The ANPD just showed that the LGPD bites. Ruling 27 of 2026, published in the Official Gazette, imposed a simple fine of 153.7 million reais on ByteDance Brasil, TikTok’s controlling entity, for violations of Articles 7 and 6 of the law in its teenager registration flow.
To calibrate the size of the leap: the ANPD’s first financial fine ever, in 2023, was 14.4 thousand reais. When we mapped the leak of 279 million CPFs, the criticism was the absence of consequence. Four orders of magnitude later, the era of consequence has begun.
The bill, violation by violation
The fine splits into three violations: 63.1 million reais for violating Article 7 (the legal bases of processing), another 63.1 million for violating Article 6, item VIII, and 27.4 million for violating Article 6, item X.
There is a discount on the horizon: if the company waives its right to appeal and pays within 20 business days, the amount drops 25%, to 115.3 million. The design is classic mature-regulator doctrine: punish, and monetize fast compliance.
The obligation that hurts more than the fine
The point most coverage will miss: besides the fine, the ruling orders the deletion of personal data of teenagers aged 13 to 18 registered without regularized legal representation, within 60 business days.
The obligation comes bundled: notification to third parties that received the data, and a technical report with logs signed by the data officer. Non-compliance generates a daily fine of 137 thousand reais per day of delay. The ANPD is not fining the past; it is forcing the company to operate the future in a verifiable way.
For anyone running a digital product, the technical takeaway is direct: data deletion must be a product capability (a pipeline that finds and erases at scale, including backups and the third-party chain), and the documented chain must exist before the inspection.
The context that matters: minors at the front of the queue
This sanction does not come out of a vacuum. Protection of children and teenagers is a priority axis for the ANPD in 2026-2027, with the Digital Child Statute (ECA Digital) in the same package. We have covered the ANPD’s self-report in the ISAC case, with 500 thousand patients, here before: the authority has been building its case line for a while, and now it has demonstrated reach against a global platform.
Brazil processed ByteDance the way it would process any controller: by the registration flow, the legal basis, and the legal representation of minor data subjects. Size is not a shield.
What it means for product builders
For anyone creating AI products with minors’ data, the AI Legal Framework is still a bill. The LGPD is already a sanction on the invoice.
In practice, three requirements anticipate themselves: a documented legal basis per processing flow (Article 7), verified legal representation in teenager registrations (a decorative checkbox does not survive a ruling), and the technical capacity to delete data on a deadline, third-party chain included. None of the three is expensive when designed up front; all of them are very expensive when designed by ruling.
What to do in the next 30 days
For anyone leading product or technology, the 30-day plan fits on one page:
- Inventory every minor registration in the product and verify how legal representation is obtained and proven today.
- Test deletion capability: can you locate and erase a specific data subject's data across every system, including backups and third parties, within a business deadline?
- Inventory legal bases per flow and have the data officer sign off on the document.
- Rehearse the inspection: who answers, in what timeframe, with which reports.
Each item costs days when done early and weeks when done under a ruling. The difference between the two scenarios now has a public price tag: 153.7 million reais.
Conclusion
The largest fine in LGPD history is not a story about TikTok. It is the public definition of how the ANPD reads legal basis, minors’ data, and the duty to delete. From now on, "no one has ever been fined" stopped being a planning argument.
If your product registers teenagers, processes sensitive data, or feeds automated decisions, the checklist exists and the window for voluntary compliance is now: with dialogue and cooperation, the conversation with the ANPD is technical. Without them, the conversation is Ruling 27.