Alerts
New law on online child protection is enacted in Brazil
Brazil enacted its first law dedicated to the protection of minors in online environments. Federal Law No. 15.211/2025 (“New Law”), formerly Bill of Law No. 2628/2022, was sanctioned by President Lula yesterday and establishes rules for the protection of all individuals under 18 in digital environments.
Except for the veto on the one-year vacatio legis, the New Law was sanctioned by the Brazilian President without other significant vetoes, meaning that it was enacted virtually with the same wording approved by Congress. In this sense, we refer to our previous alert, in which we provide general information on this new law: Alert – ECA Digital. Nonetheless, additional regulations were issued, notably Provisional Measure 1.317/2025, Executive Decree 12.622/2025 and Provisional Measure 1.319/2025 to respectively, change the nature of the Data Protection Authority to an Autonomous Agency, attribute to it the obligation to oversee the New Law and propose a six-month period for the New Law to come to force.
This New Law has extraterritorial effects, meaning it applies both to Brazilian and foreign based companies that meet the legal criteria. A lot of the wording of the New Law was inspired in foreign legislations, such as the UK OSA and the EU DSA, but there are notable particularities that should be carefully evaluated. For this reason, we tried to prepare a checklist of the main issues that companies should evaluate to ensure compliance with this new regulation.
1. When will the New Law come into effect?
The President vetoed the provision that granted companies a one-year term to comply with the New Law. The President then issued Provisional Measure 1.319/2025 establishing that the New Law will come o force 6 months after its publication, which happened in September 17, 2025.
Such measure has immediate effects but must be approved by Congress to be converted into law. If not approved within 120 days of its publication, it will cease to be effective, and the New Law will come to force immediately. We do not expect this to happen, as originally Congress had approved an even larger term, but cannot discard the possibility.
Accordingly, if the provisional measure is confirmed by Congress, the New Law will come into force 180 days after its official publication, which would place its entry into force around March 2026.
2. Which companies are subject to the New Law?
The New Law applies to providers of information technology products or services directed at or likely to be accessed by individuals under 18 years of age (“Minors”). This includes Brazilian and foreign companies that develop, manufacture, supply, commercialize, or operate such products and/or services. The New Law expressly establishes its application to video games and internet application stores.
3. What should the companies do now?
While none of the new obligations are immediately applicable, the New Law will have a significant operational impact on digital products and services that may be considered directed at or accessible to Minors. Given the technical aspects of many of these obligations, affected companies should begin planning and discussing necessary adjustments to ensure compliance as early as possible.
Key issues that should be critically evaluated include:
| Disposition | Action Needed | Who is it applicable to? | |
| Loot Boxes | Prohibition of the commercialization or exploitation of loot boxes in video games directed at or likely to be accessed by Minors. | Review regulatory practices. | All games that currently use loot boxes and are accessible by Minors. |
| Age Gating | Obligation to implement effective age-assurance mechanisms to prevent Minors from accessing age-inappropriate content. Considering the broad wording of the New Law and prior opinions issued by Brazilian authorities, self-declaration mechanisms will not be deemed sufficient. | Review regulatory practices and implement operational changes. | All platforms that meet the legal criteria. |
| Linked Accounts | Obligation to ensure that accounts of users under 16 years of age are linked to the account of one of their legal guardians. | Review operational systems. | All platforms that meet the legal criteria. |
| Parental Controls | Obligation to provide parental control mechanisms, including those that must be enabled by default or made available for activation by legal guardians. | Review regulatory practices and implement operational changes. | Mostly games and social media, but applies to all platforms that meet the legal criteria. |
| Content Moderation | Obligation to implement a notice-and-take-down mechanism, in the format set forth in the New Law. Additionally, companies must adjust the design of their platforms to allow for systematic moderation. | Review regulatory practices and implement operational changes. | All platforms that meet the legal criteria. |
| Local Representative | Obligation to appoint a legal representative in Brazil, with the powers defined in the New Law. | Appoint a representative in Brazil. | All platforms that meet the legal criteria. |
| Advertising and Use of Data | Prohibition on certain uses of Minors’ data for advertising purposes. | Review data protection practices. | All platforms that meet the legal criteria. |
| Transparency and Reporting | Obligation to prepare and publish reports on Minors’ access to and use of the products and/or services. | Implement controls. | All platforms that meet the legal criteria. |
4. Who will be responsible for monitoring compliance and regulating the New Law?
The New Law provided for the creation of an “autonomous administrative authority for the protection of the rights of children and adolescents in the digital environment”. This authority would be responsible for ensuring the implementation of the New Law, monitoring compliance, and issuing the regulations and procedures necessary for its enforcement.
When sanctioning the New Law, the President issued Provisional Measure 1.317/2025 changing the nature of the National Data Protection Authority (Autoridade Nacional de Proteção de Dados – “ANPD”) to an Autonomous Agency and Executive Decree 12.622/2025 attributing to it such role to oversee the application of the New Law. As a result, the new ANPD will preserve its original attributions on the enforcement and regulation of data protection, but will also assume the role of protecting minors under 18 years of age in digital environments.
We make reference to our comments above on the need of approval of Provisional Measures in Congress.
5. Will there be any additional regulation of the New Law?
Yes. Given the broad and sometimes open-ended provisions of the New Law, it is expected that Brazilian authorities will issue supplementary regulation on several aspects.
In particular, further regulation is likely to address:
- the technical requirements and minimum standards for parental control and age-assurance mechanisms;
- clarification on whether the obligation to link accounts of users under 16 years applies to all digital platforms regardless of sector;
- regulation of ANPD’s attributions as the authority for the protection of Minors in the digital environment;
- the qualifications and scope of authority of the local legal representative; and
- reporting and transparency requirements.
6. What are the possible risks of non-compliance with the New Law?
Without prejudice to other applicable civil, criminal, or administrative sanctions, failure to comply with the New Law subjects violators to the following penalties:
- warning, with a period of up to 30 (thirty) days, to adopt corrective measures;
- simple fine of up to 10% (ten percent) of the economic group’s revenue in Brazil in its last fiscal year or, in the absence of revenue, a fine of BRL 10.00 (ten reais) to BRL 1,000.00 (one thousand reais) per registered user of the sanctioned provider, limited in total to BRL 50,000,000.00 (fifty million reais) per infraction;
- temporary suspension of activities; or
- prohibition from carrying out activities.
Warnings and fines may be imposed extrajudicially, while suspension and prohibition of activities will be subject to judicial determination, with the National Telecommunications Agency (Anatel) responsible for enforcing blocking orders to connection providers and the Internet Management Committee (CGI) responsible for enforcing blocking of .br domain names.
Additionally, companies that fail to comply with the New Law may face regulatory and judicial enforcement actions.
Our team is closely monitoring the New Law and is available to answer any questions. We are also evaluating the impact of the changes of the attributes of the ANPD to data protection and will provide further information as soon as possible.