Brazil has moved from drafting its child online safety regime to operating it. Law 15.211/2025, the ECA Digital, has been in force since 17 March 2026, and the National Data Protection Authority (ANPD) is now both its enforcer and a full regulatory agency. In a post published on 21 October 2026 summarising comments it filed with the ANPD during 2026, the Electronic Frontier Foundation said that data privacy and free expression must underpin how the agency regulates platforms. Our reading is that this raises a question the official materials we reviewed leave unanswered: will the new rules keep working for people who cannot easily prove their age?
The case for the regime
The strongest argument for the ECA Digital is that self-declaration of age protected no one. Under the law, children's profiles default to maximum privacy, behavioural data on minors cannot be used for targeted advertising, and loot boxes and continuous-scroll features are restricted, according to the Ministry of Human Rights's one-year review. Enforcement is real: that review reports that the ANPD opened a supervision process against Discord and temporarily suspended its live streams in Brazil. A regulator that cannot verify age cannot enforce any of this, so some form of age assurance is a reasonable demand.
What the ANPD has set in motion
The ANPD published preliminary guidance and a monitoring schedule on 20 March 2026. Its announcement says the first stage, starting immediately, covers app stores and proprietary operating systems. It also says implementation should be "compatible with the rights to privacy and personal data protection of children and adolescents."
The agency's English-language ECA Digital page lays out the rest of the timeline:
- Stage I, from March 2026: Apple, Google and Microsoft were to submit information by July.
- Stage II, from August 2026: publication of guidelines.
- An adaptation period from August to November 2026.
- Updated enforcement regulations from November 2026.
- Stage III enforcement from January 2027.
The age-assurance guide was open for public contributions until 9 July, and the agency plans to update it by the end of the third quarter of 2026. Mattos Filho summarises the same consultation and update path for practitioners.
The legal footing is also new. Law 15.352 of 25 February 2026 turned the ANPD into a regulatory agency, per the same ANPD page. The timing leaves little room for error: the agency is building institutional capacity at the same moment it is writing rules for some of the largest platforms in the world.
What EFF asked for
In its post, EFF argues against a blanket approach. Age restrictions, it says, should apply only to products and services already categorised as inadequate or prohibited for minors, with safeguards against subjective and overbroad interpretation. EFF treats access to information, participation in society and access to technology as part of the "best interests of the child."
On privacy, EFF warns that zero-knowledge proofs alone do not guarantee strong protection. It recommends unlinkability, selective disclosure, batch issuance and on-device processing. It also asks for minimal information to be shared with verifiers and no "phoning home" to the credential issuer. EFF further asks the ANPD to treat non-dominant providers, such as federated networks and free software apps, differently, and to scale prevention duties so they do not become general monitoring obligations.
These are engineering-level demands, and they are the right ones. A verification system that creates a central log of who accessed what is a surveillance system with a child-safety label.
The inclusion gap
The documents we read do not address a further question. The ANPD announcement, its English page and the ministry reviews we examined do not mention accessibility, disability, low connectivity or alternative verification routes. That is our finding about those pages, not a claim that the ANPD ignores the issue elsewhere. The ANPD's consultation materials may cover it, and we could not review them in full.
The omission matters because age-assurance methods carry different failure modes for different people. Face-based estimation can fail for users with certain facial differences or motor conditions. Document-based checks exclude people without current ID. Credential schemes that need a recent smartphone or a stable connection exclude users on older devices or patchy networks. In a country where many people rely on shared or low-end phones, a method that works in a São Paulo office may not work in a rural municipality.
None of this is an argument against age assurance. It is an argument for proportionality. A rule that is cheap to satisfy for the median user and impossible for an unlucky minority is not proportionate, even if every individual design choice looked reasonable.
What proportionate enforcement looks like
Four practical commitments would let the ANPD protect children without shutting out adults and teenagers who have a right to access information:
- Method plurality. Platforms should offer more than one route, so that failing one check does not mean losing access.
- Accessibility testing. The ANPD should ask providers for evidence of testing with disabled users and on low-end devices before treating a method as "reliable."
- Data minimisation. Verifiers should learn only that a user clears a threshold, as EFF recommends, and nothing more.
- Narrow scope. Restrictions should attach to genuinely age-inappropriate products, not to whole platforms, so that minors keep access to educational and community resources.
The adaptation window between August and November 2026 is where these choices will be made, before the January 2027 enforcement stage. The ANPD's own timeline shows that the decisive rules are still being drafted, and that is the moment for inclusion to be built in rather than patched afterwards.
Brazil has a credible chance to show that child protection and an open internet can coexist. Whether it does will depend less on the headline law than on whether the agency measures success by who is kept out as well as who is screened.