On March 17, 2026, Brazil's Digital ECA (Estatuto Digital da Criança e do Adolescente) became enforceable, instantly making it the most comprehensive digital child protection law on Earth and sending shockwaves through every platform that serves adult content to Brazilian users. President Lula signed three implementing decrees the following day, activating a law that applies to any digital product or service "aimed at or likely to be accessed" by minors in Brazil — regardless of where the company is headquartered.

Why It Matters

Brazil is the fifth-largest internet market on Earth, with an estimated 180 million users. The Digital ECA sets a new global benchmark for how aggressively a government can regulate digital platforms in the name of child protection — and unlike the EU's Digital Services Act or Australia's Online Safety Act, it explicitly bans self-declaration age verification, requiring biometric or ID-based methods that are far harder to circumvent. For adult content platforms already grappling with age verification mandates in Australia (where Pornhub chose to geo-block rather than comply), the UK, France, and over 20 US states, Brazil's law adds another major market where half-measures won't suffice. The infinite scroll ban is particularly notable — it's the first time a major country has targeted a specific UX pattern as harmful to minors, setting a precedent that could inspire similar moves in the EU and US.

The law's reach is sweeping. Social networks, messaging apps, video platforms, games, app stores, streaming services, and adult content websites all fall under its purview. For adult content providers specifically, the Digital ECA mandates "effective and reliable" age-verification mechanisms, expressly banning simple self-declaration checkboxes like "I am 18+." Accepted verification methods include CPF-based verification (Brazil's national taxpayer ID), facial biometrics with liveness detection, document upload, and age signals transmitted via API from app stores or operating systems.

Beyond age verification, the law introduces consumer protections that tech platforms have never faced at this scale. Infinite scrolling — the engagement mechanic that powers TikTok and Instagram — is now prohibited for accounts belonging to minors. Autoplay of unsolicited content is banned for under-18 users. Accounts for users under 16 must be linked to a parent or guardian's account, with parental controls configured to maximum protection by default. Paid loot boxes in games accessible to minors are banned, and platforms are prohibited from profiling or targeting advertising at anyone under 18.

The penalties for non-compliance are among the steepest globally: fines of up to 10% of a company's Brazilian revenue, capped at 50 million Brazilian reais (approximately $9.4 million USD) per violation. Repeated violations can result in temporary service suspension or complete loss of authorization to operate in Brazil. Platforms with more than one million minor users must publish semi-annual transparency reports in Portuguese to Brazil's National Data Protection Agency (ANPD). Harmful content — including sexual exploitation, violence, bullying, and incitement to self-harm — must be removed within 24 hours of reporting.

Sources

Update — 2026-03-25

Initial entry — story first created.

Update — 2026-05-03

On April 30, 2026, Brazil's National Data Protection Authority (ANPD) opened a public consultation phase on the Digital ECA's implementing guidelines, with comments accepted through June 15, 2026. The consultation will refine: who the law applies to, definitions of key obligations (prevention, protection, information, security), and the scope of "supplier of information technology products or services directed at or likely to be accessed by children and adolescents." Comments can be submitted via Brazil's participation platform at brasilparticipativo.presidencia.gov.br; non-Brazilian participants must provide passport information. ANPD framed the consultation as "an opportunity to promote a collaborative and transparent process" with experts, organizations, and citizens.

The opening of the consultation phase is the first formal post-enactment guidance step. Adult content platforms now have a roughly six-week window to submit positions on key implementation ambiguities — particularly which biometric-and-document age-verification mechanisms the ANPD will accept as "effective and reliable," and how the geographic scope rules apply to non-Brazilian operators serving Brazilian users via VPN-routed traffic. The June 15 deadline lands almost a month after the U.S. TAKE IT DOWN Act's May 19 platform compliance deadline, creating an unusually compressed mid-2026 schedule for global platforms juggling parallel compliance regimes in Brazil, the U.S., the U.K., the EU (DSA), and Australia.

New Sources