Brazil's data protection authority sets out who must comply with the ECA Digital

Brazil's data protection authority sets out who must comply with the ECA Digital

28 October 2026: Brazil's National Data Protection Authority (ANPD) published on Wednesday 28 October a guide for suppliers of information technology products and services on the scope and general obligations of the ECA Digital, the statute that protects children and adolescents online. The guide matters to any company offering apps, platforms, games, app stores, operating systems, messaging or e-commerce in Brazil, including those that say their service is for adults only.

Not yet independently verified. This rests on ANPD's own news release of 28 October 2026. We have not read the full guide, so its tables, examples and flowchart are not covered here. We will update this when it can be confirmed, and remove this note.

Who counts as a supplier

The guide treats as suppliers the companies and others responsible for offering digital products and services such as social networks, apps, app stores, content platforms, electronic games, operating systems, messaging services and e-commerce. A product or service is in scope when it has three characteristics: it is offered at a distance, it works by electronic means, and it is used at the individual request of the user.

The "likely access" test

The central idea is "likely access". The statute covers not only services built for children but also those aimed at a wider audience that children and adolescents are likely to use. The guide says the three criteria in article 1 of the ECA Digital must be read together, always with the best interests of the child in mind, among them how attractive and likely the service is to be used by children and whether it presents significant risks to their privacy, safety or development.

"An app may state that its target audience is exclusively adults, but have videos, visuals, games, rewards or interaction mechanisms that attract adolescents," said ANPD director Lorena Giuberti Coutinho, the rapporteur of the guide. Two points follow. A company's own statement about the age of its users does not decide whether it must comply: ANPD may look at how the product actually works. And age verification does not by itself remove the other obligations; it may be one of the measures needed to meet them. Some categories, including social networks, app stores and operating systems, are treated as likely-access services as a rule.

The duty of prevention

The guide details the duty of prevention: companies cannot wait for a violation before acting. They must identify the risks of their products, assess how likely and severe harm would be, and take measures to avoid or reduce it, then keep reviewing them. ANPD groups the obligations into four dimensions, prevention, protection, information and security. In practice that means more protective privacy settings, age assurance, parental supervision, content moderation and measures against compulsive use. Suppliers must also show that their measures work and, where the law requires, publish transparency reports.

Obligations are scaled to the type of activity, the size of the supplier, the number of users and how far it can shape content and interactions. Operating systems and app stores carry specific duties because they sit between developers and users, such as sending an age signal to apps.

Where it came from and what comes next

The guide was revised after a call for input between April and June 2026 and was previewed at a webinar on 15 October. Lucas Borges, ANPD's superintendent of regulation, who coordinated it, said the authority needs contributions from all sectors for regulation that is "effective, proportionate" and guided by the best interests of children. ANPD is also consulting on the sanctions rules that will back the statute, as we reported. App developers and platforms serving Brazil should read the guide against their own products now, since the authority has said it will judge them on how they work, not on what they claim.

Sources

• ANPD: Guia esclarece quem deve cumprir o ECA Digital e quais sao as responsabilidades das plataformas (28 October 2026), 28 October 2026