The guide shows when likely access under the ECA Digital brings services designed for adults within the scope of the statute.
On 28 October 2026, the ANPD (Brazilian National Data Protection Authority) published the Guidance Document “Suppliers of information technology products or services: scope and general obligations under the ECA Digital”, addressing the scope and the general obligations set out in Law No. 15,211/2025 (the ECA Digital, the Digital Child and Adolescent Statute). In practice, the document clarifies that services designed for adults may also become subject to the statute where children and adolescents are in fact likely to access them. The guide is advisory in nature and does not create any new rule.
When likely access under the ECA Digital reaches your service
The guide requires an assessment of how the product actually operates. An application may state that it is intended for adults only. If it features videos, games, rewards or forms of interaction that appeal to adolescents, the picture changes.
The ANPD requires three criteria set out in Article 1 of the statute to be analysed together:
- the appeal to, and the likelihood of use by, children and adolescents;
- the ease of access and of use;
- the existence of significant risks to the privacy, safety or development of children and young people.
In addition, social networks, application stores and operating systems are, as a rule, already regarded as being subject to likely access. Each case, however, has its own particularities.
Declaring that the audience is adult is not enough
The company’s statement as to the age of its users does not, in itself, determine whether the statute applies. The ANPD may assess the actual characteristics of the service and reach a different conclusion. Likewise, implementing age verification does not displace the remaining obligations. Indeed, that tool is usually one of the measures required.
Prevention from the product design stage
The duty of prevention prevents the company from waiting for a violation to occur before acting. It must identify risks, measure the likelihood and severity of the harm and adopt measures to avoid it. It must then monitor and improve those measures.
The guide divides the duty into four dimensions: prevention, protection, information and security. The measures include more protective privacy settings, age assurance, parental supervision, content moderation and action against compulsive use. The obligations vary according to the activity, the size of the undertaking and the number of users. A large social network and an educational application are therefore not subject to the same requirements.
It is our understanding that technology companies with a mixed audience should already be documenting the risk analysis of each product, since the guide places weight on evidence of the effectiveness of the measures adopted. Finally, it is worth reviewing whether the service holds itself out as adult-only while attracting young people.
Read further legal news commented on by the firm and the articles by Moraes de Freitas Advogados.