Enforcement of Brazil’s ECA Digital introduces new obligations for companies

March 17, 2026 marks the end of the grace period for Law No. 15,211/2025, Brazil’s Digital Statute for Children and Adolescents ("ECA Digital"). The law establishes a comprehensive regulatory framework for protecting children and adolescents ("minors") in digital environments and applies broadly to companies operating in the digital services and technology sector . Its obligations are based on the level of risk that a service or product may pose to minors.

The ECA Digital introduces new requirements across several areas, including data protection, parental supervision, advertising and commercial practices, and content moderation and control. In addition, the expansive definition of "probable access by minors" significantly broadens the scope of regulated entities and requires companies to conduct proper risk assessments of their digital products and services.

The new regulatory framework will be supervised by the National Data Protection Agency ("ANPD"), which implemented monitoring measures even before the law came into force. Given this heightened scrutiny, companies operating in Brazil’s digital ecosystem should assess how the ECA Digital affect their activities and whether any measures should be taken for compliance.

I. Scope

The ECA Digital applies to any and all providers of products or services targeted at minors or likely to be accessed by minors. "Probable access" by minors exists where:

• There is a sufficient probability that the product or service is attractive to minors;
• Minors can access it with relative ease; and
• The product or service presents a significant risk to the privacy, safety, or biopsychosocial development of minors.

In practice, this concept of "probable access" is open to interpretation – including whether the above requirements are cumulative – which considerably expands the law’s reach. Thus, while the main regulated entities are social networks, messaging apps, streaming platforms, and electronic games, the ECA Digital also applies to:

• marketplaces;
• payment institutions;
• virtual advertising platforms;
• health, exam, and wellness-related applications;
• other websites, applications, and content platforms that can be accessed by minors.

The law applies to both domestic and foreign providers, if their services and products are made available in Brazil.

Since the second half of 2025, the ANPD has been monitoring 37 companies identified as having an important, direct, and continuous influence on minors in Brazil, whether through targeted audiovisual content, interactive platforms, or the sale of technological devices that serve as gateways to the digital ecosystem .

II. Why Worry about ECA Digital?

Non-compliance with the provisions of the ECA Digital may result in significant penalties, including:

• Warnings;
• Fines of up to 10% of the economic group's revenue generated in Brazil in the preceding fiscal year;
• Temporary suspension of activities; and
• Prohibition from operating in Brazilian territory.

Notwithstanding the relevance of the sanctioning regime, the ANPD's has signaled a responsive enforcement approach, prioritizing regulatory dialogue and compliance incentives, particularly during this initial transition period, before applying more severe sanctions.

In addition to the regulatory landscape, compliance with the ECA Digital is particularly relevant from a reputational and business perspective. Noncompliance may directly impact M&A transactions, due diligence processes, and company valuation. In this context, potential investors and acquirers will likely assess ECA Digital compliance as part of their risk evaluation.

III. Key Obligations

Companies subject to the ECA Digital must implement a range of new obligations, including:

• Reliable age verification mechanisms, with mere self-declaration being expressly prohibited;
• Mandatory linkage of accounts belonging to users under 16 years of age to a legal guardian;
• Provision of parental supervision tools;
• Adoption of privacy settings in the most protective model by default (privacy by default);
• Prohibition of profiling minors for advertising purposes;
• Prohibition of manipulative design practices, such as features that encourage compulsive use;
• Impact assessments which address the rights of minors, including the use of emotional analysis, augmented reality, extended reality, and virtual reality technologies;
• Biannual transparency reports for providers with more than one million minor users; and
• Moderation, removal, and reporting of unlawful content.

IV. Legal Representation

Foreign companies subject to the ECA Digital must appoint a legal representative in Brazil to receive service of process, summonses, and notifications in connection with lawsuits and administrative proceedings, and to respond to Brazilian authorities.

Both domestic and foreign providers should engage in proactive legal planning to ensure compliance. Proper legal counsel is especially recommended for the preparation and publication of biannual transparency reports – mandatory for providers with more than one million minor users – and for the moderation, removal, and reporting of unlawful content to competent authorities.

