Digital ECA: new legal framework for the protection of children and adolescents in the digital environment will enter into force in March

 

The Digital Child and Adolescent Statute (Law No. 15,211), known as “Digital ECA”, was enacted in the second half of 2025, establishing a new regulatory framework aimed at strengthening the protection of children and adolescents in the digital environment as of March 2026. This law sets forth specific rules and obligations for providers of information technology products and services directed at – or potentially accessed by – children and adolescents in Brazil, regardless of their location.

The Digital ECA directly affects digital platforms, social media networks, electronic games, app stores, software companies, computer programs, and the entire digital advertising market more generally.

With a preventive and structural approach, based on the best interests of the child and the adolescent, the Digital ECA requires robust measures regarding security, privacy, and the processing of personal data, such as:

~ Implementation of effective age-verification mechanisms (self-declaration being prohibited);

~ Parental supervision tools;

~ Content moderation and notification mechanisms for violations;

~ Linkage of user accounts held by individuals under 16 years of age to a legal guardian;

Restrictions on digital advertising, including a prohibition on profiling techniques to target commercial advertising to children and adolescents;

~ Preparation of transparency and accountability reports (for providers with more than 1 million child and adolescent users);

~ Obligation to report unlawful content to competent authorities and to prevent access to content that is improper, inappropriate, or prohibited by law;

~ Requirement that foreign providers appoint a legal representative in Brazil.

In the electronic games sector, the law expressly prohibits the use of reward boxes (“loot boxes”) in games directed at or likely to be accessed by minors, in addition to requiring enhanced safeguards for games that enable user interaction, particularly with respect to content moderation and protection against improper contacts.

The National Data Protection Agency (“ANPD”) has been designated as the competent administrative authority to oversee, regulate, and supervise compliance with the Digital ECA, as well as to impose sanctions in the event of non-compliance. In January of this year, the Authority launched a monitoring process focusing on 37 companies whose products and services are likely to be accessed by children and adolescents – selected based on their relevance and influence over this audience. The purpose is to map the initiatives already implemented for compliance with the new law. Companies must submit, by February 13, detailed information on the technical and organizational measures adopted to date for implementation of the law.

This movement reflects an active regulatory posture by the ANPD and signals the expectation that companies should begin their compliance processes promptly, considering the technical, operational, and governance complexity involved in meeting the new obligations.

The non-compliance with the provisions of the Digital ECA may result in the imposition of administrative sanctions, including warnings with deadlines for corrective measures, fines of up to 10% of the economic group’s revenue in Brazil, as well as temporary suspension or even prohibition of activities related to non-compliant products or services.

In case of any doubts about this subject, please do not hesitate to contact us.