Brazil’s ANPD Explains Who the ECA Digital Covers, and Why an ‘Adults Only’ Label Won’t Settle It

Brazil’s data protection regulator has published the guidance that companies have been waiting for since the Digital Statute of Children and Adolescents took effect in March. The Agência Nacional de Proteção de Dados (ANPD) released its guide on who must comply with the law, known as the ECA Digital, and what the law’s central “duty of prevention” requires in practice. The answer to the first question is broader than many foreign companies assumed, and the answer to the second puts the burden squarely on the provider rather than on parents.

The ANPD’s announcement describes the guide, titled “Suppliers of information technology products or services: scope and general obligations of the ECA Digital,” which was published on October 28, 2026. It was revised after a public call for input that ran from April to June and was previewed at an ANPD webinar on October 15.

The law behind the guide

The ECA Digital is Law No. 15.211 of September 17, 2025. It entered into force on March 17, 2026, and a decree issued the next day set out more detailed rules. Decree No. 12.622 gave the ANPD responsibility for enforcing the statute, writing parts of its regulations and supervising compliance across Brazil. The authority was turned into a full regulatory agency by Law No. 15.352 in February 2026, partly to carry this new workload.

Since March the ANPD has issued preliminary guidance on age assurance, opened a dedicated complaints channel, set a September deadline for transparency reports from platforms that children are likely to use, and opened enforcement proceedings against Discord. The new guide is the piece that tells everyone else whether the law reaches them at all.

Who counts as a supplier

The guide applies the statute to “suppliers” of information technology products and services. That term covers companies and other parties offering social networks, apps, app stores, content platforms, games, operating systems, messaging services, e-commerce and similar technologies. To fall into the category, a product or service must have three features:

• it is offered at a distance;
• it works by electronic means; and
• it is used at the individual request of the user.

That definition is deliberately technology-neutral. The ANPD says the rules should keep pace with new products and features without needing to be rewritten for each one.

“Likely access” is the test that matters

The ECA Digital does not only cover services built for children. It also covers services that children are likely to use, even when the provider says they are meant for adults. The guide explains how the ANPD will decide whether a product falls into that group, applying the criteria in Article 1 of the law together and always in light of the child’s best interests. The factors include:

• how attractive the service is to children and adolescents and how likely they are to use it;
• how easy it is for them to access it; and
• whether it poses significant risks to their privacy, security, or physical, psychological or social development.

“In practice, this means looking at how products and services really work,” said ANPD director Lorena Giuberti Coutinho, who was rapporteur for the document. “An app may state that its target audience is made up exclusively of adults, but present videos, visual features, games, rewards or interaction mechanisms that attract the interest of adolescents.” (Quotes in this article are translated from Portuguese.)

Two points in the guide close off common arguments. First, a company’s own statement about the age of its users does not settle the question. The ANPD can look at the product’s real features and conclude that the law applies. Second, adding age verification does not take a service outside the law’s other obligations. Age assurance may be one of the measures the law requires, but it does not replace the rest. Some categories, including social networks, app stores and operating systems, are treated as likely to be accessed by children as a general rule.

The duty of prevention, in four parts

The guide spends most of its length on the duty of prevention. The ANPD says companies cannot wait for a violation before acting. They must identify the risks their products pose, assess how likely and how serious harm would be, and take steps to prevent or reduce it, then keep monitoring and improving those steps. The guide organizes the duty into four dimensions: prevention in the strict sense, protection, information and security.

In practice the ANPD lists these measures:

1. more protective privacy settings by default;
2. age assurance mechanisms;
3. parental supervision tools so parents or guardians can follow their children’s activity;
4. content moderation;
5. measures against compulsive use of the platform; and
6. transparency reports, where the law requires them.

The guide adds an expectation that will matter in any investigation: suppliers must be able to show that their measures work. Having a feature is not the same as having evidence that it reduces risk.

Obligations are scaled to the service. The size of the supplier, the number of users, the type of activity and the company’s ability to influence content and interactions all affect what is expected. A large social network, an educational app and a streaming service may face different requirements. App stores and operating systems carry specific duties, such as sending an age signal to apps, because they sit between developers and users.

What this means for companies outside Brazil

The ANPD has already shown it will act against foreign platforms. It fined TikTok R$153.7 million over children’s data under the LGPD, and this year it ordered Discord to suspend live streaming in Brazil. Our earlier analysis of the statute’s launch argued that the era of warnings was ending. The new guide removes the remaining doubt about scope.

For a company with Brazilian users, the practical questions are:

• Would a teenager find the product appealing, whatever the terms of service say?
• Can a teenager reach it easily, for example through an app store with no meaningful age gate?
• Does it collect data, enable contact with strangers, use reward loops or recommend content in ways that could harm a young user?
• Can you produce evidence, not just policy, that your protections work?

Brazil is not alone. Age assurance rules such as Google’s new measures in the United States and state design codes like Vermont’s S.69 follow the same logic of judging a service by how it actually works. The ANPD has also been clear that child safety overlaps with other harms, as its work on deepfake risk shows.

How Captain Compliance can help

Our Brazil LGPD module is built to manage consent, cookies, lawful bases, privacy notices, data subject requests, impact assessments, international transfers, incidents and the evidence the ANPD may ask for. For the ECA Digital, the most useful parts are the assessments and the evidence trail: a documented risk assessment of each product, a record of which protective settings are on by default, and a history of changes. Software cannot decide whether your product is “likely” to be used by children. It can help you show how you reached your answer.

Frequently asked questions

When did the ECA Digital take effect?

On March 17, 2026. The guide published on October 28, 2026, explains how the ANPD reads its scope and general obligations.

Does an “adults only” policy keep a service outside the law?

No. The ANPD says it will look at how the service actually works, and a supplier’s statement about its audience does not decide the question on its own.

If we add age verification, are we compliant?

Not automatically. Age assurance can be one required measure, but the duty of prevention also covers default settings, parental tools, moderation, compulsive-use safeguards and proof that these measures work.

Are all suppliers held to the same standard?

No. Obligations scale with the supplier’s size, user numbers, type of activity and control over content. App stores and operating systems have specific duties, including sending age signals.

Who enforces the ECA Digital?

The ANPD, under powers given by Decree No. 12.622 of 2025.

The question every product team now has to answer

The guide moves the conversation from “Is our product for children?” to “Would a child use it, and what happens if they do?” That second question has no checkbox answer. Companies that can show their reasoning, their settings and their results will be in a far better position than those that rely on the line in their terms of service saying users must be 18.