Publicado em 26/08/2025

House of Representatives approves bill on the protection of children in digital environments

Last week, Bill No. 2628/2022 (“PL 2628/2022“) was approved in the House of Representative, which establishes rules for the protection of children and adolescents in the digital environment. This regulation may affect all companies that maintain or are responsible for platforms targeted or likely to be accessed by minors (such as applications and app stores, virtual stores, electronic games, social networks, and computer programs) and its violation may result in severe penalties (from fines to suspension of the company’s activities).

PL 2628/2022 now returns to the Federal Senate for review of the amended points and vote.

 

1. Has PL 2628/2022 already been approved in Congress?

PL 2628/2022 was originally presented in the Federal Senate in October 2022, and its initial analysis took approximately two years.

The course of this regulation in the House of Representatives was abruptly shortened, since it was declared an urgent regime in its processing. Most likely this is related to a video published in August 2025 by a Brazilian influencer who questioned the use of social networks and digital platforms to exploit the image of children and adolescents. The video, which currently has more than 48 million views, generated strong repercussions among the Brazilian population and boosted a popular clamor for the protection of minors in digital environments, especially on social networks.

It is important to note that PL 2628/2022 has undergone many changes in the House of Representatives. Thus, it returns to the Senate for its amendments to be evaluated and voted on. It is important to remember that if approved, this law will partially affect the thesis of general repercussion of the Brazilian Supreme Court (for more information click here)

 

2. Main provisions of the wording of PL 2628/2022 approved by the House of Representatives

• To whom would PL 2628/2022 be applicable?

PL 2628/2022 will be applicable to any information technology product or service targeted to or likely to be accessed by minors under 18 years old in Brazil, regardless of its location, development, manufacture, offer, commercialization and operation. It should be noted that the proposal expressly establishes its application also to electronic games and internet application stores.

We note that “likely to be accessed” is a defined term in the legal proposal. It is a situation that includes the following: (i) sufficient probability of use and attractiveness of the product or service; (ii) considerable ease of access and use of the product or service; and (iii) significant degree of risk to privacy, security or biopsychosocial development, especially for products or services that allow social interaction and large-scale information sharing between users in a digital environment.

• What does PL 2628/2022 say about loot boxes?

This is one of the points that was drastically modified by the House of Representatives. Loot boxes went from prohibited to regulated. The approved text defines “loot boxes” as: “functionality available in certain electronic games that allows the acquisition, upon payment, by the player, of consumable virtual items or random advantages, redeemable by the player or user, without prior knowledge of their content or guarantee of their effective usefulness”.

The exploitation of loot boxes in games targeted or likely to be accessed by minors under 18 years old is now regulated. The requirements are:

1. Guaranteed benefit: every loot box must offer at least one virtual item or perk, and empty boxes are prohibited.
2. Transparency: the probabilities of obtaining each item must be informed in a clear, accessible, accurate and ostensive way before acquisition.
3. Prohibition of commercialization: it is forbidden to sell, exchange or convert items obtained through the loot box into currency, credit or advantages external to the game (cash-out).
4. Competitive balance: There may be no granting of significant or disproportionate competitive advantages exclusively to paying players. PL 2628/2022 even expressly defines what should be understood by “disproportionate competitive advantages”.
5. Prevention of excessive use: Technical and administrative measures must be adopted to prevent compulsive or excessive use of loot boxes, such as purchase limits, warnings and parental supervision.

• What does PL 2628/2022 say about age verification mechanisms?

In general, PL 2628/2022 states that platforms must adopt mechanisms capable of providing experiences appropriate to the age of users. More specifically, the proposal obligates platforms that make inappropriate content, product or service available to minors under 18 years old to adopt effective measures to prevent access by children and adolescents. In addition, internet app store providers must adopt proportional, auditable, and technically secure measures to assess the age or age group of users.

Although the text does not specify which verification mechanisms will be accepted, it expressly determines that they must be reliable, thus prohibiting the use of simple self-declaration. In this context, the government may act as a regulator, certifier or promoter of technical solutions aimed at age verification.

• What does PL 2628/2022 say about parental control?

PL 2628/2022 establishes a set of rules related to parental control mechanisms, including determining the mandatory adoption of their adoption by platforms covered by the law.

The proposal also defines minimum default settings that must be present in parental supervision tools, including, but not limited to: (i) restriction of communication with unauthorized users; (ii) limitation of resources that encourage excessive use; and (iii) control over personalized recommendation systems.

In addition, PL 2628/2022 also provides that parental supervision tools must enable parents and legal guardians to: (i) view, configure, and manage account and privacy options, (ii) restrict purchases, (iii) identify profiles of adults with whom the child or adolescent communicates, (iv) monitor screen time, (v) activate or deactivate safeguards through accessible and appropriate controls,  and (vi) have information and control options in Portuguese.

