On September 17, 2025, Law No. 15.211/2025, known as the Brazilian Statute for the Protection of Children and Adolescents Online (commonly referred to in Portuguese as “ECA Digital”), was enacted. This new law establishes that information technology products and services must adopt effective measures to protect children and adolescents from illegal or age-inappropriate content, strengthening parental controls, age verification mechanisms, and prompt responses to complaints.

The law also imposes clearer obligations to remove content that violates the rights of minors, including without a court order when notified by victims, legal representatives, the Public Prosecutor’s Office, or child protection entities. In addition, it requires that minors’ accounts on digital platforms be linked to a legal guardian and provides for fines of up to fifty million reais, as well as stricter sanctions in cases of repeated non-compliance.

For technology companies, social media networks, and digital platforms, the new statute represents a new level of regulatory compliance. It will be necessary to review content moderation policies, privacy policies, reporting and parental control mechanisms, as well as implement technical systems for age verification and appropriate filters. For parents and guardians, the expectation is greater safety and transparency regarding how platforms operate with respect to minors, reducing premature exposure to offensive or manipulative content.

The law also has a strong connection with the Brazilian General Data Protection Law (“LGPD”), especially regarding the processing of personal data of children and adolescents. In this respect, the new law does not alter the rules already established by the LGPD, but greater oversight of the processing of minors’ data by the National Data Protection Authority (“ANPD”) is expected. Another aspect worth highlighting, which clearly illustrates the intersection between the LGPD and the new online child protection statute, is the role of the ANPD. Under Decree No. 12,622, issued on the same date, the ANPD has become an autonomous administrative authority responsible for the protection of children and adolescents in digital environments.

The law will come into force 6 months after its publication (according to Provisional Measure No. 1,319/2025). Although it already defines core obligations, further details will still need to be regulated or specified in complementary norms. Companies will need to closely follow the guidance to be issued in order to adapt their processes and technologies, aligning these new requirements with other national and international data protection and internet regulation laws.

We will continue to closely monitor all updates and regulations related to this new statute and remain at our clients’ disposal to support their adaptation to the new guidelines, contributing to increasingly responsible, secure, and market-aligned practices.