ECA Digital: ANPD clarifies the scope of the rules and the responsibilities of technology providers

Protecting children and adolescents in the digital environment requires more than setting a minimum age for using a service. With the publication of its Guidance on Providers of Information Technology Products or Services in October 2026, the Brazilian Data Protection Agency (ANPD) provides guidance on interpreting the scope of the Digital Statute of Children and Adolescents (ECA Digital) and identifying the responsibilities of the entities operating in this market.

The Scope of the New Rules for the Digital Environment

The document conveys an important message for businesses: the target audience is not the only criterion for determining whether the ECA Digital applies. The legislation covers digital products and services directed at children and adolescents or likely to be accessed by them. Accordingly, even platforms designed for adults may be subject to the rules, depending on their functionalities, access conditions, and the risks they present.

To assess what is known as “likely access,” the ANPD highlights the three criteria set out in Article 1, sole paragraph, of ECA Digital, which must be considered together: (i) the likelihood of use and the service’s appeal to children and adolescents; (ii) the ease of access and use; and (iii) the existence of significant risks to this group’s privacy, safety, or physical, psychological, and social development.

In practice, elements such as design, content, interactive features, and engagement mechanisms may be relevant to this assessment. Simply stating that a service is not intended for minors does not automatically exclude it from the scope of the legislation. Likewise, implementing age-verification mechanisms does not, in itself, eliminate other applicable obligations.

The guidance is particularly relevant to social media companies, video game providers, streaming services, app stores, operating systems, and artificial intelligence solutions, among other players in the digital ecosystem. The analysis may also extend to foreign providers whose products or services are accessible in Brazil and meet the statutory criteria.

From Formal Compliance to Risk Prevention

Another key aspect of the document is the duty to prevent harm (Article 5 of ECA Digital). Rather than acting only after a violation has occurred, providers must adopt proactive measures to identify, prevent, and mitigate risks to children and adolescents throughout the lifecycle of their products and services.

ANPD organizes this duty around four dimensions: (i) prevention, (ii) protection, (iii) information, and (iv) security. Depending on the characteristics of the service and the risks involved, measures may include more protective privacy settings, age-assurance mechanisms, parental supervision tools, content moderation, and features designed to prevent compulsive use.

This does not mean that all companies are subject to the same requirements. The guidance emphasizes that obligations should be applied proportionately, considering factors such as the nature of the service, its business model, the provider’s size, the number of users, and its ability to influence the content and interactions it offers.

A Guide to Turning Criteria into Action

In addition to clarifying key concepts, the publication provides resources to help companies assess their products and services. Three annexes deserve particular attention:

• Appendix I – Summary Table of Key Concepts: brings together relevant definitions to help readers understand the scope of the ECA Digital and providers’ obligations.

• Appendix II – Summary Table on Likely Access: organizes the assessment criteria and presents factors that may indicate the likelihood that a service will be used by children and adolescents.

• Appendix III – Likely Access Assessment: provides a flowchart to help determine whether a product or service falls within the scope of the legislation, taking into account the statutory criteria and presumptions of likely access (e.g., social media, video games, generative AI systems, among others).

These resources provide a starting point for internal reviews but do not replace an assessment of each business’s specific circumstances. ANPD also emphasizes that a provider’s self-assessment is not binding on the Agency, which may reach a different conclusion based on the actual characteristics of the service.

What Should Companies Do Now?

The guidance reinforces the importance of reviewing not only terms of use and age ratings, but also how products actually function, their interaction mechanisms, the risks involved, and the protective measures in place. Incorporating this assessment into the development and ongoing updating of digital solutions may be essential to achieving effective compliance with the ECA Digital.

We will continue to monitor developments in this area and remain available to assist with any related legal advisory needs. For further information, please contact our team at digital@kasznarleonardos.com.