Brazil's ECA Digital (Law 15,211/2025): What Foreign Companies Must Know

Brazil has enacted one of the strictest child protection laws for digital platforms in Latin America. Law 15,211/2025 — known as the ECA Digital — establishes a comprehensive set of obligations for any platform or digital service accessible to children and adolescents in Brazil. For foreign companies operating in the country or planning to enter the Brazilian market, this is a significant compliance development that cannot be overlooked.

What Is the ECA Digital?

The ECA Digital amends Brazil's Child and Adolescent Statute (Estatuto da Criança e do Adolescente — ECA), extending its protections to the digital environment. Signed into law in late 2024 and entering into force in 2025, the legislation imposes direct obligations on digital platform operators, social media companies, streaming services, online games, and any digital product or service that may be accessed by users under 18 years of age in Brazil.

The law applies regardless of where the company is incorporated. If your platform is accessible in Brazil and used by minors, your company falls within its scope.

Who Is Covered?

The ECA Digital casts a broad net. The following types of companies and services are subject to its requirements:

• Social media platforms and content-sharing applications

• Online gaming platforms, including mobile and browser-based games

• Streaming services for video, music, and other digital content

• E-commerce platforms and digital marketplaces

• Messaging and communication applications

• Any app or website that collects data from or directs services toward Brazilian minors

Companies that operate exclusively B2B services with no direct exposure to minors may be outside the law's scope, but this requires a careful assessment of how the service is actually used in practice.

Key Obligations Under the ECA Digital

1. Age Verification

Platforms must implement effective age verification mechanisms to identify users under 18. The law requires that this verification be reliable — not merely a self-declaration checkbox. Companies need to review their current onboarding flows and assess whether existing mechanisms meet this standard.

2. Parental Consent and Controls

For users identified as minors, parental or guardian consent is required for account registration and for access to certain categories of content. The law also mandates that platforms offer accessible parental control tools, enabling parents to monitor usage, restrict content, and set time limits.

3. Content Restriction and Moderation

Platforms must restrict minors' access to content that is harmful to their physical or psychological development. This includes violent content, adult material, content promoting self-harm or substance use, and content involving exploitation or abuse. Companies are required to have content moderation policies specifically designed for the protection of minors.

4. Data Protection for Minors

The ECA Digital works in tandem with Brazil's General Data Protection Law (LGPD). Processing personal data of children and adolescents requires specific legal basis, in most cases, verifiable parental consent. Platforms must ensure their data collection, processing, and retention practices comply with both the LGPD and the ECA Digital's additional layer of protection for minors.

5. Reporting Mechanisms and Duty to Report

Platforms must provide accessible and effective channels for users to report content that violates child protection rules. More significantly, companies are under a legal obligation to report to Brazilian authorities any instance of content involving child sexual abuse material (CSAM) identified on their platforms. Failure to report constitutes a criminal violation.

6. Algorithmic Accountability

One of the more novel provisions of the ECA Digital concerns recommendation algorithms. Platforms that use algorithmic systems to recommend or curate content must ensure those systems do not expose minors to harmful content or exploit their behavioral data in ways that are detrimental to their wellbeing. This has direct implications for how ad targeting and content personalization are configured for Brazilian users.

Penalties for Non-Compliance

The ECA Digital establishes significant penalties for platforms that fail to comply with its requirements. These include administrative fines, suspension of activities in Brazil, and — in cases involving failure to report child exploitation material — criminal liability for company representatives. Brazilian authorities have enforcement powers that can be applied to foreign companies operating in the country, including orders directed at payment processors and app store operators.

What Foreign Companies Should Do Now

For foreign companies that are already operating in Brazil or planning market entry, the ECA Digital adds a meaningful compliance layer on top of the LGPD. The practical steps include:

• Conducting a compliance gap analysis to identify where current platform features fall short of the ECA Digital's requirements

• Reviewing age verification and parental consent flows to determine whether they meet the reliability standard required by law

• Auditing content moderation policies and algorithmic recommendation systems for compliance with minor protection rules

• Aligning data processing practices for minors with both the LGPD and ECA Digital requirements

• Establishing or updating internal reporting procedures for child protection violations

• Engaging local legal counsel to monitor regulatory guidance as it is issued

How Reis Araujo Advogados Can Help

Our firm advises foreign companies on digital law and data protection compliance in Brazil, including LGPD implementation and now ECA Digital readiness. We work with international legal teams and in-house counsel to provide practical, Brazil-specific legal analysis that can be integrated into global compliance programs.

If your company operates a digital platform or service accessible to users in Brazil, contact us to discuss your compliance obligations under the ECA Digital.