Brazil's ECA Digital Is in Force: Age Checks and Parent Accounts

Typing a fake birthday into a sign-up box no longer counts as an age check in Brazil. Since March 17, 2026, the ECA Digital Brazil passed in 2025 (Law 15.211, the Digital Statute of Children and Adolescents) has required apps, games and social networks that kids are likely to use to verify age by some method other than self-declaration, to link the accounts of users up to age 16 to a parent’s account, to switch on the most protective settings by default, and to stop profiling minors for advertising. Loot boxes are banned in games kids can reach.

It is the most ambitious child-online law in the Americas. It is also not finished. The regulator is still writing the rulebook, sanction rules are being updated from November 2026, and formal enforcement starts in January 2027. Here is what the law says, what has happened in its first seven months, and what it means for a family in São Paulo or one in Texas.

Key Takeaways

• Self-declared age is not enough. Article 12 and the regulator’s guidance require “reliable” age assurance, and the job starts with app stores and phone operating systems.
• Kids up to 16 need a linked parent account on services aimed at or likely to be used by minors (Article 24).
• Protective defaults are mandatory: no contact from unauthorized users, limits on autoplay and time-on-app rewards, control over recommendations, and location sharing off.
• Fines reach 10% of a company’s Brazilian revenue, or up to R$50 million per violation when revenue cannot be used. Suspensions and bans require a court.
• Enforcement is phased. Monitoring began in 2025, sanction rules are being updated from November 2026, and full enforcement starts January 2027. Families outside Brazil get none of these rights automatically.

What the ECA Digital is, and when it took effect

The ECA Digital is a Brazilian federal law that sets safety, privacy and design duties for any digital product or service “directed to children and adolescents or likely to be accessed by them.” It was signed on September 17, 2025, and entered into force on March 17, 2026, according to the official text on the Brazilian legislative portal. Three implementing decrees followed on March 18, 2026, the most important being Decree 12.880, which details age assessment, parental supervision and advertising rules.

The enforcer is the ANPD, Brazil’s national data protection agency, which was converted into an autonomous regulatory agency in February 2026 partly to take on this job. The ANPD’s ECA Digital page publishes the timeline, the guidance documents and a complaints channel.

“Likely to be accessed” is the phrase that gives the law its reach. A company cannot escape by writing “18+” in its terms. The ANPD’s guide published on October 28, 2026 says the three tests in Article 1 are weighed together: is the service attractive to minors, is it easy for them to get into, and does it pose significant risks to their privacy, safety or development? “An app may claim its audience is exclusively adults but present videos, visuals, games, rewards or interaction features that attract teenagers,” ANPD director Lorena Giuberti Coutinho said in the agency’s announcement of that guide. Social networks, app stores and operating systems are treated as likely-accessed by default.

The law also applies to foreign companies whose services are available in Brazil, and it requires them to keep a legal representative in the country (Article 40).

What the law requires platforms to do

Reading the statute itself, rather than summaries, the core duties fall into six groups.

Age assurance. App stores and operating systems must take “proportional, auditable and technically secure” steps to determine a user’s age or age range (Article 12). Downloads by children and teens depend on a parent’s free and informed consent, and the law forbids presuming consent when a parent simply says nothing.

Parent-linked accounts. Article 24 requires that accounts of children and adolescents “up to 16 years of age” be linked to the account of a legal guardian. Where a social network says its service is not suitable for minors, it must say so clearly, limit content obviously designed to attract kids, and keep improving its age checks. Accounts with “well-founded signs” of being run by an underage child must be suspended, with a fast appeal process for the parent.

Parental tools that actually do things. Article 18 lists what supervision tools must let a parent do: see and manage the child’s account and privacy settings, restrict purchases, identify the adult profiles the child talks to, see total time-of-use figures, and switch safeguards on and off, with information in Portuguese. Companies may not design interfaces that nudge families into weakening those safeguards.

Protective defaults. Article 17 sets the floor for default settings: contact from unauthorized users restricted, features that “artificially extend” use (autoplay, rewards for time spent, notifications) limited, recommendation systems controllable and switchable off, and geolocation sharing restricted. It also calls for regular expert review of AI features, with the option to turn off non-essential ones.

Commercial limits. Profiling children to target ads is banned, as is using emotional analysis or augmented and virtual reality for that purpose (Articles 22 and 26). Loot boxes are banned in games directed at or likely accessed by minors (Article 20), a rule big enough that it gets its own article in this series.

Removal and reporting. Platforms must remove and report apparent child sexual exploitation, abuse, kidnapping and grooming content, and must take down content that violates children’s rights once the victim, a parent, prosecutors or a child-rights group flags it, without waiting for a court order (Articles 27 and 29). Services with more than one million registered users under 18 must publish a transparency report in Portuguese every six months (Article 31). The first ones were due September 17, 2026.

How age checks work under the law

This is the part most coverage skips, and it is the part that decides whether the law works.

