Brazil's National Data Protection Authority (ANPD) released a comprehensive guidance document on October 28, 2026, clarifying how technology companies must protect children and adolescents online under the newly enacted ECA Digital statute. The legislation, formally known as Law No. 15,211/2025, entered into force in March 2026 and represents a significant shift in how digital services approach youth safety.

The central innovation of the ANPD's guide is the concept of "probable access." This principle means that compliance obligations apply not only to platforms explicitly designed for young users but also to general-purpose services where minors might reasonably encounter harmful content. Three criteria must all be present for this classification: the service must show sufficient attractiveness and likelihood of use by minors, offer considerable ease of access, and involve significant risks to privacy, security, or the biopsychosocial development of younger users.

According to the official guidance, certain categories of platforms are automatically presumed to meet these criteria. Social networks, application stores, and operating systems fall into this category by default. However, even services marketed exclusively to adults may face regulation if their features—such as games, rewards, or interactive elements—could attract adolescent users. The ANPD emphasizes that company declarations about target audiences do not override actual service characteristics when determining regulatory applicability.

Age verification represents another critical component of the new framework. The ANPD explicitly stated that simple user self-declarations or terms-of-service warnings are insufficient to demonstrate compliance. Services providing pornographic content must implement effective age verification mechanisms, though the authority has noted that many major sites still rely primarily on self-reporting. In June 2026, the ANPD began monitoring 18 websites hosting pornographic material, which collectively represented approximately 98% of such traffic in Brazil. By July 2026, only a few of these platforms had visible age verification barriers in place.

The guide establishes four core dimensions of prevention duties that companies must address proactively rather than reactively. These include content moderation to limit exposure to inappropriate material, parental supervision tools allowing guardians to monitor usage, enhanced security and privacy configurations, and measures to prevent compulsive usage patterns. Platforms must identify potential threats before incidents occur and continuously evaluate whether their protective measures remain effective over time.

Specific requirements vary based on platform type and scale. Social media services must link accounts belonging to users under 16 years old to legal guardians. Behavioral profiling for commercial advertising purposes is strictly prohibited for minors. Operating systems and app stores must provide secure API signals indicating user age ranges to help developers implement appropriate protections. Additionally, artificial intelligence interactions enabling sexually explicit dialogue or content generation are classified equivalently to pornography under the statute.

The ANPD acknowledges that enforcement responsibilities should be proportional to each company's size, user base, and capacity to influence content and interactions. A large social network faces different obligations than an educational application or streaming service. Nevertheless, all providers must demonstrate that their adopted measures effectively mitigate identified risks.

Transparency requirements mandate that terms of service and privacy notices use language accessible to young audiences. Platforms must establish reporting channels for guardians to communicate safety concerns. The overall objective shifts protection from reactive responses to proactive design considerations integrated throughout product development and ongoing operations.

This regulatory framework builds upon broader Brazilian efforts to address digital harms affecting minors. Previous government actions included investigations into chatbots simulating romantic friendships and judicial orders examining loot box mechanics in video games. The ECA Digital represents a more systematic approach, embedding child protection principles directly into data governance requirements.

The complete guidance document remains available through the ANPD's official website, offering practical examples, decision tables, and flowcharts to assist technology providers in assessing their compliance obligations. Legal experts note that the statute aims to create greater certainty for suppliers while ensuring that family supervision alone cannot bear the entire burden of protecting children online.