Brazil age verification law: the Digital ECA

Since 17 March 2026, services with content unsuitable for under-18s must check age reliably at each access, and ticking a box is not allowed.¹ App stores and operating systems must check age too.¹

Checked 1 November 2026 against the sources.

What the law requires, and of whom

Law 15.211 of 17 September 2025, the Digital Statute of the Child and Adolescent, applies to any digital product or service aimed at, or likely to be used by, children and teens in Brazil, wherever the company is based.¹

In force since 17 March 2026, as of 1 November 2026. This page describes the law and its decrees. It is not legal advice.
Who	What the law requires	Article
Services with adult content	Effective measures to keep under-18s out, with reliable age verification at each access. Self-declaration is not allowed. Pornography counts as unsuitable.¹	Art. 9
Porn services	Must stop children and teens from creating accounts or profiles.¹ The 2026 decree adds that minors must not see even previews, images, titles or captions.²	Art. 9, decree art. 16
App stores and operating systems	Check the age or age range of users, offer parental supervision, and send apps an age signal through a secure interface. Children and teens need a parent's consent to download apps, and silence does not count as consent.¹	Art. 12
Apps and sites likely used by minors	Receive the age signal, and still run their own checks to keep minors from content unsuitable for their age.¹	Art. 14
Social networks	Accounts of children and teens up to 16 must be linked to a parent's or guardian's account.¹	Art. 24

The age signal from phones and computers

Brazil puts part of the check on the device. The law defines an operating system as system software that controls a device's basic functions and lets apps run on it.¹

What the store or system must do

Ask for your age or age range when you create an account, check it with a reliable method set by the regulator, preferably verifiable credentials, let you contest the result, and take steps against duplicate accounts made to get around the check.²

What the signal may say

Only what is needed to confirm the minimum age for a service. It may not include your exact date of birth, your identity or profiling data, and it must be free for apps.² If an app's own check disagrees with the signal, it must take the more protective option.²

What may be kept

Data collected to check a child's or teen's age may be used only for that purpose.¹ The decree goes further for ID documents: only the age or age range may be used, and the image or copy of the document must not be stored and must be deleted immediately and irreversibly once the age is read.² What other laws let sites keep

Who enforces it, and the penalties

The data protection agency, ANPD, was named the enforcer on 17 September 2025.³ It can issue warnings and fines. Suspending or banning a service is for the courts, carried out by blocking orders to internet providers.^{1, 3}

Penalty	Detail	Imposed by
Warning	Up to 30 days to put things right¹	ANPD
Fine	Up to 10% of the group's revenue in Brazil in its last financial year. Without revenue, R$10 to R$1,000 per registered user, capped at R$50 million per violation.¹	ANPD
Suspension or ban	Temporary suspension, or a ban on the activity, enforced by blocking orders sent through Anatel, the telecoms regulator, and CGI.br for .br domains^{1, 3}	Courts

Mar 2026ANPD publishes preliminary guidance on reliable age assurance and starts monitoring app stores and proprietary operating systems first.⁴
Jul 2026Apple (App Store), Google (Play Store) and Microsoft (Windows) were to send ANPD documents on their systems, data flows and age checks by July.⁴
Aug to Nov 2026An adaptation period while ANPD monitors how age checks are rolled out.⁴
Jan 2027Enforcement actions planned to start, with age checks a focus.⁴

This is ANPD's plan as published on its Digital ECA page, last updated 10 June 2026, not a record of what has happened.⁴

Questions people ask

When did Brazil's age verification law start?

On 17 March 2026. The law was signed on 17 September 2025, and Law 15.352 of 2026 fixed the start date.¹

Does the law cover operating systems, including on computers?

The law puts duties on providers of app stores and of operating systems for devices, without listing device types.¹ ANPD's first round of monitoring named the App Store, Google Play and Windows.⁴

Can a site just ask if you are 18?

Not for content unsuitable for under-18s. The law requires reliable age verification at each access and bans self-declaration.¹ How age checks work

Does the law allow mass surveillance to check ages?

It says the opposite: no regulation under it may authorize or lead to mass, generic or indiscriminate surveillance.¹

Sources 4

Lei nº 15.211, de 17 de setembro de 2025 (Estatuto Digital da Criança e do Adolescente), consolidated text, Presidency of Brazil. Read 1 November 2026 from the Internet Archive copy of 22 October 2026.
Decreto nº 12.880, de 18 de março de 2026, Presidency of Brazil. Read 1 November 2026 from the Internet Archive copy of 17 October 2026.
Decreto nº 12.622, de 17 de setembro de 2025, Presidency of Brazil. Read 1 November 2026 from the Internet Archive copy of 18 October 2026.
ECA Digital, including the age assurance timeline (last updated 10 June 2026), Agência Nacional de Proteção de Dados (ANPD). Read 1 November 2026.

Every fact here comes from the law, its decrees or the regulator, checked again and dated. How we check