On October 28, 2026, Brazil's National Data Protection Authority (ANPD) published the guidance Guia Orientativo "Fornecedores de produtos ou serviços de tecnologia da informação: escopo e obrigações gerais do ECA Digital" (suppliers of information-technology products or services: scope and general obligations of the ECA Digital). The guide, announced on the ANPD news page, explains how Lei nº 15.211, de 17 de setembro de 2025 (the Digital Statute for Children and Adolescents) reaches products that were not built for children.
Social networks offering services in Brazil, including those that declare an adult-only audience, app stores and operating-system providers serving users in Brazil, games, messaging and content platforms with likely access by children or adolescents in Brazil, and e-commerce platforms that intermediate sales to users in Brazil must apply the three-part likely-access test and put the duty of prevention in place, including protective privacy defaults, age assurance, parental supervision, content moderation, measures against compulsive use and transparency reports where the statute requires them, by January 1, 2027, or from that date the ANPD moves from monitoring to formal enforcement, with administrative sanctions stated as fines up to BRL 50 million or 10 percent of Brazil revenue.
What does the ANPD guide change in the likely-access test?
The guide requires the three criteria in Article 1 of the ECA Digital to be read together, always against the best interests of children and adolescents: attractiveness and likelihood of use, ease of access and use, and a significant risk to privacy, safety, or physical, psychological and social development.
Director Lorena Giuberti Coutinho, rapporteur, states that an app may claim an adult-only audience and still attract adolescents through video, games, rewards or interaction tools. If access is also easy and the risk is significant, the service may be considered likely access and then subject to the obligations. Social networks, app stores and operating systems are presumed likely access as a rule, subject to the facts of each case. A supplier's age declaration does not decide scope, and an age check does not switch off the other duties.
| Test element | What the guide requires the supplier to examine |
|---|---|
| Supplier definition | Remote offer, electronic means, and use that starts from an individual user request |
| Attractiveness | Whether children or adolescents are likely to use the product, including features that draw them in despite an adult-only claim |
| Ease of access | How easily that audience can reach and use the service |
| Significant risk | Risk to privacy, safety, or physical, psychological and social development |
| Presumed categories | Social networks, app stores and operating systems, as a rule, with case-specific exceptions |
Who must apply the ECA Digital duties in Brazil?
Suppliers of digital products and services offered in Brazil are in scope when the three supplier traits and the likely-access test are met, even if the product was not designed for minors.
The guide names social networks, applications, app stores, content platforms, games, operating systems, messaging and e-commerce. Other technologies are in scope only when they meet the three supplier traits and the three-part test. Duties are modulated by the activity, the supplier's size, user numbers and the ability to interfere in content and interactions, so a large social network and a streaming service can face different requirements. Operating systems and app stores must send an age signal to applications. The ANPD may conclude that the statute applies even when the supplier says the product was not developed for children or adolescents.
What must suppliers put in place before January 1, 2027?
Suppliers must identify risks, assess how likely and how serious the harm is, and adopt measures that avoid or reduce it before a rights violation occurs, then monitor and improve those measures.
The guide organises the duty into prevention in the strict sense, protection, information and security. The measures named are more protective privacy settings, age assurance, parental supervision, content moderation and measures against compulsive use. Suppliers must show that the measures work and, where the statute requires it, publish transparency reports. Age assurance does not remove the other duties. The ECA Digital has been in force since March 17, 2026. January 1, 2027 is the stage at which the ANPD moves from monitoring to formal enforcement.
What happens if the duty of prevention is not in place?
From January 1, 2027 the ANPD's implementation stage for Lei nº 15.211 is formal compliance verification and administrative sanctions, recorded in the expected-watch entry as fines up to BRL 50 million or 10 percent of Brazil revenue.
The guide itself is orientation, not a new statute: it sets how the ANPD will read "likely access" and the duty of prevention. A self-declared adult audience, or an age gate standing alone, is not a defence if the product still meets the three-part test. Continuous, per-jurisdiction monitoring surfaces a guidance document of this kind the moment the authority publishes it.
Verify each product offered in Brazil against the supplier definition and the three-part test, including products labelled adults-only. Map privacy defaults, age assurance, parental supervision, moderation, compulsive-use controls and any required transparency report. Confirm that app stores and operating systems send the age signal, and brief trust and safety and privacy counsel before January 1, 2027 with the evidence that the measures work.
