Brazilian Agency fines tech company BRL 153 Million, raising the bar for digital enforcement

The Brazilian Data Protection Agency (“ANPD”) has imposed a BRL 153.7 million fine on a tech company, primarily for alleged irregularities in the processing of children’s and adolescents’ personal data. The decision, issued on August 25, represents an important development in the Authority’s enforcement activities and signals that the protection of minors will be a key focus of the regulatory oversight of digital platforms in Brazil. The decision remains subject to administrative appeal, within 10 business days.

What did the ANPD identify?

The investigation examined two ways of accessing a platform managed by the tech company: the “logged-out feed”, which allowed users to browse without creating an account, and the “logged-in feed.” In both cases, the ANPD found that children’s and adolescents’ personal data was being processed without an appropriate legal basis and that the measures adopted by the platform were insufficient to prevent or mitigate such processing, in violation of Articles 6(I), (VIII) and (X), 7 and 14 of LGPD (Brazilian Data Protection Act, Law No. 13,709/2018). The violations were classified as serious by the Authority.

This aspect deserves particular attention, as the decision confirms that compliance does not simply mean having policies, documents or internal procedures in place: companies must also demonstrate that the measures they adopt are effective.

Why is this case particularly relevant now?

Although the facts under review predate the entry into force of the Digital Child and Adolescent Statute (ECA Digital, Law No. 15,211/2025) in Brazil, the decision comes at a time of significant expansion of the obligations applicable to digital platforms. The Statute entered into force on March 17, 2026, and introduced new requirements concerning, among other matters, age verification, parental supervision, and the prevention and mitigation of risks to children and adolescents.

The ANPD’s Board of Directors made an important distinction: facts predating the ECA Digital remain subject to the LGPD, but compliance measures to be implemented going forward must also comply with the new framework. Accordingly, the decision makes clear that the obligation to prevent unlawful processing of children’s data did not arise with the ECA Digital – it already derived from the LGPD – but now coexists with an even more specific and comprehensive regulatory framework.

In this context, this tech company’s compliance plan was approved with a reservation, including a requirement for the “implementation of robust age-assurance mechanisms”, in accordance with the deadlines established by the ANPD and the final guidance to be issued on the subject.

In practice, this means that issues such as age verification, privacy by design, default privacy settings, parental controls, targeted advertising, content personalization, and risk governance are likely to become increasingly relevant in compliance assessments of digital products and services.

A broader movement beyond

The ANPD’s recent enforcement activities indicate that this case should not be viewed in isolation. Shortly before the sanction, the Authority ordered, as a preventive measure, the suspension of Discord’s livestreaming features in Brazil (“GoLive”), after identifying structural shortcomings in the prevention of and response to serious violations involving children and adolescents. The measure remains subject to the platform’s adoption of measures capable of mitigating these risks.

The Brazilian movement follows an international trend toward greater accountability for digital platforms. In the European Union, the same tech company had already been fined €345 million in 2023 for violations relating to the processing of children’s data. In the United States, in August 2026, the tech company entered into a US$400 million agreement with the Department of Justice to resolve litigation concerning children’s privacy protection.

What should companies be aware of?

The combination of the LGPD + ECA Digital + increasingly assertive enforcement by the ANPD demonstrates a shift in the regulatory landscape for the digital environment in Brazil. Rather than merely responding to incidents or updating documentation, companies that develop, offer or use digital products and services need to incorporate data protection and the safety of children and adolescents into the architecture, governance and risk management of their businesses.

Against this backdrop, companies should consider conducting preventive compliance assessments, reviewing data processing flows, age-assurance mechanisms, advertising and profiling practices, parental controls and risk-prevention measures, while closely monitoring regulatory developments from the ANPD.

We will continue to monitor this topic and remain available to assist with any related legal and compliance needs. For further information, please contact our team at digital@kasznarleonardos.com.