LGPD & DIGITAL LAW
Digital ECA: what companies, apps and schools must do
In force since March 2026, Brazil's Digital ECA creates duties for anyone offering digital services that children and teenagers use. See who must comply, the obligations, the ANPD timeline and a checklist.
IN 30 SECONDS
- It applies to services aimed at or likely accessed by minors.
- Age assurance, parental supervision and linked under-16 accounts are central.
- Loot boxes are banned in games.
- Fines can reach R$ 50 million per violation.
The Digital ECA (Law 15,211/2025), Brazil’s Digital Statute for Children and Adolescents, has been in force since March 17, 2026. It brings the principle of full protection online: anyone offering digital products and services that children and teenagers use, or are likely to use, now has concrete duties. Enforcement is in the hands of the ANPD, now a regulatory agency.
Who needs to comply
The law covers technology products and services aimed at children and teenagers or likely to be accessed by them, even if they were not designed for them: apps, social networks, video games, app stores, operating systems and, depending on the case, marketplaces, online stores and education platforms. Foreign companies are also covered when the service is available in Brazil.
The main obligations
- Age assurance
Reliable mechanisms proportionate to the risk, collecting only the minimum needed. Pornographic sites and services selling alcohol or cigarettes must verify age. - Accounts of under-16s
On social networks, the account of anyone under 16 must be linked to a parent or guardian’s account. - Parental supervision
Apps and social networks must offer tools for parents and guardians to oversee use. - Age signal
App stores and operating systems must provide apps with a signal of the user’s age range. - Advertising and profiling
There are limits on behavioral advertising and profiling of children and teenagers. - Games
Loot boxes (paid reward boxes with random results) are banned in video games. - Illegal content
Prompt response to illegal content and a ban on monetizing content that depicts minors in a sexualized context.
The ANPD timeline
| When | What |
|---|---|
| Mar 17, 2026 | The Digital ECA comes into force |
| Mar 20, 2026 | ANPD publishes its enforcement timeline and preliminary guidance on age assurance |
| Phase 1 | Priority monitoring of app stores and operating systems |
| August 2026 | Phase 2 monitoring starts, followed by final guidance |
| Next | New sectors selected by risk and impact |
Sanctions
Warnings, fines of up to 10% of the economic group’s revenue in Brazil, capped at R$ 50 million per violation, and, in serious cases, suspension or prohibition of activities by court order.
What about schools?
Schools rarely build apps, but they hire platforms, messaging apps and virtual learning environments that students use every day. It is worth reviewing these vendors and contracts, confirming how they handle student data and remembering that the LGPD already requires the processing of children’s and teenagers’ data to be in their best interest.
Compliance checklist
- Assessed whether the product targets or is likely accessed by minors
- Age assurance method chosen and documented
- Parental supervision tools available
- Advertising and recommendations reviewed for minors
- Terms of use and privacy policy updated
- Risk assessment documented and vendors reviewed
Gestão de TI supports compliance by combining a legal reading of the law with a technical review of flows, data and vendors.
HOW GESTÃO DE TI CAN HELP
Digital Protection for Schools & Families
Compliance with the Digital ECA and the LGPD, with a legal and technical review of products, data and vendors.
For information only. This does not replace a professional review of your specific case. Legal references reflect the rules in force on the publication date (Brazilian law).