Also, it is important to note that PL 2628/2022 determines that users or accounts of minors up to 16 years old must be linked to the user or the account of one of their legal guardians.

• How can advertising be done in digital media?

The use of profiling techniques to target commercial advertising to minors under 18 years old is prohibited, as well as the use of emotional analysis, augmented reality, extended reality and virtual reality resources for this purpose.

In addition, the proposal also prohibits the monetization and promotion of content that portrays minors under 18 years of age in an eroticized or sexually suggestive way or in the context of the adult sexual universe.

• Should platforms remove content that violates the rights of children and adolescents?

The platforms covered must provide users with public and easily accessible notification mechanisms to report violations of the rights of minors under 18 years old.

The notification must contain, under penalty of nullity, elements that allow the specific technical identification of the content pointed out as violating the rights of minors and the author of the notification, and anonymous complaints are prohibited.

In line with the thesis of general repercussion of the Brazilian Supreme Court, suppliers must remove content that violates the rights of minors as soon as notified by victims, their representatives, the Public Prosecutor’s Office or entities representing the defense of the rights of children and adolescents, regardless of a court order.

However, the procedure for removing content must observe the right to full defense of the user responsible for the publication. To this end, platforms must: (i) notify the user of the removal of their content; (ii) present the grounds for the decision, including whether the identification was the result of human or automated analysis; (iii) guarantee the user the possibility of appealing the measure, through an easily accessible procedure; and (iv) establish clear deadlines for both the filing of the appeal and the response to it.

• Will platforms need to publish reports?

Yes. PL 2628/2022 establishes that providers of internet applications targeted or likely to be accessed by minors under 18 years old, which have more than 1,000,000 (one million) registered users in this age group, must prepare semiannual reports, in Portuguese, to be published on their official websites.

The weekly reports must contain the following information:

1. Complaints: number of complaints received.
2. Moderation: number of content or moderated accounts, by type.
3. Identification: measures to detect child accounts and illicit acts.
4. Data protection: technical improvements to protect the privacy of minors under 18 years of age.
5. Parental consent: technical improvements to assess consent of guardians, in accordance with personal data protection legislation.
6. Risk assessment: methods and results of impact assessments, identification and management of risks to the safety and health of children under 18 years of age.

• Is there an obligation to maintain a legal representative in Brazil?

Similarly to the recent decision of the Federal Supreme Court, PL 2628/2022 provides that companies covered by its text must maintain a legal representative in Brazil with powers to receive, among others, summonses, subpoenas or notifications, in any lawsuits and administrative proceedings, as well as respond to bodies and authorities of the Executive Branch,  of the Judiciary and the Public Prosecutor’s Office, and to assume, on behalf of the foreign company, its responsibilities before the bodies and entities of the public administration.

• Who will be responsible for the application of PL 2628/2022?

PL 2628/2022 provides for the creation of an “autonomous administrative authority for the protection of the rights of children and adolescents in the digital environment”. This authority must be established by law and will have as its main attributions to ensure the application of the bill, monitor its compliance and issue regulations and procedures necessary for its execution.

It should be noted, however, that the approved text does not detail the organizational structure, functioning or resources of this authority, leaving such aspects to be defined in subsequent legislation.

• What are the sanctions provided for non-compliance with the proposal?

In case of non-compliance with the obligations, violators are subject to the following penalties:

1. Warning, with a period of up to 30 days for corrective measures.
2. Simple fine, of up to 10% of the economic group’s revenue in Brazil in the last fiscal year, or from R$ 10.00 to R$ 1,000.00 per registered user, limited to R$ 50,000,000.00 per infraction.
3. Temporary suspension of activities.
4. Prohibition of the exercise of activities.

The application of sanctions will consider the seriousness of the infraction, recidivism, economic capacity of the offender and the impact on the community. The fines and warnings will be applied by the new autonomous administrative protection authority, while the suspension and prohibition will be up to the Judiciary, with Anatel being responsible for forwarding the blocking orders.

 

3. What are the next steps?

• New Vote in the Senate: Once the text has been changed in the Chamber of Deputies, it returns to the Federal Senate for a new round of voting before going to presidential sanction.
• Regulation by the Executive Branch: After eventual approval and sanction, the Executive Branch will be responsible for regulating various aspects of the law, defining objective criteria for gauging the degree of interference by suppliers, details of the requirements and minimum standards for parental supervision and age verification mechanisms. It should be noted that such regulation cannot impose mass surveillance or compromise fundamental rights such as freedom of expression and privacy.
• Working Group: Important and complex issues that were not fully deepened by the amendments (such as new criminal classifications or improvements to the ECA) may be transferred to a working group for discussion and proposal of additional protection measures.

 

Our Digital Law team is closely following the regulation of PL 2628/2022 and we are available to answer any questions.