A tragedy, and a regulator under pressure
The strongest case for Brazil's action is a human one. A 13-year-old girl from Mato Grosso do Sul died on 22 July 2026 after reportedly being induced to self-harm during a live stream, and Brazilian police are investigating a group suspected of encouraging self-harm and suicide through the platform. Congresso em Foco reports that ANPD cited SaferNet data showing complaints about Discord rising 54% in the first seven months of 2026, from 264 to 406. A regulator that did nothing after that would be failing its mandate.
ANPD, Brazil's data protection authority, opened an inspection on 7 August and on 12 August ordered Discord to suspend Go Live and functionally equivalent video-sharing features within three business days. On 24 September, per the news hook, it rejected Discord's request for reconsideration. Its technical note says Discord's end-to-end encryption on voice and video, enabled in March 2026, leaves the company unable to see or moderate live streams. ANPD says this conflicts with the ECA Digital, Law 15.211/2025, which extends child-protection duties to digital services likely to be accessed by minors.
What ANPD is actually saying about encryption
The agency's reasoning, as reported, is that Discord cannot run automated detection on streams it cannot read, and so depends on user reports. Hardware.com.br reports that ANPD considers the measures presented so far insufficient. It also reports that ANPD reads the rollout of Discord's DAVE audio/video encryption protocol as having hindered oversight after the ECA Digital took effect. Discord replies that DAVE was announced in 2024 and its timeline was set earlier.
This is the part that matters beyond Discord. Regulators are not banning encryption outright. They are saying that a design which prevents the provider from inspecting live content cannot satisfy a duty to prevent harm to children. That is a de facto encryption penalty even if the word never appears in the order.
Why that logic is wrong
First, it proves too much. Any end-to-end encrypted service, from messaging to video calling, is unreadable by its operator. If inability to inspect is itself non-compliance, every such service in Brazil is exposed, and so are the ordinary users who rely on encryption against fraud, stalking and state overreach. As EFF argued this week in its podcast episode on encryption's legal history, today's secure internet was won in court, not given by default.
Second, the harm in this case, as Discord argues, was coordinated across other platforms and in small groups. Discord told Brazilian press that a server linked to the case had 51 unique accounts over about two hours, not a public broadcast to hundreds. The risk here is targeted grooming and coercion, which are better addressed by account-level and behavioural controls than by reading every video frame: age assurance, default restrictions on streaming from unknown adults, friction on new-contact streaming, fast human escalation, and rapid cooperation with police on metadata and reports.
Third, a blanket suspension hits unrelated users. Discord says the measure affects families, students, communities and businesses outside the cases under review. Voice-only calls and text remain available, but a nationwide feature removal is a blunt tool.
The legal question is not a technicality
Discord argues that the ECA Digital lets ANPD issue warnings and fines, while temporary suspension or prohibition of activities needs a court, and that a nationwide measure should come from the Board of Directors rather than the Superintendency of Inspection. The ECA Digital text sits on the Planalto site, and that is where the dispute will be resolved. ANPD's own framing is that the measure is precautionary, and it says fines of up to R$ 50 million per infraction remain possible if violations are confirmed.
A proportionate reading would respect both points. Urgent interim protection for children is legitimate, and a regulator should be able to act quickly. But the power to switch off a product feature for an entire country should rest on explicit statutory authority and board-level accountability, precisely because it will be reused against other services. The appeal now heading to the Board is the right forum, and the outcome will set the template.
What a better outcome looks like
Discord has offered a compliance plan, objective criteria for gradual restoration, and a Termo de Ajustamento de Conduta (a conduct adjustment agreement). ANPD wants technical records, configurations, tests or architecture documents, and prior authorisation before reactivation. There is a workable deal in the overlap: verifiable safeguards that do not require breaking encryption.
- Publish measurable outcome tests (time to action on reports, share of minors' accounts with restricted streaming) rather than a capability test of whether the provider can view content.
- Allow phased, auditable reactivation, for example streaming limited to verified-adult or mutually connected accounts.
- Make clear in guidance that end-to-end encryption is compatible with the ECA Digital where equivalent risk controls exist.
The alternative is a precedent in which a safety law becomes an encryption mandate by administrative inference. That would not make Brazilian children measurably safer, and it would make everyone's communications less secure.
The bottom line
Brazil is right to demand that platforms take child safety seriously, and ANPD is right to demand evidence rather than assurances. But the standard should be demonstrated risk reduction, not visibility into private streams. The Board of Directors should resolve the competence question openly, keep any suspension time-limited, and tell companies plainly what a compliant, encrypted design looks like.