Alerts
Digital Child Protection Law Approved
Today, Bill No. 2628/2022 (“PL 2628/2022”), which establishes rules for the protection of children and adolescents in the digital environment, was approved by the Brazilian Congress. This regulation may affect all companies that maintain or are responsible for platforms targeted or likely to be accessed by minors under 18 years of age (such as applications and app stores, virtual stores, electronic games, social networks, and computer programs) and its violation may result in severe penalties (from fines to suspension of the company’s activities). The vote had the massive support of Brazilian political parties, with few oppositions. The text will be sent to President Lula for sanctioning. We prepared a summary of this regulation.
1. What companies are subject to PL 2628/2022?
providers of information technology products or services directed to or likely to be accessed by minors under 18 years of age. This applies to Brazilian and foreign companies that develop, manufacture, supply, commercialize and operate these products and/or services. It should be noted that the proposal expressly establishes its application to video games and internet application stores.
We note that “likely to be accessed” is a defined term in the legal proposal. It is a situation in which the following are present: (i) sufficient probability of use and attractiveness of the product or service; (ii) considerable ease of access and use of the product or service; and (iii) significant degree of risk to privacy, security or biopsychosocial development, especially for products or services that allow social interaction and large-scale information sharing between users in a digital environment.
2. What do you need to know immediately about PL 2628/2022?
If sanctioned by the President of the Republic, the new law will enter into force one year after its publication. Therefore, no measure is of immediate application.
The proposal has relevant operational impact on products and services of regulated companies. We briefly highlight the main points below:
- Age gating: Platforms must adopt secure and auditable age verification mechanisms to restrict minors’ access to inappropriate content. Therefore, the declaratory system does not meet the legal requirements.
- Parental control: Platforms must adopt parental control mechanisms with minimal default settings, such as restricting contacts, limiting excessive use, and controlling recommendations. It also requires the linking of accounts of minors under 16 years of age to legal guardians and guarantees accessible tools in Portuguese for supervision and management of online activity.
- Loot boxes: the exploitation of loot boxes was prohibited in Brazil for electronic games directed to or that can be used by people under 18 years old.
- Removal of content: the duty to remove content that violates the rights of minors under 18 years of age, upon notification of the user, his/her legal guardians or authorities, has been regulated. PL 2628/2022 also establishes the duty to implement a system that allows ample defense of the user responsible for the publication.
- Representation in Brazil: companies subject to the law must have representation in Brazil.
- Digital advertising: profiling techniques for targeting commercial advertising to minors under 18 years old, as well as the use of emotional analysis, augmented reality, extended reality and virtual reality for this purpose, are prohibited.
3. How was PL 2628/2022 discussed in Congress?
The vote of this bill was declared urgent by both Houses of Congress. This was largely due to a video published in August 2025 by a Brazilian influencer who questioned the use of social media and digital platforms to exploit the images of children and adolescents. The video, which currently has over 48 million views, generated significant clamor of the Brazilian population and fueled a popular outcry for the protection of minors in digital environments, especially on social media.
The text now awaits presidential sanction. The President has 15 business days to sanction the bill into law, with the power to veto any provision.
4. Main provisions of PL 2628/2022
What does PL 2628/2022 say about loot boxes?
This is one of the points that was very debated in Congress. The House of Representatives voted to regulate the mechanism, but the Senate rejected the proposal and reinstated the wording to ban loot boxes for people under 18 years old.
Therefore, loot boxes are prohibited in video games directed or that can be used by minors under 18 years of age, according to their age-rating. That is, if the game is age rated as appropriate for minors under 18 years old, it cannot have loot box.
What does PL 2628/2022 say about age verification mechanisms?
In general, PL 2628/2022 establishes that platforms must adopt mechanisms capable of providing experiences appropriate to the age of users. More specifically, the proposal obliges platforms with content, product or service inappropriate for minors under 18 years of age to adopt effective measures to prevent access by such minors. In addition, internet app store providers must adopt proportional, auditable, and technically secure measures to assess the age or age group of users.
Although the text does not specify which verification mechanisms will be accepted, it expressly determines that they must be effective, thus prohibiting the use of simple self-declaration. In this context, the government may act as a regulator, certifier or promoter of technical solutions aimed at age verification.
What does PL 2628/2022 say about parental control?
PL 2628/2022 establishes a set of rules related to parental control mechanisms, including by requiring their adoption by platforms subject to the law.
The proposal also defines minimum default settings that must be present in parental control tools, including, but not limited to: (i) restriction of communication with unauthorized users; (ii) limitation of resources that encourage excessive use; and (iii) control over personalized recommendation systems.
In addition, PL 2628/2022 also provides that parental control tools must enable parents and legal guardians to: (i) view, configure, and manage account and privacy options, (ii) restrict purchases, (iii) identify profiles of adults with whom the child or adolescent communicates, (iv) monitor screen time, (v) activate or deactivate safeguards through accessible and appropriate controls, and (vi) have information and control options in Portuguese.