The law makes a distinction that engineers will recognize. Age assessment means estimating that someone is probably in an age band. Age verification means confirming it against something like an ID. Decree 12.880 keeps the two separate and leaves the technical standards to the ANPD. Either way, the design target is an age signal: the operating system or app store works out the user’s age range once, then passes only that range (for example, “13 to 15”) to apps through a secure API. Article 12 says that signal must follow data minimization and forbids “continuous, automated and unrestricted” sharing of kids’ data. Article 13 says data collected to check age may be used only for that purpose.

Why start with Apple, Google and Microsoft? Because almost every child’s app passes through a phone’s operating system or an app store. The ANPD said so directly: market concentration means acting on a few companies affects most of the services children use. On June 10, 2026, the agency opened monitoring of the App Store, Google Play and Windows, giving the companies 15 business days to send documentation on system architecture, data flows and age-assessment mechanisms.

The ANPD’s March 20, 2026 preliminary guidelines set six principles for these systems, summarized by the law firm Mayer Brown: proportionality, accuracy and fraud resistance, privacy and data minimization, inclusion of Brazil’s socioeconomic diversity, transparency with a way to dispute a result, and interoperability so only the age attribute travels.

That inclusion principle matters more than it sounds. Face-based age estimation can be less accurate for some groups, and many Brazilian kids share a parent’s phone or use prepaid data. A check that fails a 15-year-old in Manaus but passes one in Curitiba would break the law’s own rules.

If you want the general mechanics of age estimation and why kids get around it, our explainer on how online age verification works and why kids lie to platforms covers it.

What has happened in the first seven months

Enforcement has been gradual, but it is not zero. The ANPD’s one-year review, published September 16, 2026, lists what it had done so far:

• A complaints channel opened in early June and had received about 200 reports, most about missing safeguards against inappropriate content.
• Monitoring of app stores and operating systems, and separately of pornography sites, both due to finish by the end of 2026.
• Two more monitoring actions opened in August covering major platforms, app stores and generative AI tools. Brazilian outlet SBT News reported that these include Instagram, WhatsApp, Facebook and Meta AI; a separate article in this series looks at what that means.
• A formal investigation into Discord opened in August over alleged failures to protect under-18s from content encouraging self-harm and suicide, weak age checks and failures to remove content. As a preventive measure, the ANPD ordered Discord to suspend live streaming in Brazil and kept the order in place after Discord appealed. These are the agency’s allegations; the case was still open.

ECA Digital compared with US, Australian and Brazilian rules

The law is often compared to Australia’s under-16 social media ban and to the US federal privacy law, COPPA. They solve different problems.

	Brazil: ECA Digital	US: COPPA (federal)	Australia: social media minimum age
Ages covered	Under 18; parent-linked accounts up to 16	Under 13	Under 16
Main idea	Safety and design duties across apps, games and social media	Parental consent before collecting a child’s data	Platforms must keep under-16s from holding accounts
Self-declared age	Not enough	Allowed for general-audience sites without “actual knowledge”	Platforms must take “reasonable steps”
Default settings	Most protective by law	Not regulated	Not the focus
Loot boxes	Banned for minors’ games	Not covered	Not covered
Ad profiling of kids	Banned	Needs parental consent	Not the focus
Top penalty	10% of Brazilian revenue, or up to R$50 million per violation; court can suspend	Civil penalties per violation	Up to AUD 109.2 million per court order
Who enforces	ANPD (fines); courts (suspension)	FTC and state attorneys general	eSafety Commissioner and courts

Sources: Law 15.211/2025; the FTC’s COPPA FAQ; Australia’s eSafety Commissioner.

The table makes one thing plain. Australia’s law is a door: under 16, you do not get in. Brazil’s is a building code: you can come in, but the building has to be safer inside. Neither approach has a long record yet, so anyone who tells you which one works better is guessing.

What families can do now

Do the linking yourself, early

If you live in Brazil, expect apps your child uses to ask for a guardian account. Set it up together, at the kitchen table, rather than letting a 14-year-old click through alone. Look at what the linked view actually shows you: Article 18 says it must include adult contacts and time-of-use totals. If a service shows less, that is the kind of gap the ANPD’s complaints system exists for.

Check that the defaults stayed on

The law makes protective settings the default, not permanent. A teen can still ask to change things, and the law only blocks lowering protection below the default when no parent account exists. Once a month, open the settings with your child and check contact permissions, location sharing and recommendations.

Give honest birthdays

A truthful birth date is now the input to every protection the law offers. A child registered as 18 gets none of them. The same is true outside Brazil.

Report through the right door

The ANPD handles non-compliance: missing age checks, weak parental tools, compulsive-use design, excessive data collection. It does not investigate crimes. The agency’s own complaints page says abuse, grooming and sexual images of children go to the platform’s report button and to Disque 100 or the Federal Police’s Comunica PF. Wrong age ratings go to the Justice Ministry’s ombudsman.

