Brazil enacts sweeping bill requiring online age verification, safeguards for children’s data

Brazilian President Luiz Inácio Lula da Silva on Wednesday signed a law requiring digital service providers to verify the ages of users and adhere to strict new data protection and privacy requirements for children and adolescents.

The Digital ECA mandates that tech companies take “reasonable measures” to block young users from accessing content which features violence, porn, sexual exploitation, drugs or gambling, as well as content that encourages self harm.

The law requires that “reliable” age verification mechanisms be used to ensure users of digital services containing inappropriate content are over age 18. Self-declaration is no longer adequate as part of the law.

It also orders that tech companies set up a “parental supervision mechanism” to ensure adults can “limit and manage the use of the service, the content accessed and the processing of personal data carried out.”

Platforms also cannot process children’s personal data in a way that violates their privacy or use their data for targeted advertising.

The measure, which overhauls a 1990 law, will take effect in March.

“Brazil has stepped forward as the first country in Latin America to pass a dedicated law to protect children’s online privacy and safety,” Hye Jung Han, children’s rights and technology researcher at Human Rights Watch, said in a prepared statement.

In June 2024, Human Rights Watch reported that personal photos belonging to Brazilian children were used to create artificial intelligence systems which were turned into deepfakes of other children being abused.