#
Statutory protection is strong and rapidly maturing (Digital ECA now in force), but implementing age-verification technical standards remain under active public consultation as of mid-2026.
Sub-modules (5)
Age VerificationAmber
The Digital ECA (Law 15.211/2025), in force since 17 March 2026, requires providers of digital products/services directed at or likely accessed by children/adolescents to implement robust age-verification mechanisms; ANPD's Radar Tecnológico and 2026 public consultations are developing detailed technical guidance.
Claims (3):
- Law No. 15.211/2025, the Digital Child and Adolescent Statute ('Digital ECA'), establishes a substantive framework for protecting children and adolescents in digital environments, with Decree No. 12.881/2026 operationalising preventive measures, risk management and accountability requirements.
- The Digital ECA applies to any product, service, or platform directed to, or likely to be accessed by, children (under 12) and adolescents (12-18) in Brazil.
- ANPD's Radar Tecnológico #5 and a May 2026 call for contributions are developing an Age Verification Mechanisms Guide to implement the Digital ECA, updating preliminary guidelines first published in March 2026.
Parental ConsentAmber
Article 14 requires specific and highlighted parental/guardian consent as the general rule for processing children's data, with statutory exceptions for contacting parents or protecting the child; ANPD's Statement 1/2023 clarified that other LGPD legal bases can apply provided the best interest of the child prevails.
Claims (2):
- Children's personal data may only be processed with specific and highlighted consent from a parent or legal representative, except where collection is necessary to contact the parents/representative, is used a single time without storage, or is for the child's protection.
- ANPD's Statement No. 1/2023 clarified that processing of children's data may rely on any legal basis under the LGPD, provided the best interests of the child prevail in the specific case, moving away from consent as the sole compliance anchor.
Minor Profiling BansAmber
The SGD DPIA guideline recommends a DPIA whenever processing involves children and teenagers, reflecting heightened scrutiny of profiling activities affecting minors rather than an outright statutory profiling ban.
Claims (1):
- The SGD's DPIA guideline recommends a data protection impact assessment whenever processing involves children and teenagers.
Education SettingsRed
No education-sector-specific children's-data provision distinct from the general Digital ECA/LGPD children's-data framework was identified in this research pass.
Dependent AdultsRed
No Brazil-specific statutory provisions for dependent/incapacitated adults distinct from general Civil Code representation rules were identified in this research pass.
Children & Vulnerable Groups
The ANPD's Consulta Pública nº 1/2026, open for comment from 9 September to 26 October 2026, proposes revising the fiscalização and sanctioning regulation specifically to incorporate enforcement of the ECA Digital framework and the provider duties established under Decreto nº 12.975/2026. This is a proposal under public consultation and has not yet become a final rule, but it is understood to reflect the ANPD's intention to align its enforcement architecture with Brazil's child-specific digital-protection regime rather than relying solely on the LGPD's general lawful-processing requirements for children's data.
This consultation-stage development sits alongside the ANPD's September 2026 fine against ByteDance (TikTok), understood to have been imposed specifically for processing children's and adolescents' data without a lawful basis. Read together, the fine and the consultation point in the same direction: a regulator actively using its existing enforcement powers against children's-data violations while simultaneously seeking to formalise and expand those powers for future cases.
Outlook
The consultation closes 26 October 2026. Its outcome will determine whether ECA Digital and Decreto nº 12.975/2026 enforcement become formally incorporated into the ANPD's binding sanctioning regulation, which would give the regulator a more explicit procedural basis for children's-data enforcement actions going forward.
1 earlier distinct update(s)
Children & Vulnerable Groups
ANPD fined ByteDance, operator of TikTok, BRL 153.7 million for violations of the Lei Geral de Protecao de Dados connected to the processing of minors' data. This is understood to be the largest single enforcement figure ANPD has issued to date, and it concentrates specifically on the children's-data area rather than on general LGPD compliance. Alongside the fine, digital platforms that target children are required to publish their first transparency report by 17 September 2026, a new disclosure obligation specific to platforms operating in this space.
The scale of the ByteDance fine, considered against ANPD's historical enforcement record, signals that children's-data processing has become a concentrated area of supervisory attention, consistent with the agency's broader institutional strengthening achieved through Lei 15.352/2026 earlier in the year.
Outlook
The 17 September 2026 transparency-report deadline has, as at this cycle, already passed; whether platforms targeting children in Brazil met that deadline, and how ANPD responds to any that did not, is the immediate development to watch in this area.
1 further periodic run re-emitted the standing brief unchanged and is not shown.
Sources and claims (6)
- ConfirmedIAPP — Law No. 15.211/2025, the Digital Child and Adolescent Statute ('Digital ECA'), establishes a substantive framework for protecting children and adolescents in digital environments, with Decree No. 12.881/2026 operationalising preventive measures, risk management and accountability requirements.observed
- ConfirmedIAPP — The Digital ECA applies to any product, service, or platform directed to, or likely to be accessed by, children (under 12) and adolescents (12-18) in Brazil.observed
- ConfirmedIAPP — ANPD's Radar Tecnológico #5 and a May 2026 call for contributions are developing an Age Verification Mechanisms Guide to implement the Digital ECA, updating preliminary guidelines first published in March 2026.observed
- ConfirmedDataGuidance — Children's personal data may only be processed with specific and highlighted consent from a parent or legal representative, except where collection is necessary to contact the parents/representative, is used a single time without storage, or is for the child's protection.observed
- ConfirmedIAPP — ANPD's Statement No. 1/2023 clarified that processing of children's data may rely on any legal basis under the LGPD, provided the best interests of the child prevail in the specific case, moving away from consent as the sole compliance anchor.observed
- ProbableIAPP — The SGD's DPIA guideline recommends a data protection impact assessment whenever processing involves children and teenagers.observed