What not to do: treat the law as a babysitter

The ANPD itself frames the law as shared responsibility, meaning companies now carry part of the load. Part, not all. A parent-linked account does not tell you what your child is feeling, and no age signal stops a friend’s phone. The conversations still have to happen.

What to Watch For Over the Next 3 Months

• Week 4: Updated ANPD rules on inspections and administrative sanctions are scheduled from November 2026. Look for the dosimetry regulation, which sets how fines are calculated; its public consultation runs until November 30.
• Month 2 red flags: Apps your child uses that still accept a typed birthday with no other check, or a “parent account” that shows nothing useful. Both are reportable in Brazil.
• Month 3 self-check: Formal enforcement begins in January 2027. Can you name which of your child’s apps are linked to you, and what each one lets you see?

Frequently Asked Questions

Does the ECA Digital ban social media for kids under 16?

No. Unlike Australia, Brazil does not set a blanket minimum age for social media. It requires that accounts of users up to 16 be linked to a parent’s account on services likely used by minors, and that age be checked by a method other than self-declaration. Platforms that say they are adults-only must suspend accounts with strong signs of underage use.

When do companies start paying fines?

The law has applied since March 17, 2026, but the ANPD chose a phased approach. Updated sanction regulations are scheduled from November 2026, and formal enforcement actions from January 2027. The agency has already used preventive measures, such as ordering Discord to suspend live streaming in Brazil in August 2026.

Does the law apply to families outside Brazil?

Only if they live in Brazil. Protections depend on where the user is, not the company’s nationality. A family in Mexico or the United States gets none of these rights, though global companies sometimes roll a Brazil-driven feature out more widely. Check each app’s settings rather than assuming.

Will my child have to scan their face or upload an ID?

Not necessarily. The law asks for reliable, proportional methods and leaves the choice to companies under ANPD guidance. Many will rely on an age signal from the phone’s operating system or app store. Any data collected for age checks may be used only for that purpose under Article 13.

Where do I report a problem in Brazil?

For an app that ignores the law, such as weak age checks or missing parental tools, use the ANPD’s ECA Digital complaints system. For crimes against a child, including sexual images or grooming, report on the platform and to Disque 100 or the Federal Police. The ANPD does not investigate crimes.

---

About the author

Ricky Flores is the founder of HiWave Makers and an electrical engineer with 15+ years of experience building consumer technology at Apple, Samsung, and Texas Instruments. He writes about how kids learn to build, think, and create in a tech-saturated world. Read more at hiwavemakers.com.

---

Sources

1. Brazil. (2025). “Lei nº 15.211, de 17 de setembro de 2025 (Estatuto Digital da Criança e do Adolescente).” Normas.leg.br. https://normas.leg.br/?urn=urn:lex:br:federal:lei:2025-09-17;15211
2. ANPD. (2026). “ECA Digital” (timeline, guidance and complaints). Agência Nacional de Proteção de Dados. https://www.gov.br/anpd/pt-br/assuntos/eca-digital
3. ANPD. (2026, September 16). “ECA Digital completa um ano e é marco na proteção de crianças e adolescentes na internet.” gov.br. https://www.gov.br/anpd/pt-br/assuntos/noticias/eca-digital-completa-um-ano-e-e-marco-na-protecao-de-criancas-e-adolescentes-na-internet
4. ANPD. (2026, June 10). “ANPD inicia monitoramento da adequação de lojas de aplicativos e sistemas operacionais ao ECA Digital.” gov.br. https://www.gov.br/anpd/pt-br/assuntos/noticias/anpd-monitoramento-lojas-de-aplicativos-sistemas-operacionais
5. ANPD. (2026, October 28). “Guia esclarece quem deve cumprir o ECA Digital e quais são as responsabilidades das plataformas.” gov.br. https://www.gov.br/anpd/pt-br/assuntos/noticias/anpd-publica-guia-que-esclarece-quem-deve-cumprir-e-quais-sao-as-responsabilidades-das-plataformas-na-protecao-de-criancas-e-adolescentes
6. ANPD. (2026). “Denúncias – ECA Digital.” gov.br. https://www.gov.br/anpd/pt-br/assuntos/eca-digital/denuncias-eca-digital
7. Thomson, A., Bruder, A., & Allevato, A. L. (2026, April 23). “Enforcement of Brazil’s ECA Digital introduces new obligations for companies.” Mayer Brown. https://www.mayerbrown.com/ja/insights/publications/2026/04/enforcement-of-brazils-eca-digital-introduces-new-obligations-for-companies
8. Federal Trade Commission. (2020, updated). “Complying with COPPA: Frequently Asked Questions.” FTC. https://www.ftc.gov/business-guidance/resources/complying-coppa-frequently-asked-questions
9. eSafety Commissioner. (2026). “Social media age restrictions.” Australian Government. https://www.esafety.gov.au/about-us/industry-regulation/social-media-age-restrictions