It is also important to note that PL 2628/2022 establishes that users or accounts of minors up to 16 years old must be linked to the user or the account of one of their legal guardians.
Finally, in the absence of a user or account of the legal guardians, providers must prohibit the possibility of changing the parental supervision settings of the account to a lower level of protection.
How can advertising be done in digital media?
The use of profiling techniques to target commercial advertising to minors under 18 years of age is prohibited, as well as the use of emotional analysis, augmented reality, extended reality and virtual reality resources for this purpose.
In addition, the proposal also prohibits the monetization and promotion of content that portrays minors under 18 years of age in an eroticized or sexually suggestive way or in the context of the adult sexual universe.
Should platforms remove content that violates the rights of children and adolescents?
The platforms subject to PL 2628/2022 must provide users with public and easily accessible notification mechanisms to report violations of the rights of minors under 18 years of age.
The notification must contain, under penalty of nullity, elements that allow the technical identification of the content pointed out as infringing and the author of the notification, and anonymous complaints are prohibited.
In line with the thesis of general repercussion of the Federal Supreme Court, suppliers are obliged to remove content that violates the rights of minors under 18 years of age as soon as notified by victims, their representatives, the Public Prosecutor’s Office or entities representing the defense of the rights of children and adolescents, regardless of a court order.
However, the procedure for removing content must observe the right to full defense by the user responsible for its publication. To this end, platforms must: (i) notify the user of the removal of their content; (ii) present the grounds for the decision, including whether the identification was the result of human or automated analysis; (iii) ensure the possibility of the user appealing the measure, through an easily accessible procedure; and (iv) establish clear deadlines for both the filing of the appeal and the response to it.
Will platforms need to publish reports?
Yes. PL 2628/2022 establishes that providers of platforms directed or likely to be accessed by minors under 18 years old, who have more than 1,000,000 (one million) registered users in this age group, must prepare semiannual reports, in Portuguese, to be published on their official websites.
The reports must contain the following information:
- Complaints: number of complaints received.
- Moderation: number of content or moderated accounts, by type.
- Identification: measures to detect child accounts and illicit acts.
- Data protection: technical improvements to protect the privacy of minors under 18 years of age.
- Parental consent: technical improvements to collect consent of legal guardians, in accordance with personal data protection legislation.
- Risk assessment: methods and results of impact assessments, identification and management of risks to the safety and health of children under 18 years of age.
Is there an obligation to maintain a legal representative in Brazil?
Also in line with the recent decision of the Federal Supreme Court, PL 2628/2022 establishes that companies subject to it must maintain a legal representative in Brazil with powers to receive, among others, summons, subpoenas or notifications, in any lawsuits and administrative proceedings, as well as respond to entities and authorities of the Executive Branch, of the Judiciary and the Public Prosecutor’s Office, and to assume, on behalf of the foreign company, its responsibilities before the public entities and authorities.
Which entity will be responsible for the enforcement of PL 2628/2022?
PL 2628/2022 provides for the creation of an “autonomous administrative authority for the protection of the rights of children and adolescents in the digital environment”. This authority must be established by law and will have as its main attributions to ensure the application of Pl 2628/2022, monitor its compliance and issue regulations and procedures necessary for its execution.
It should be noted, however, that the approved text does not detail the organizational structure, functioning or resources of this authority, leaving such aspects to be defined in subsequent legislation.
What are the sanctions provided for non-compliance with the proposal?
In case of non-compliance with the obligations, violators are subject to the following penalties:
- Warning, with a period of up to 30 days for corrective measures.
- Simple fine, of up to 10% of the economic group’s revenue in Brazil in the last fiscal year, or from R$ 10.00 to R$ 1,000.00 per registered user, limited to R$ 50,000,000.00 per infraction.
- Temporary suspension of activities.
- Prohibition of the exercise of activities.
The application of sanctions will take into account the seriousness of the infraction, recurrence, economic capacity of the offender and the impact on the community. The fines and warnings will be applied by the new autonomous administrative protection authority, while the suspension and prohibition will be up to the Judiciary, with Anatel being responsible for forwarding the blocking orders.
What are the next steps?
Presidential sanction: PL 2628/2022 will now be analyzed by the president for sanctioning and veto.
Regulation by the Executive Branch: After the eventual sanction, the Executive Branch will be responsible for regulating various aspects of the law, defining objective criteria for gauging the degree of interference by suppliers, details of the requirements and minimum standards for parental control and age verification mechanisms. It should be noted that such regulation cannot impose mass surveillance or compromise fundamental rights such as freedom of expression and privacy.
Working Group: Important and complex issues that were not fully deepened in the final version of PL 2628/2022 (such as new criminal classifications or improvements to the ECA) may be transferred to a working group for discussion and proposal of additional protection measures.
Our team is closely following PL 2628/2022 and we are available to answer any questions.