Brazil’s National Data Protection Agency (ANPD) has issued new guidance for online providers regarding child protection responsibilities under the Digital Statute for Children and Adolescents (Digital ECA). This document clarifies obligations for adult websites, which are mandated to implement age verification for users located in Brazil.

New Guidance for Digital ECA Compliance

On Wednesday, October 28, 2026, the ANPD published a guide titled “Suppliers of information technology products or services: scope and general obligations of the Digital ECA.” The guide aims to provide practical guidelines, specifying which products and services fall under the Digital ECA and outlining the measures operators must adopt to ensure compliance.

The Digital ECA, also known as Law No. 15,211/2025, took effect on March 17, 2026, and was regulated the following day by Decree No. 12,880/2026. It applies to any information technology product or service that is directed at, or likely to be accessed by, children and adolescents. This applies regardless of where the product or service is developed, offered, or operated. The law’s extraterritorial scope means it applies to all information technology products and services aimed at or likely to be accessed by minors.

For adult content providers, the Digital ECA requires age verification beyond self-declaration. This requirement applies irrespective of the site operator's base location. The ANPD stated in a post announcing the new guide that "The companies responsible for developing and operating digital services must assume responsibilities commensurate with the risks their activities present."

The guide details requirements for covered providers, including the necessity to “document and demonstrate the effectiveness of the measures adopted.” It emphasizes that "Safety is a permanent condition for the responsible operation of the product or service." Providers must demonstrate identification of relevant risks, adoption of compatible controls, and maintenance of a continuous process for reviewing implemented measures.

Scope and Obligations

The Digital ECA’s framework is designed for product design, not solely for data. Its logic aligns with regulations such as the EU Digital Services Act and the UK Online Safety Act, focusing on preventing risk by design. The law’s provisions are governed by the principle of the “best interest of the child,” requiring providers to prioritize the rights, interests, and safety of minors from the design phase and throughout their operations.

A significant portion of the guide addresses how to determine if an online service is covered by the Digital ECA. For adult sites and platforms, this is considered a clear matter. The concept of "likely access" for a technology service or product is a novel standard, composed of three elements: attractiveness, ease of use, and potential risks to minors. Foreign providers are required to appoint a legal representative in Brazil, and their local affiliate is jointly liable for fines.

Key obligations for providers under the Digital ECA include age assurance. Services deemed unsuitable for individuals under 18 must employ reliable age verification at every access, with self-declaration explicitly prohibited. Additionally, app stores and operating systems are mandated to assess age, facilitate parental supervision, and expose a privacy-preserving age signal through a secure API. Age data collected for these purposes may not serve any other function. The law also mandates protective defaults, requiring the most protective privacy settings by default.

Enforcement and Monitoring

The ANPD initiated a complaints page in June, allowing citizens to report potential violations of the Digital ECA, including failures in age verification. The agency also began monitoring 18 high-traffic adult websites to assess their compliance with the Digital ECA.

Direct enforcement actions are not scheduled to commence until January, assuming the ANPD adheres to its previously announced enforcement timeline. This period allows providers to review the new guidance and adjust their operations to meet the outlined requirements.

Key Facts

  • Brazil’s National Data Protection Agency (ANPD) published new guidance for online providers on child protection under the Digital ECA.
  • The Digital Statute for Children and Adolescents (Digital ECA), Law No. 15,211/2025, took effect on March 17, 2026.
  • The Digital ECA mandates age verification beyond self-declaration for adult content providers, regardless of their location.
  • The guide, titled “Suppliers of information technology products or services: scope and general obligations of the Digital ECA,” was published on October 28, 2026.
  • The ANPD launched a complaints page in June and began monitoring 18 high-traffic adult websites for Digital ECA compliance.
  • Direct enforcement actions are scheduled to begin in January.