Mayer Brown. (2024). "New ANPD Regulation on International Data Transfers." Legal alert on Resolution CD/ANPD No. 19/2024, August 2024.
- IAPP. (2024). "Lessons from Brazilian DPA sanctions to date." Analysis of the ANPD's first seven published sanctioning decisions, October 2024.
- Folha PE. (2023). "Empresa de telemarketing e multada em R$14,4 mil por violacao da Lei Geral de Protecao de Dados." Report on the ANPD's first LGPD fine, July 2023.
Note: All figures verified as of August 2026. The ANPD does not yet publish a cumulative LGPD fine total comparable to the GDPR trackers maintained by CMS Law or DLA Piper, so figures in this post are drawn directly from individual ANPD decisions and law firm client alerts tracking those decisions rather than from a single aggregated database. This post will be refreshed at least twice a year as new sanctioning decisions and ANPD reports are published.
