Editor's note: The IAPP is policy neutral. We publish contributed opinion and analysis pieces to enable our members to hear a broad spectrum of views in our domains.
On 27 Aug., Brazil's Federal Senate approved Bill 2628/2022, establishing safeguards for children and adolescents in digital environments. If enacted, the law would be among the first Brazilian rules to regulate digital platforms — bringing new privacy and data protection requirements with several operational impacts for social networks, app stores, video games and other businesses.
With the legislation, Brazil would join a growing group of countries and regions that have a dedicated legal framework for processing minors' data.
Following the Senate approval, the measure moves to the president for signature or veto, with expectations of a swift outcome. The law would take effect one year after its official publication.
The proposal has become known as the "Digital ECA," a reference to the Portuguese acronym for Brazil's Statute of the Child and Adolescent. While the Digital ECA has been before the National Congress since 2022, it only gained momentum in August 2025 after Brazilian influencer Felipe "Felca" Bressanim publicly exposed cases of the adultification of minors online.
Beyond the political process, the Digital ECA carries strategic social impact for Brazil, which ranks second worldwide in daily average screen time and fifth in social media use.
Scope of application: Who must comply?
The Digital ECA would apply to any provider of tech-related products or services that are "directed to" or "likely to be accessed" by children — defined as individuals under 12 years of age — and adolescents — defined as individuals between the ages of 12-18 — in Brazil. The definitions are set out in Brazil's Statute of the Child and Adolescent.
The notion of a tech-related provider is broad and extends from app stores, online applications and electronic games to software and operating systems.
Under the bill, a product or service would be considered of likely access where there is a sufficiently high probability of use and appeal to minors, a considerable ease of access and use, and a significant degree of risk to the user's privacy, safety or biopsychosocial development.
The bill would apply regardless of the provider's location, making it relevant to foreign companies with a market in Brazil. Such companies would be required to appoint a legal representative in Brazil empowered to respond to and assume responsibilities before Brazilian public authorities.
From profiling to parental controls: Key privacy shifts
The new rules would expand the privacy and data protection landscape established by Brazil's General Data Protection Law.
One of the bill's most consequential provisions is the prohibition on using profiling techniques and immersive technologies to target advertising to minors. Secondary guidelines, such as the National Council for the Rights of Children and Adolescents' Resolution No. 245/2024, already prohibit behavioral advertising directed at minors in Brazil but have seen limited adherence and enforcement. Elevating that prohibition to federal law is expected to bring greater attention.
The Digital ECA would also require providers of tech-related services or products to adopt mechanisms to prevent minors from accessing content inappropriate for their age group, including age-assurance measures. One element of this obligation will be receiving an "age signals" from app stores via application programming interfaces. Adult-only services, such as pornographic material or alcohol sales, would face even stricter obligations — with self-declaration expressly excluded as a valid age-assurance method.
Privacy by default and privacy by design are also incorporated into the Digital ECA. Providers would need to embed parental supervision tools configured to the most protective settings for minors, with reinforced transparency if less protective options are enabled.
At a minimum, these parental supervision tools would need to enable restrictions on communication with unauthorized users, time spent in applications, personalized recommendation systems, geolocation sharing, nonessential AI tools, in‑app purchases and financial transactions, among others.
Age assurance and parental supervision mechanisms would need to comply, at all times, with the LGPD principles of data minimization, transparency and purpose limitation to prevent excessive processing, power asymmetries, intrusive monitoring and function creep.
The Digital ECA would also make a data protection impact assessment mandatory when data of children and adolescents' is processed and set additional governance and accountability requirements.
Oversight and sanctions under the Digital ECA
Oversight and sanctions for violations of the Digital ECA would be handled by an independent administrative authority dedicated to protecting children and adolescent rights in the digital environment.
This authority, yet to be designated, may issue warnings or impose fines. Fines can reach up to 10% of the economic group's revenue in Brazil, capped at BRL 50 million per violation. If the company has no revenue in Brazil, the fine would be calculated based on the number of registered users.
In extreme cases, the Digital ECA also authorizes the Judiciary to temporarily suspend a company's activities or prohibit it from operating in Brazil.
Other Brazilian authorities may act within their respective areas, including the Public Prosecutor's Office and consumer protection agencies. Notably, Brazil's National Data Protection Authority has included this topic in its regulatory agenda and, in recent years, has investigated the processing practices of certain companies involving children's and adolescents' data.
By elevating child protection to federal law, Brazil starts moving from fragmented safeguards to a coherent legal order, placing children at the center of digital governance.
Fernando Bousso, CIPP/E, CIPM, CDPO/BR, FIP, is a partner and head of technology, AI, privacy and data protection at Baptista Luz Advogados. Matheus Botsman Kasputis is an associate attorney at Baptista Luz Advogados.
