Brazil’s Digital Statute of Children and Adolescents (Estatuto Digital da Criança e do Adolescente, or ECA Digital), enacted as Law No. 15.211/2025 on September 17, 2025, establishes comprehensive child-protection and age-assurance requirements for digital services. Originally introduced as Bill 2628/2022, the law entered into force on March 17, 2026, and applies to digital products and services directed toward children and adolescents or likely to be accessed by them, including social media, gaming, e-commerce, entertainment platforms, and adult-content websites.
The legislation requires digital services to incorporate safeguards protecting minors against exploitation, abuse, harmful content, and inappropriate commercial practices. Reliable age assurance is a central requirement, particularly for services providing access to age-restricted content. Self-declaration alone is insufficient where reliable age determination is required. Pornographic websites must implement effective measures to prevent access by minors, while social media platforms must apply age-appropriate protections and identify underage users where necessary.
Implementing Decree No. 12.880, issued March 18, 2026, establishes more detailed requirements for age-assurance systems. These include accuracy, robustness, proportionality to risk, privacy protection, data minimization, transparency, and interoperability. Age-assurance methods may include identity-document verification, facial age estimation, or other appropriate technical approaches. Information collected for age assurance must not be repurposed for unrelated activities, and identity-document images or copies must be deleted immediately and irreversibly once the necessary age information has been obtained. The regulatory framework also recognizes age signals supplied by app stores and operating systems, although individual service providers retain responsibility for compliance.
Social media accounts belonging to children and adolescents under 16 must be linked to a parent or legal guardian. Providers must offer parental supervision tools enabling guardians to manage privacy settings, restrict communications, limit content exposure, and control usage. The law also restricts loot boxes for minors, establishes safeguards for games featuring user interactions, and prohibits certain forms of targeted advertising and behavioral profiling involving children and adolescents. Providers must implement mechanisms for identifying and reporting child sexual exploitation and abuse material to the appropriate authorities.
Brazil’s National Data Protection Authority (ANPD) oversees regulatory implementation and administrative enforcement. In March 2026, ANPD published preliminary guidance on reliable age-assurance mechanisms, followed by a public consultation on expanded technical guidance addressing approaches such as facial age estimation and documentary verification. Beginning in June 2026, ANPD initiated compliance monitoring of app stores, operating systems, and pornography websites, subsequently expanding its oversight to major digital platforms and generative AI services.
Violations may result in warnings, administrative fines of up to R$50 million per violation, subject to applicable statutory limits, and other sanctions, including suspension or prohibition of activities. Although the legislation has been in force since March 2026, ANPD is following a phased implementation approach, with an adaptation and monitoring period extending through November 2026 and more intensive enforcement activity anticipated beginning in January 2027. Further technical guidance, regulatory requirements, and enforcement developments are expected as Brazil’s age-assurance framework continues to mature.