The Digital ECA: Brazil’s New Age Verification Framework and Enforcement Timeline
In March 2026, the Brazilian legal landscape for children’s privacy underwent a transformative shift with the entry into force of Law No. 15,211/2025, popularly known as the Digital ECA. This legislation serves as a modern extension of the Statute of the Child and Adolescent (ECA), a landmark federal law from 1990 that established the principle of "absolute priority" for the rights of minors in Brazil. Supplemented by Decree No. 12,880/2026, this new framework creates a specific regulatory layer on top of the General Data Protection Law (LGPD), Brazil’s comprehensive privacy regime which was heavily inspired by the European GDPR.
The National Data Protection Authority (ANPD), the federal body responsible for enforcing the LGPD and overseeing data privacy nationwide, has recently published preliminary guidelines to ensure legal certainty during this transition. The core of the regulation focuses on the adoption of "reliable age verification mechanisms" for any information technology provider whose products are either directed at or likely to be accessed by minors. The Authority’s position is that the implementation of these tools must be technically robust while remaining strictly compatible with the constitutional rights to privacy and personal data protection.
An essential element of the current legal environment is the ANPD’s specific enforcement roadmap for 2026. The first stage, which began in March 2026, prioritizes the monitoring of app stores and proprietary operating systems. The ANPD views these players as structural gatekeepers capable of implementing age assurance and parental supervision at the device level, allowing for a broad and transversal impact across the digital ecosystem. By focusing on this concentrated market, the legal system aims to produce immediate systemic effects, ensuring that protection is embedded into the very infrastructure of digital services.
Furthermore, the implementation of these age verification solutions is intrinsically linked to the ANPD's broader 2025–2026 Regulatory Agenda. The Authority intends to detail the principles provided in the Decree through specific regulations or technical guides, aiming to clarify ambiguities regarding the scope of obligations for different technology providers. This includes a rigorous call for evidence and technical contributions from society to refine the interpretation of the Law, ensuring that the legal burden is proportionate to the risk level of each digital product or service.
The evolution of this legal framework continues with a second stage of enforcement scheduled to begin in August 2026. Following a period of public consultation and the publication of definitive guidelines, the monitoring will expand to other sectors based on the risk level identified in earlier assessments. This phase includes a formal transition period between August and November 2026 to allow for the maturation of technical solutions before the updated Regulations on Inspection and Administrative Sanctions are fully applied later in the year.
Ultimately, the Digital ECA signifies that Brazil is moving toward a highly specialized and mature legal environment regarding online safety. The integration of mandatory verification solutions and the structured audit timeline indicate that "Safety by Design" has transitioned from a theoretical recommendation to a statutory requirement. This systemic shift reflects a commitment to harmonizing technological innovation with the robust protective traditions of Brazilian law, ensuring that the digital economy develops in a manner that respects the fundamental rights of children and adolescents as a core priority of the State.
Article provided by INPLP member: Fábio Lacaz (ALV Advogados, Brazil)
Discover more about the INPLP and the INPLP-Members
Dr. Tobias Höllwarth (Managing Director INPLP)l