V. Decrees and preliminary guidelines

On March 18, 2026, the Federal Government published, in an extra edition of the Official Gazette of the Union, three decrees regulating the ECA Digital:

• Decree No. 12,880/2026: The main regulatory instrument of the ECA Digital, detailing the obligations of providers relating to prevention, protection, age assessment, inappropriate and prohibited content, parental supervision, and advertising;
• Decree No. 12,881/2026: Establishes the new organizational structure of the ANPD as an autonomous regulatory agency (effective April 8, 2026);
• Decree No. 12,882/2026: Creates the National Notification Screening Center, linked to the Federal Police, to centralize and forward reports of criminal content involving minors.

Decree No. 12,880/2026, the most extensive of the three decrees, comprehensively regulates the ECA Digital, addressing:

• Age verification requirements for games with loot boxes or the obligation to offer versions without such features to minors;
• Creation of the National Policy for the Protection of Children and Adolescents in the Digital Environment;
• Transparency obligations for generative AI providers and algorithmic risk assessments;
• Distinction between "age assessment" and "age verification", with technical requirements to be defined by the ANPD;
• Prohibition on the use of age verification data for other purposes; and
• Regulation of "child influencers", with the requirement of prior judicial authorization for monetization.

Some obligations introduced by Decree No. 12,880/2026 are not included in the text of the ECA Digital. Therefore, regulated companies should assess which provisions apply to their activities on a case-by-case basis.

Alongside the decrees, the ANPD launched an ECA Digital webpage, and on March 20, 2026, published the Preliminary Guidelines on Reliable Age Assessment Mechanisms. These guidelines reflect the ANPD’s institutional position and will serve as a reference for its monitoring activities until final guidance is issued under the 2025-2026 Regulatory Agenda. The guidelines outline six main principles:

• Proportionality: A risk-based approach balancing accuracy of measurement and protection of users' rights;
• Accuracy, robustness, and reliability: Precise, fraud-resistant mechanisms that are verifiable under real conditions, with self-declaration being insufficient as a standalone method;
• Privacy and protection of personal data: Data minimization, prohibition of secondary use, traceability and unrestricted sharing;
• Inclusion and non-discrimination: Consideration of Brazilian socioeconomic diversity and prevention of discriminatory biases;
• Transparency and auditability: Clear information about the functioning of the mechanism, dispute channels and audit records; and
• Interoperability: Adoption of standardized protocols and secure APIs, transmitting only the strictly necessary age attribute.

VI. Implementation and Enforcement Schedule

The ANPD’s ECA Digital webpage also outlines the implementation and enforcement schedule. The first stage of monitoring by the ANPD begins immediately, focusing on app stores and proprietary operating systems. Following publication of the ANPD’s final guidelines in August 2026, the second stage will begin, which will expand monitoring to other sectors and groups of providers, based on product and service risk levels.

According to the schedule, administrative sanctions are scheduled to begin in November 2026, with formal enforcement activities to verify compliance with the ECA Digital beginning in January 2027. Regulated companies should therefore pay attention to these dates to ensure the timely adaptation of their products and services to the new legal requirements.

VII. Conclusion

Although fully in force, the ECA Digital still has several regulatory elements under development. With preliminary guidelines published and a phased implementation schedule underway, 2026 will likely function as a regulatory transition period for companies adapting to the new framework.

Companies affected by the provisions should adopt a risk-based compliance strategy and demonstrate good faith efforts toward implementation. These steps, along with the ability to demonstrate a proactive and collaborative posture with enforcement authorities, will help mitigate enforcement risks and protect both business operations and reputation. Global companies may rely on existing frameworks for minors’ safety and implement any targeted changes needed to comply with Brazilian-specific rules.

*This content was produced in partnership with Mayer Brown partners Amber Thomson and Ana Bruder, as well as Ana Leticia Allevato of Tauil & Chequer Advogados in association with Mayer Brown.

**This content was produced with the participation of law clerk Ana Loiola.