On August 11, 2026, Brazil's data protection authority, the ANPD, published Decision Order CD/ANPD No. 122/2026. It fixed the deadline and minimum content for the semiannual transparency reports required by Article 31 of the Digital ECA (Law 15.211/2025), Brazil's children's online safety statute. Providers directed at, or likely to be accessed by, minors with more than one million registered child and adolescent users in Brazil had to publish their first report by September 17, 2026. This piece looks at whether the design is sound.
What the order requires
The statute requires these providers to produce reports in Portuguese and publish them on their own websites (Law 15.211/2025, Article 31). ANPD's contribution was to settle two open questions. The first was timing. ANPD said the deadline runs from the date the law completes one year, which is September 17. The law was signed on September 17, 2025 and entered into force on March 17, 2026. The second was the reporting window. The first report covers January 1 to June 30, 2026. A provider without systematized data for January and February may instead report March 17 to June 30 (ANPD).
The minimum content includes complaint channels and investigation processes, complaint volumes, content and account moderation by type, measures to identify child accounts and unlawful acts, privacy and data-protection improvements, parental consent mechanisms, and risk-assessment results. ANPD also asks providers to email a copy to its monitoring address. Later reports are due February 1 for the second half of the year and August 1 for the first half, according to the same ANPD notice. A Baker McKenzie summary of the order matches these points.
The strongest case for the rule
The best argument for mandatory reporting is that regulators cannot govern what they cannot see. Platform child-safety claims are self-reported, and each company defines its own metrics. A standardized, public, recurring disclosure lets ANPD, researchers and parents compare services on the same terms. The statute also gives ANPD real leverage. Article 35 allows warnings, fines of up to 10% of a provider's Brazilian group revenue, suspension and prohibition of activity. Where there is no revenue, the fine is R$10 to R$1,000 per registered user, capped at R$50 million per infraction. A duty backed by those sanctions will be taken seriously.
This is also the least intrusive instrument in the Digital ECA. A report does not require removing lawful speech, verifying every user's age or weakening encryption. If Brazil is going to regulate child safety, a duty to publish is the kind that should come first.
What is well designed
- A size threshold. The one-million-child-user trigger in Article 31 exempts small forums, hobby communities and early-stage startups, which could not absorb a compliance function. Proportionality is built into the statute.
- Publication, not just filing. Reports go on the provider's own website. Public exposure disciplines behaviour more cheaply than a private filing to a regulator.
- Clarity on dates. Settling how the one-year clock runs removes a real legal uncertainty. It arrived about five weeks before the deadline, which is tight for companies compiling six months of data, but it arrived.
Where the design is risky
First, moderation counts can become a scoreboard. The reports must state how much content and how many accounts were moderated, by type. A regulator and press reading a large removal number as diligence will push providers toward removing more. That pressure adds to one already building. The Supreme Court's reworked intermediary-liability regime brings notice-and-takedown and duty-of-care obligations, and EFF has warned that such measures "can create problematic incentives for enforcement overreach and over censorship of protected speech." In the ANPD summaries I reviewed, the minimum content does not mention appeals, reinstatements or error rates. Those figures are the counterweight. A report that shows removals without showing how many were reversed rewards over-removal.
Second, the scope test is open-textured. "Likely to be accessed" by minors is a judgment call. General-purpose services with large teenage audiences may find themselves in scope, while others with similar audiences may not. The one-million threshold applies to registered users in the age group, so a provider must know its own minors, which is a data-collection problem in itself and sits uneasily with data minimisation.
Third, category definitions are unstandardized. If "complaint", "notification" and each moderation "type" mean different things at different companies, the first cycle produces incomparable data. Comparability was the whole justification for the duty.
Fourth, the sanction ceiling is out of proportion for a paperwork failure. A 10% revenue fine is defensible for serious child-safety failures. It is not defensible for a late or incomplete disclosure. Article 35 lists warnings with up to 30 days to correct, and ANPD should treat that as the default for reporting lapses. Its own one-year review says intensified enforcement is planned from 2027, so it has time to publish sanction guidance for transparency failures first (ANPD).
What to watch
I could not find an ANPD tally of how many providers published by September 17, so compliance is unverified. Three things will show whether this becomes evidence-based regulation or performative reporting. The first is whether ANPD publishes a common methodology or template before the February 1, 2027 cycle. The second is whether it collects the reports in one public place. The third is whether it asks for appeal and reinstatement data alongside removal data. ANPD's complaint channel had received roughly 200 reports since its June launch, per the same one-year review. That is a small base from which to infer systemic failure, and platform reports should help fill the gap.
Brazil has picked the right first instrument. Disclosure regimes work when the numbers describe outcomes, such as harm reduced and lawful speech preserved. They fail when the numbers describe activity, such as items removed and accounts closed. ANPD has a second reporting cycle to decide which kind it is building.