ANPD launches call for contributions to develop its 2027-2028 Regulatory Agenda
On September 1, 2026, the Brazilian National Data Protection Agency (“ANPD”) launched a call for contributions to support the development of its Regulatory Agenda for the 2027-2028 biennium, which will set the priority topics for the Agency’s regulatory activities in the coming years.
Topics submitted for discussion include artificial intelligence (“AI”), processing of biometric data, protection of children and adolescents in the digital environment, and the exercise of data subject rights. Contributions received may inform the selection of matters to be addressed through regulation, studies or other ANPD initiatives over the next two-year period.
In parallel, the Agency also began developing its 2027-2030 Regulatory Outcome Assessment Agenda, which will identify the regulatory instruments whose effects will be evaluated following implementation. Contributions to both initiatives may be submitted until October 16, 2026.
The consultations provide an early indication of topics that may gain greater prominence in the ANPD’s activities from 2027 onwards and that are already relevant to companies using AI or biometric technologies, or processing children’s and adolescents’ personal data as part of their activities.
Further details on the call for contributions regarding the 2027-2028 Regulatory Agenda are available at this link, and further information on the Regulatory Outcome Assessment Agenda is available at this link.
ANPD moves forward with review of its enforcement and rulemaking procedures
In September 2026, the Brazilian National Data Protection Agency opened a public consultation on the review of the Regulation governing the Enforcement Process and Administrative Sanctioning Proceedings, currently established by ANPD Board Resolution No. 1/2021.
The proposal seeks to update the rules governing the Agency’s monitoring and enforcement activities and the conduct of administrative sanctioning proceedings. The review also takes into account the expansion of the ANPD’s powers, which now include new responsibilities relating to the protection of children and adolescents in the digital environment and the oversight of platforms under the Brazilian Civil Rights Framework for the Internet (“Marco Civil da Internet”). As part of the process, the Agency held a public hearing on September 24, 2026, and the draft Regulation remains open for contributions on the Brasil Participativo platform until October 26, 2026.
In a related development, on October 6, 2026, the ANPD opened a separate public consultation to review ANPD Ordinance No. 16/2021, which governs the Agency’s rulemaking process. The consultation seeks input on the procedures applicable to the drafting, amendment and review of ANPD regulatory instruments and will remain open until November 23, 2026.
Together, the initiatives form part of a broader update of the instruments governing the ANPD’s activities, covering both how the Agency monitors compliance, conducts enforcement activities and pursues sanctioning proceedings, and the procedures it uses to develop and review its own regulations.
Further information on the public consultations is available on the Brasil Participativo platform.
ANPD does not approve Guidance on high-risk personal data processing
In September 2026, the Board of Directors of the Brazilian National Data Protection Agency unanimously decided not to approve the Guidance on High-Risk Personal Data Processing, which was intended to assist processing agents in identifying high-risk processing activities under the Regulation on the application of the Brazilian General Data Protection Law (“LGPD”) to small processing agents, approved by ANPD Board Resolution No. 2/2022.
The draft proposed parameters for applying the general and specific criteria established in the Regulation, taking into account factors such as large-scale processing, the potential impact on data subjects’ rights, the use of emerging or innovative technologies, automated decision-making, surveillance of publicly accessible areas, and the processing of sensitive personal data or personal data relating to children, adolescents and older persons.
In reviewing the proposal, the Board considered, among other matters, that the methodology proposed for assessing large-scale processing would be overly complex, particularly for small processing agents, and that issuing standalone guidance on high-risk processing could lead to a fragmented approach to data protection risk management.
The draft was archived, although its content may be used in future initiatives. The ANPD indicated that the topic may instead be addressed in an integrated manner as part of the discussions on Data Protection Impact Assessments (“DPIAs”) contemplated in the 2025-2026 Regulatory Agenda.
Further information on the decision is available here.
“AI companions” draw regulatory and legislative attention in connection with the protection of children and adolescents
In September 2026, so-called AI companions – artificial intelligence applications designed to simulate friendship, companionship or emotional relationships with users – became the subject of new initiatives focused on the protection of children and adolescents in the digital environment.
On September 22, 2026, the National Secretariat for Digital Rights (“Sedigi”), part of the Ministry of Justice and Public Security (“MJSP”), released a technical note identifying risks associated with the use of these tools by children and adolescents, including exposure to inappropriate content, the development of excessive emotional attachment and improper processing of personal data. The document also addresses advertising, monetization and profiling practices and assesses these services in light of the rules established by the Digital Statute for Children and Adolescents (“ECA Digital”).
From a legislative perspective, Bill No. 5,349/2026 (“Bill No. 5,349/2026”) was introduced before the Brazilian Chamber of Deputies on September 11, 2026. The Bill proposes amendments to ECA Digital and the Marco Civil da Internet to establish measures to prevent and mitigate risks associated with applications, content, products or interactive practices that simulate emotional relationships.
The initiatives reflect increasing regulatory attention to the application of safeguards for children and adolescents to AI-based services, particularly those designed to foster personalized and continuous interactions with users.
Read the MJSP technical note at this link and follow the legislative process for the Bill here.
On September 1, 2026, Bill No. 5,271/2026 (“Bill No. 5,271/2026”) was introduced before the Brazilian Chamber of Deputies, proposing amendments to ECA Digital to prohibit children under 16 from registering for or accessing social media platforms.
The proposal also provides for awareness campaigns on the risks associated with early use of these platforms and forms part of the broader discussion regarding protective measures applicable to children’s and adolescents’ access to digital services, including age assurance mechanisms.
Bill No. 5,271/2026 is at an early stage of the legislative process before the Chamber of Deputies, and its provisions may therefore be amended as the proposal moves forward.
Follow the legislative process here.
In September 2026, Bill No. 1,636/2026 (“Bill No. 1,636/2026”), which proposes rules for job advertisements on digital platforms with a focus on transparency and the prevention of fraud and recruitment practices associated with human trafficking, advanced in the Brazilian Chamber of Deputies.
The proposal applies to websites, applications and social media platforms with more than one million monthly active users in Brazil. Among other measures, it provides for a specific category for job advertisements, disclosure of information regarding advertisers and the parameters used to target advertisements, and mechanisms to identify postings showing indications of recruitment for unlawful purposes.
The Bill also prohibits targeting job advertisements based on criteria such as gender, race, age and disability, and requires human review of advertisements flagged as suspicious by automated systems.
In September, a rapporteur was appointed for the proposal before the Committee on Foreign Affairs and National Defense and the period for submission of amendments was opened. Bill No. 1,636/2026 remains under consideration by the Chamber of Deputies.
Follow the legislative process here.
Bill proposes measures to protect older persons in the digital environment
On September 29, 2026, Bill No. 5,497/2026 (“Bill No. 5,497/2026”) was introduced before the Brazilian Federal Senate, proposing amendments to the Consumer Protection Code and the Statute of Older Persons to strengthen the protection of older persons when using digital services.
Among the contemplated measures are accessibility and plain-language requirements, additional confirmation mechanisms for certain transactions, and measures aimed at preventing and challenging fraud involving financial and payment services.
From a data protection perspective, the proposal prohibits the use of older persons’ data to create profiles for targeted advertising and provides for digital education initiatives concerning data protection and fraud identification.
Bill No. 5,497/2026 is at an early stage of the legislative process before the Federal Senate, and its provisions may therefore be amended as the proposal moves forward.
Follow the legislative process here.
This content is part of the Telecommunications Alert for September 2026, bringing together the main sector highlights of the period. We emphasize that this material is for informational purposes only. Our team is available to provide more information on these and other topics.
