On August 7, 2026, Brazil's National Data Protection Authority (ANPD) opened an administrative enforcement proceeding (processo de fiscalização) against Discord, alleging the platform failed to meet child-protection duties under the Digital Statute for Children and Adolescents (ECA Digital, Lei 15.211/2025), in force since March 17, 2026. Discord has five business days to explain the mechanisms it uses to prevent and combat serious violations against minors, and exposure to sanctions under Article 35 of the statute reaches R$50 million per infraction.
The ANPD announcement frames the case as the first platform-specific enforcement action under ECA Digital and a signal that the regulator is not waiting for the phase-3 sanctions regime, expected in January 2027, to test compliance. The proceeding runs alongside a criminal investigation by the Civil Police and the Ciberlab of the National Public Security Secretariat into a group suspected of inciting suicide and self-harm through Discord, connected to the death of an adolescent on July 22.
Which ECA Digital duties does the ANPD say Discord breached?
The opening order (despacho de instauração) targets four clusters of obligations that ECA Digital places on digital services likely to be accessed by minors.
First, Article 6, III requires providers to prevent and mitigate the risk of minors being exposed to, recommended, or put in contact with content that induces, incites, instigates or aids self-harm and suicide. The ANPD cites indications that Discord's preventive and detection measures for this content category are inadequate.
Second, Articles 10 and 17 require effective age-assurance mechanisms. The order flags the absence of reliable age-verification tools, which is the central pillar of the statute's protection model and the focus of ANPD Technical Note 2/2026, which is expanding age-assurance monitoring across additional digital service providers.
Third, Article 29 imposes a duty to remove content that violates the statute, and Article 28 requires providers to communicate serious violations to the competent authorities. The ANPD alleges failures in both the takedown workflow and the reporting channel.
What must Discord do within five business days?
Discord has five business days from the opening of the proceeding to submit information on the mechanisms it already operates to prevent and combat serious violations against children and adolescents on its platform. The submission is the regulator's evidentiary baseline: it will determine whether the ANPD finds irregularities and proceeds to corrective measures and sanctions.
For trust and safety teams, the practical implication is that documentation of existing age-assurance, content-moderation, takedown and authority-reporting workflows must be production-ready and defensible to a Brazilian regulator now, not at the start of the formal sanctions phase.
What sanctions and corrective measures can the ANPD impose?
If the proceeding confirms irregularities, the ANPD may order corrective measures and apply the administrative sanctions set out in Article 35 of ECA Digital. The headline exposure is a fine of up to R$50 million per infraction.
| Exposure | Basis (ECA Digital) | When it bites |
|---|---|---|
| Corrective measures | Art. 35, administrative track | Once irregularities are confirmed in this proceeding |
| Fine up to R$50 million per infraction | Art. 35 | Per confirmed infraction, cumulative across the four duty clusters |
| Service restrictions or suspension | Phase-3 sanctions regime | Formal enforcement framework expected January 2027 |
The proceeding also sits inside a broader enforcement stack: the same facts are under criminal investigation, the office of the Attorney General (AGU) is studying civil action, and the first lady has publicly called for Discord to be blocked. Administrative, civil and criminal tracks can therefore run in parallel on the same underlying conduct.
Who else should treat this as an enforcement signal?
Every Brazil-facing platform likely to be accessed by minors, including Meta, TikTok, Google, Roblox and gaming or messaging services, should read the Discord case as the first concrete test of how the ANPD interprets the Article 6, III self-harm and suicide duty, the Articles 10 and 17 age-assurance standard, and the Article 28 and 29 reporting and takedown obligations. The duty cluster the ANPD chose to foreground, content abetting suicide and self-harm, is the highest-political-salience category and the most likely to be replicated against other platforms.
Continuous, per-jurisdiction real-time monitoring surfaces this kind of case-specific enforcement the moment a regulator publishes it, before the sector-wide sanctions phase opens.
Take advantage of this real-time watch
What to do next
Confirm whether your service is likely to be accessed by minors in Brazil and therefore falls under ECA Digital. Map your current age-assurance, self-harm and suicide content moderation, takedown and authority-reporting workflows against the four duty clusters the ANPD singled out. Brief your trust and safety and legal teams on the five-business-day response precedent that Discord has just set, and track the parallel criminal and civil tracks before the January 2027 sanctions phase begins.
