BrazilDecreto nº 12.880, de 18 de março de 2026, regulating the ECA Digital (arts. 14 to 30: age verification and age signals)
Decreto nº 12.880, de 18 de março de 2026
In force since .
An age-appropriate design code rule binding private bodies.
- Enforcement body
- The Agência Nacional de Proteção de Dados (ANPD)
- Audit expectation
- none
What it requires
- Applies, as the regulation of Lei nº 15.211/2025, to suppliers of information-technology products or services that make available content, products or services prohibited or improper for children and adolescents, to social network services, and to app stores and operating systems.
- If you make available content, a product or a service prohibited to children and adolescents (weapons, alcohol, tobacco, gambling, loot boxes, pornographic content, escort services, services for arranging sexual encounters), implement effective age verification mechanisms and effectively prevent access by children and adolescents (art. 15).
- For gambling, loot boxes, pornographic content, escort services and services for arranging sexual encounters, bar the creation of accounts and profiles by children and adolescents, and identify and remove accounts they operate (art. 15, § 2).
- If you make available pornographic content, your own or a third party's, adopt your own age verification mechanisms that ensure no access by children and adolescents, even in previews, images, titles or captions (art. 16, § 1).
- If a user is not registered, the age is not verified or the account is operated by a child or adolescent, hide, blur or do not display pornographic content by default, or require age verification to unlock it; self-declaration alone is not enough (art. 17).
- If you offer or intermediate the sale of weapons, alcohol, tobacco, addictive products, fireworks, gambling or loot boxes, implement effective age verification at registration, with purchases blocked by default and no unlock by self-declaration, or at the time of purchase (art. 18).
- If you operate a social network service that makes available content, products or services prohibited to children and adolescents, create versions without them or adopt effective age verification; self-declaration is not enough (art. 19).
- If you collect documents to assess age, keep only the age or the confirmation of the age range, and delete the image, the copy of the document and the information immediately and irreversibly after capturing what you need (art. 24, § 3).
- If you operate an app store or an operating system, provide users' age signals to application suppliers free of charge, limited to what is strictly necessary to confirm the minimum age and with no exact date of birth, civil identity or profiling data; ask for age or age range at account creation, assess age by a reliable method, allow the user to contest the result, and take measures against multiple accounts (art. 25, caput, §§ 1 and 2).
- If you operate an app store or an operating system, request the legal guardians' authorization before a child or adolescent downloads or installs an application, and tell the guardians the age rating assigned to it before they authorize (art. 25, § 3).
- If you supply a product or service that offers content improper, inadequate or prohibited for children and adolescents, receive the age signals from app stores and operating systems and adapt the product or service; if your own age assessment differs from the signal, apply the alternative that better protects children and adolescents, and give the user a way to contest the assessed age (arts. 26 and 27).
These lines are LexLint's reading of the law's text.
What it reaches
Covered services
Suppliers of information-technology products or services that make available content, products or services improper or prohibited for children and adolescents, including pornographic content, gambling, tobacco, alcohol and loot boxes, social network services, and app stores and operating systems that provide age signals.
Obligation class
Age verification, Design code, Retention
Verification methods
Device signal
What record it asks for
Log retention
- As of
- Basis
- Purpose bound
- Prohibits retaining
- The image, the copy of the document and the information collected from a document to assess age, beyond the age or the confirmation of the age range
Logging duty
- Kind
- None
- As of
What this law does
Decreto nº 12.880, de 18 de março de 2026, regulates Lei nº 15.211, of , the ECA Digital. The decree enters into force on the date of its publication. A supplier of information-technology products or services that makes available content, a product or a service prohibited to children and adolescents must implement effective age verification mechanisms and effectively prevent their access, enjoyment or consumption.
For gambling, loot boxes, pornographic content, escort services and services for arranging sexual encounters, the supplier must also bar the creation of accounts and profiles by children and adolescents and identify and remove accounts they operate. A supplier that makes available its own or third-party pornographic content must adopt its own age verification mechanisms that ensure no access by children and adolescents, even in the form of previews, images, titles or captions.
A supplier that allows pornographic images or videos to be viewed must, when the user is not registered, the age is not verified or the account is operated by a child or adolescent, hide, blur or not display the content by default, or require age verification to unlock it, and mere self-declaration is barred.
A supplier that offers or intermediates the sale of products and services prohibited to children and adolescents under article 15, paragraph 1, items I to VII, must implement effective age verification at registration, with purchases blocked by default and no unlock by self-declaration, or at the time of purchase so that a child or adolescent cannot complete the operation.
A social network service that makes available content, products or services prohibited to children and adolescents must either create versions without them, which dispenses with age verification, or adopt effective age verification mechanisms, and self-declaration is barred.
Data collected from documents for age assessment must be limited to the age or the confirmation of the age range, and the image, the copy of the document and the information may not be stored or retained but must be deleted immediately and irreversibly after the necessary information is captured.
App stores and operating systems must provide users' age signals to suppliers of information-technology products and services free of charge, limited to the data strictly necessary to confirm the minimum age required, with no exact date of birth, civil identity or user profiling data.
App stores and operating systems must also request authorization from legal guardians for a child or adolescent to download and install an application, and inform the guardians of the age rating assigned to the application before they authorize it. A supplier whose own age assessment differs from the age signal sent by the app store or operating system must take the measures corresponding to the alternative that better protects children and adolescents. The decree revokes Decreto nº 9.856, of .
When LexLint raises it
When your app profile says your app serves under-18s, operates a social platform, operates an app store or ships a mobile app.
Back to the example · Lint your app
Page updated .