The Brazilian “Digital ECA” — an update to the Child and Adolescent Statute aimed at addressing online harms — introduced by Law No. 15,211/2025, will enter into force on March 17, 2026. The legislation establishes a regulatory framework to protect minors in the digital environment and is expected to have significant implications for technology companies and other organizations offering digital products or services accessible to minors in Brazil.
The law creates rules related to product design, content moderation, data protection and risk governance, with centralized oversight by the National Data Protection Agency (ANPD) — which was recently transformed into a regulatory agency and will have expanded supervisory powers.
With its imminent entry into force, companies must assess their level of compliance. The new law requires structural changes to products, monetization models, internal processes, and data governance.
Broad scope: who will be impacted?
The Digital ECA applies to any information technology product or service targeted or likely to be accessed by children and adolescents in Brazil, regardless of the company’s place of development or operation.
In practice, this includes:
- social networks and content platforms;
- marketplaces and apps;
- electronic games;
- streaming services;
- search engines;
- digital advertising platforms;
- operating systems and app stores;
- connected devices and electronic equipment with internet access.
However, the scope of the law is not limited to these examples. Any digital product or service, in any sector, may be subject to the new rules to the extent that it is targeted or likely to be accessed by children or adolescents, for example:
- financial institutions that offer digital accounts or banking applications used by adolescents;
- health and wellness apps, including telemedicine or fitness platforms accessible to minors;
- applications used in clinical trials or medical follow-up programs that involve digital data collection from minors.
The concept of “probable access” significantly broadens the scope of the law. Generalist platforms, even if not intended for children and adolescents, can be framed if there is relevant use by minors.
Main changes and new obligations
With the entry into force of the Digital ECA, suppliers of digital products and services must pay special attention to some central points, such as:
- design of products and services;
- age verification mechanisms;
- boosting and monetization;
- parental supervision tools.
These are just some of the main points that should be considered from a practical point of view when adapting products, processes, and business models to new legal requirements.
For more details on the new obligations introduced by Digital ECA, see the alert previously published by Lefosse: Digital ECA: new law introduces significant changes to Brazil’s digital ecosystem.
ANPD’s central role
The ANPD was designated as the authority responsible for the inspection and implementation of the Digital ECA. In addition to supervising compliance with the new legislation, the ANPD will be responsible for editing complementary rules, establishing technical parameters, and guiding the market on the application of the new rules.
The Agency has already started monitoring proceedings for relevant companies in the digital sector, with the aim of assessing the stage of market adequacy. This movement signals that the inspection should take place actively from the first months of the law’s effectiveness.
It is worth noting that failure to comply with the obligations provided for in the Digital ECA may result in administrative sanctions, including a warning, fines of up to 10% of the economic group’s revenue in Brazil (or, in the absence of revenue, between BRL 10 and BRL 1,000 per registered user, limited to BRL 50 million per infraction), in addition to suspension or prohibition of activities in the country. The definition of penalties will consider, among other factors, the seriousness of the infraction, the extent of the damage and the economic capacity of the offender.
In the case of foreign companies, entities established in Brazil may be jointly and severally liable for the payment of fines.
How can organizations prepare?
Given the proximity of the entry into force of the statute, organizations must prioritize adaptability with an efficient compliance assessment, focusing on risk mapping and the implementation of initial adequacy measures. Among the main initial actions there are:
Map regulatory exposure
- identify products or services with probable access by children and adolescents;
- assess the risks associated with each product or feature and potentially applicable regulatory obligations.
Review product design and functionality
- evaluate technological solutions for age verification (internal development or contracting suppliers);
- establish a roadmap for the technical and operational implementation of the new tools.
Update policies and governance
- structure internal policies related to product design and protection of children and adolescents
- review terms of use, regulations, and privacy policies to reflect Digital ECA requeirements.
Prepare reports and documentation for accountability
- carry out data protection impact assessments
- structure transparency, moderation and risk governance reports.
Our team specialized in Technology, Data Protection and Intellectual Property closely follows the changes that impact the market and is available to support your organization in the journey of compliance with Digital ECA and other ongoing regulatory initiatives. For more information on this or other topics of interest, please contact our professionals.
