The National Data Protection Authority (ANPD) released a guide on Wednesday (28th) aimed at clarifying the responsibilities of technology companies regarding the safeguarding of children and adolescents on the internet. This material specifies which services must adhere to the Digital Child and Adolescent Statute (ECA Digital) and what measures must be implemented to mitigate dangers in the virtual space.
The guidelines cover a wide range of services, including social networks, messaging applications, electronic games, video platforms, app stores, operating systems, and e-commerce platforms. It is important to note that the application of these rules is not limited only to products developed for minors; general public services may also be covered if there is a possibility of access by children and adolescents.
The guide aims to elucidate the application of Law No. 15.211/2025, which established the Digital ECA, providing criteria for companies to recognize their obligations. This legislation came into effect in March 2026.
According to the ANPD, the protection of this demographic group must be integrated into both the development process and the operation of digital services. This implies that companies have a duty to proactively identify and reduce risks, rather than only reacting after an incident occurs.
A fundamental concept presented in the guide is that of 'probable access.' This definition allows for the inclusion of services that were not specifically designed for children and adolescents but possess attributes capable of attracting this audience and exposing them to significant risks.
The analysis takes into account three primary aspects. For example, an application may declare itself exclusive to adults, but if it offers videos, games, rewards, or forms of interaction that attract teenagers, the company's claim will not be sufficient to exempt it from the law's application.
The agency has the prerogative to analyze the actual characteristics of the service to define the applicability of the obligations. Furthermore, the ANPD clarifies that implementing age verification methods does not automatically nullify the other responsibilities stipulated in the law.
The guide emphasizes the need for efficient age verification mechanisms. A mere declaration of the user about their age or a notice in the terms of use is not sufficient to prove that the company fully complies with its obligations.
App stores and operating systems also have specific duties. One of these duties is to provide developers with information about the age range of users, assisting them in applying appropriate protective measures.
However, these mechanisms must always respect privacy. Age verification cannot be used as justification for collecting documents or personal data that exceeds what is strictly necessary.
Another crucial requirement is the adoption of more protective privacy settings by default. For children's and adolescents' accounts, companies must prioritize measures that minimize data exposure and inherent risks associated with platform use.
The guide also addresses restrictions on using minors' personal data for behavioral advertising purposes, in addition to requiring that data collection be limited to what is essential for the service's operation.
The duty of prevention is a central point highlighted by the ANPD. Companies must identify potential threats, measure the chance of harm, and implement actions to prevent or reduce such risks. Responsibility does not cease with the installation of a security tool; providers must also monitor the effectiveness of these measures and make adjustments when necessary.
Among the required actions are presenting terms of use and privacy notices in language that is simple, clear, and understandable to the youth audience. Platforms must also provide reporting channels and resources so that guardians can report risk situations.
The intention is to change the companies' approach: instead of relying solely on reports and subsequent corrective actions, protection must be considered from the product conception phase throughout its operational cycle.
The guide establishes that responsibilities will be assessed according to the specifics of each service, its size, the volume of users, and the company's capacity to influence the content and interactions offered. This allows for a proportional application of the law, without deviating from the main objective of protecting children and adolescents.
The ANPD also highlights the importance of the active participation of the companies themselves in complying with the regulations. Providers must be able to demonstrate that the adopted measures are effective and consistent with the risks of their products.
The publication serves to guide how the authority intends to conduct the application of the Digital ECA obligations. The document was improved based on contributions obtained during a public consultation held between April and June 2026, and includes practical examples, tables, and a flowchart to assist companies in identifying legal classification.
In summary, the guidance reinforces that the safety of minors on the internet cannot depend exclusively on family surveillance or voluntary initiatives by platforms; companies must also assume responsibility for the safety of the environments they build and manage.
