Brazil has enacted a major expansion of its landmark child protection legislation.
The reform brings the Estatuto da Criança e do Adolescente the ECA into the digital age with binding new rules for online platforms.
Known as the ECA Digital law, it requires technology companies to take active responsibility for the safety of minors on their services, rather than leaving that burden with parents or users.
The legislation addresses a gap child welfare advocates have flagged for years.
Brazil’s existing protections were written for an offline world, while the country’s youngest citizens now spend significant time on social media, gaming platforms, and digital services built with few safeguards for minors.
Brazil ranks second in the world in daily average screen time, and a 2025 survey found that 92% of children aged 9 to 17 were using the internet with 85% reporting an account on at least one social media platform.
What the Law Requires
The core of the new law formally Law No. 15,211/2025, signed by President Lula on 17 September 2025 places clear obligations on platforms rather than individual users.
Companies must implement proactive content moderation, introduce default safety settings for minors’ accounts, and establish transparent mechanisms for reporting harmful content.
On data privacy, the law requires platforms to obtain verifiable parental consent before collecting personal information from users under 18.
Targeted advertising directed at children is prohibited, along with profiling, emotional analysis, and the use of immersive technologies in ads aimed at minors.
Age verification systems are also required to restrict access to inappropriate content.
Platforms that fail to meet these standards face fines of up to 10% of a company’s Brazilian revenue or R$50 million per violation roughly $9.4 million as well as possible service suspension or permanent bans.
For the largest global platforms, compliance is expected to demand significant investment in moderation infrastructure and dedicated legal teams.
A Global Regulatory Conversation
Brazil’s approach draws on international frameworks, including elements of the European Union’s General Data Protection Regulation and UNICEF’s child protection guidelines, adapting them to Brazil’s existing legal framework.
The law positions Brazil among the more assertive digital regulators in the developing world alongside the EU’s Digital Services Act and the UK and Australia’s Online Safety Acts.
Other emerging markets have been closely tracking Brazil’s legislative process.
Countries across Latin America and Southeast Asia developing their own digital governance frameworks may look to the ECA Digital as a model particularly its emphasis on platform liability rather than individual user responsibility.
That shift reflects a broader change in how governments are thinking about tech regulation.
Challenges Ahead
Enforcement remains the most significant open question. The Brazilian National Data Protection Agency (ANPD) has been designated as the primary regulatory body, with binding rulemaking and oversight authority a meaningful upgrade from its previous advisory role.
Still, applying national rules to global platforms across multiple jurisdictions is a challenge Brazil shares with every other country attempting platform regulation.
Age verification presents its own complications. Robust systems require users to submit personal data raising legitimate concerns about whether the cure introduces new privacy risks.
Separately, critics have noted that the law contains no explicit exemption for end-to-end encrypted services, which could create tension with platforms like WhatsApp.
Their architecture is incompatible with certain content-scanning obligations the law implies.
Supporters of the law argue that the trade-offs are worth making. The framework which came into effect on 17 March 2026 shifts the default assumption.
Instead of children navigating dangerous digital environments with parents as their only line of defence, platforms must now build safety in from the start.
Whether that ambition translates into practice depends on how rigorously the ANPD enforces the new rules.
