Regulationsby GlyphBrazil ECA Digital
In force Brazil · In force Mar 17, 2026 · no upcoming deadlines
Deadlines
ECA Digital in forceArt. 41-A (as set by Law 15.352/2026, following MP 1.319/2025) fixes entry into force on 17 March 2026.
Summaries for reference, not legal advice. Check the official text.
What it does
Requires digital products and services likely to be accessed by children and adolescents to apply protection by design and default, reliable age verification, parental supervision tools, links between under-16 accounts and guardians, and swift removal of harmful content; bans profiling-based advertising to children and loot boxes in games for minors.
- Who it applies to
- Providers of information technology products or services directed at, or likely to be accessed by, children and adolescents in Brazil: social networks, games, app stores, operating systems, streaming and similar services, regardless of location.
- Penalties
- Warning; simple fine up to 10% of the economic group's revenue in Brazil in the last fiscal year or, absent revenue, BRL 10 to BRL 1,000 per registered user, capped at BRL 50 million per infraction; temporary suspension or prohibition of activities (judicial).
- Enforced by
- Autonomous administrative authority for children's digital rights (ANPD designated); courts for suspension/prohibition
- Official name
- Estatuto Digital da Criança e do Adolescente (Law No. 15.211/2025)
- Citation
- Lei nº 15.211/2025
- Topics
- Children, Online safety, Privacy
Verified 2026-09-22 machadomeyer.com.br
Research notes
Published 18 Sept 2025. Designation of ANPD as the enforcing authority is from secondary reporting.
Related
Alberta POPAReplaces the privacy part of Alberta's FOIP Act for public bodies. It adds mandatory breach notification where there is a real risk of significant harm, privacy management programs, privacy impact assessments, rules for creating and using non-personal data, and notice when personal information will be fed into automated systems. It also bans selling personal information and adds large offence fines.In effect since Jun 11, 2025Argentina Law 25.326Argentina's habeas data and personal data protection law. It covers consent, data quality, sensitive data, security and confidentiality, international transfers to countries with adequate protection, and access, rectification and deletion rights. Argentina holds EU adequacy status based on this law.No date set
Brazil AI Bill (PL 2338/2023)Risk-based AI framework inspired by the EU AI Act: prohibited (excessive-risk) uses, high-risk system obligations, algorithmic impact assessments, rights for affected persons and copyright remuneration provisions, coordinated by a national AI regulation system (SIA) led by the ANPD.No date setBrazil LGPDBrazil's GDPR-style general data protection law: ten legal bases, data subject rights, DPO (encarregado), incident reporting and international transfer rules. ANPD's Resolution CD/ANPD 19/2024 set the international transfer regime and mandatory standard contractual clauses.In effect since Sep 18, 2020
Canada Bill C-36 (PPCDA)Would replace PIPEDA's private-sector rules with a modernised statute (successor to C-27's CPPA) including stronger consent, de-identification and re-identification rules, and administrative penalties, with oversight housed in a new Digital Safety and Data Protection Commission. Does not include an AI act.No date setChile Personal Data Protection Law (Ley 21.719)Replaces Chile's 1999 data law with a GDPR-style regime: legal bases, data subject rights (including portability and objection to automated decisions), security and breach notification, international transfer rules, a voluntary compliance (crime-prevention-style) model, and a new independent Personal Data Protection Agency.Next: Dec 1 Law in force · in 35 daysMexico LFPDPPP 2025New federal private-sector data protection law replacing the 2010 law after the dissolution of INAI; keeps the ARCO rights and privacy-notice model, broadens the personal data definition and moves enforcement to the Secretaría Anticorrupción y Buen Gobierno.In effect since Mar 21, 2025Ontario Bill 194Enacts the Enhancing Digital Security and Trust Act, 2024, which lets Ontario set cyber security program, incident reporting and AI governance rules for public sector entities, and rules on digital information about minors held by school boards and children's aid societies. It also amends FIPPA to require privacy impact assessments, reasonable safeguards and breach notification to the IPC and affected people where there is a real risk of significant harm.In effect since Jan 29, 2025
Questions about Brazil ECA Digital
- What are the Brazil ECA Digital compliance deadlines?
- Mar 17, 2026: ECA Digital in force.
- When does Brazil ECA Digital take effect?
- Brazil ECA Digital took effect on Mar 17, 2026.
- Who does Brazil ECA Digital apply to?
- Providers of information technology products or services directed at, or likely to be accessed by, children and adolescents in Brazil: social networks, games, app stores, operating systems, streaming and similar services, regardless of location.
- What are the penalties under Brazil ECA Digital?
- Warning; simple fine up to 10% of the economic group's revenue in Brazil in the last fiscal year or, absent revenue, BRL 10 to BRL 1,000 per registered user, capped at BRL 50 million per infraction; temporary suspension or prohibition of activities (judicial).