Transition to Regulatory Agency and New Responsibilities under the Digital Child and Adolescent Statute

The past few days have brought significant developments for the National Data Protection Agency (“ANPD”).

Firstly, Provisional Measure No. 1,317/2025 was published in the Federal Official Gazette, amending Law No. 13,709/2018 (Brazilian General Data Protection Law or “LGPD”), specifically its Chapter IX. The measure transforms the Authority into an Agency, thereby granting ANPD the status of a special autonomous regulatory body linked to the Ministry of Justice and Public Security, endowed with functional, technical, decision-making, administrative, and financial autonomy.

In practice, this change aims to strengthen the ANPD’s institutional and regulatory structure, including through the creation of permanent positions for data protection regulatory specialists, as well as commissioned roles and trust-based positions. With a well-defined structure and increased staffing support, ANPD gains both maturity and workforce capacity, benefiting not only the Agency itself but also all data subjects and agents who will now have access to a more robust and well-prepared local authority.

Additionally, Law No. 15,211/2025 was also enacted, establishing protection for children and adolescents in digital environments, creating the so-called Digital Child and Adolescent Statute (“Digital ECA”). This legislation deepens the legal framework for protecting minors online and applies broadly to any information technology product or service targeted at them or likely to be accessed by them. Key highlights include:

• specific definitions for terms such as social network, profiling, parental supervision, loot boxes, among others.
• mandatory mechanisms for age verification and parental supervision.
• regulation of monetization, advertising, and content directed at minors.
• sanctions and penalties similar to those established by LGPD.
• Court-ordered platform blocks or suspensions should be coordinated along the National Telecommunications Agency (ANATEL) and the Brazilian Internet Steering Committee (CGI.br), in accordance with their attribution.

As a result, ANPD expanded its powers to become the autonomous administrative authority responsible for protecting children and adolescents in digital environments, as established by Decree No. 12,622/2025. The Digital ECA will enter into force six months after its publication, on March 17, 2026, pursuant to Provisional Measure No. 1,319/2025, and should be observed with the same rigor as the ECA (Child and Adolescent Statute).

These measures reinforce Brazil’s commitment to digital safety and the protection of fundamental rights in online environments, further highlighting the role of CONAR (National Council for Advertising Self-Regulation), whose actions remain essential for overseeing advertising practices directed at children and adolescents, especially in digital environments, streaming platforms, or by influencers.

Such enhanced autonomy and staffing of ANPD, along its new role as “guardian” of the Digital ECA, indicate a more assertive and targeted regulatory approach in the near future. Therefore, we recommend close attention to personal data processing operations carried out in Brazil, particularly those involving children and adolescents.

If you would like more information on this topic, our Digital Law team is available at: digital@kasznarleonardos.com.