SINGAPORE, 30 AUG 2026 — Brazil's data protection authority has fined TikTok's owner more than 153m reais, about US$30m, over the handling of children's and teenagers' data. The fine is the reported number. The order to erase the data is the expensive part.

What the regulator found

The ANPD ruled that TikTok collected and processed young users' personal information without a valid legal basis or adequate safeguards, across both logged-in accounts and guest browsing sessions.

The guest-session finding is the significant one. A platform can argue that account holders accepted terms, and it cannot make that argument for a visitor who never created an account. Processing personal data of a visitor who has not registered removes the consent defence entirely.

The regulator estimated that at least eight million children's data may have been processed, and described systemic deficiencies in the platform's age-verification mechanism. The ruling orders TikTok to erase all data amassed illegally.

153m reaisThe fine, about US$30m
8 millionChildren whose data may have been processed, per the regulator
Guest sessionsCovered by the finding, not only logged-in accounts
EraseThe order the coverage is not leading with

Why deletion costs more than the fine

A US$30m fine is not a deterrent to a company of ByteDance's size. The deletion order is a different order of problem.

Personal data collected from users does not sit in one table. It propagates into engagement logs, into derived features, into A/B test records, into backups, and into the training corpora of recommendation systems. An order to erase all illegally amassed data therefore poses a difficult technical question. What does deletion mean once the data has already shaped a model?

If derived artefacts must also be erased, the cost is in retraining models. If only source records must go, the order is satisfiable while letting the company keep much of the value it extracted. Which reading applies is the substantive question in this ruling, and it is not one the coverage has examined.

That question is now arriving in several jurisdictions at once, and no regulator has yet published a workable technical standard for what erasure means when a model has already learned from the record.

Eight million is an estimate, and the regulator says so

Any large, round number in an enforcement action deserves scrutiny, and this one is no exception.

Eight million is the regulator's estimate of children whose data may have been processed, not a count of confirmed records. It is presumably derived from population and usage modelling rather than from an audit of TikTok's systems, because a regulator does not have direct access to those systems when it opens an examination.

That does not make it wrong or inflated. Estimates of this kind are how regulators size a harm they cannot enumerate, and understating it would be the more common failure. The number is the authority's modelled figure rather than an established count. The deletion exercise itself would produce the real one, if it is ever published.

The distinction matters because the fine and the estimate are related. Penalties in this family of law scale with the scope of the processing, so the estimate is doing work in the calculation and is a plausible ground of appeal.

Age verification is the failure underneath

The finding of systemic deficiencies in age verification has the widest application, because no platform has solved the problem.

The methods available all trade one harm for another. Self-declaration is trivially defeated. Document checks require a platform to collect identity documents from minors, which creates a worse dataset than the one being protected. Inference from behaviour means profiling children to determine that they are children.

Regional regulators are choosing among exactly these options now. Malaysia's under-16 rules let platforms check age without ever seeing an identity document, which is the most privacy-preserving design in the region and depends on a national digital identity that most jurisdictions do not have. Slovakia's approach has a second half that received almost no coverage.

OpenAI has taken the inference route, and will place users into a teen product without asking them. Each of these is a defensible trade-off, and a regulator finding one method deficient does not establish what an adequate one would be.

Why a Brazilian ruling matters here

Brazil's data protection law is closely modelled on the European regulation, and its regulator has become one of the more active enforcers outside Europe.

That matters for Southeast Asia because several regional statutes share the same lineage, and because enforcement precedent travels more readily between similar frameworks than legislation does. A finding that guest-session processing of minors lacks a legal basis is a finding that a Singaporean, Malaysian or Philippine regulator could reach on comparable provisions.

It also lands on a company with a very large regional footprint. The same product, guest-browsing behaviour and age-verification mechanism operate across this region. The ruling puts on record that a peer regulator has examined them and found them wanting.

What to watch

Whether ByteDance appeals, and on what grounds, since an appeal contesting the deletion order rather than the fine would confirm which remedy the company considers costly.

Whether the ANPD issues any technical specification for compliance with the erasure order. If it does, it will be among the first regulators anywhere to define what deleting training-influencing data actually requires, and that definition will be cited well beyond Brazil.

And whether any regional regulator opens a comparable examination. With the finding on the record and the product operating identically here, a follow-on enquiry is a matter of regulatory priority rather than of new evidence.