BrazilEstatuto Digital da Criança e do Adolescente (ECA Digital)
Lei nº 15.211, de 17 de setembro de 2025
In force since .
An age-appropriate design code rule binding private bodies.
- Audit expectation
- periodic
- Who audits it
- Self
- Where the report goes
- Published, Produced on request
What it requires
- Applies to any information-technology product or service (internet applications, software, terminal operating systems, app stores, connected games) directed at children or adolescents in Brazil or likely to be accessed by them, wherever the provider is located.
- Observe duties of prevention, protection, information and security, taking the best interest and integral protection of the child or adolescent as the guiding standard (Art. 5).no control in the NIST Privacy Framework
- Implement your own mechanisms to prevent children and adolescents from accessing content unsuited to their age range, independently of the measures an app store or operating system adopts (Art. 14).no control in the NIST Privacy Framework
- Provide parental-supervision tools (Arts. 16 to 18), and do not design, modify or manipulate an interface to undermine a user's autonomy or decision-making where that weakens those tools or safeguards (Art. 18, para. 2).no control in the NIST Privacy Framework
- If you provide an app store or terminal operating system, take proportionate, auditable and technically secure measures to assess users' age or age range, let parents configure voluntary supervision, and make an age signal available to app providers through a privacy-by-design API limited to this law's purposes (Art. 12).NIST Privacy FrameworkCT.PO-P2
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureNo
Penalty structure
Article 35, II states the fine as a simple fine of up to 10% of the economic group's revenue in Brazil in its last fiscal year, or, absent revenue, a fine of R$10.00 to R$1,000.00 per registered user of the sanctioned provider, but limits the total to this fixed cap per infraction.
- Rule
- Fixed only
- As of
- Currency
- BRL
- Fixed cap
- 50,000,000
Who enforces it
Enforcement body
The Agência Nacional de Proteção de Dados (ANPD), designated by Decreto nº 12.622/2025, art. 2, as the autonomous administrative authority for the protection of the rights of children and adolescents in the digital environment under article 2, X of Lei nº 15.211/2025
What it reaches
Age threshold
18
Covered services
Any information-technology product or service, including internet applications, computer programs, software, terminal operating systems, app stores, and connected electronic games, directed at children or adolescents in Brazil or likely to be accessed by them, regardless of the provider's location
How the hook was established
express
What makes it apply
Market targeting
Obligation class
Design code, Age verification, Disclosure
Verification methods
Device signal
What it makes you log
Who may demand the log
Regulator
Logging duty
Article 12, I requires app stores and terminal operating systems to assess age by measures that are 'auditáveis' (auditable), which presupposes a trace that can be checked, and Article 31 requires large providers to publish semi-annual reports that count complaints received and moderation actions by type. The Law names no record of an age check. Article 13 limits data collected to verify age to that purpose and bars any other processing, but sets no retention period.
- Kind
- Implicit
- As of
- Provision
- Lei nº 15.211/2025, art. 12, I (with art. 31)
- Trigger
- age_assurance
What this law does
Lei nº 15.211/2025 applies to any information-technology product or service directed at children or adolescents in Brazil, or likely to be accessed by them, regardless of the provider's location, development, manufacture, offer, marketing, or operation. Article 5 requires such a product or service to observe duties of prevention, protection, information, and security, adopting the child's or adolescent's best interest and integral protection as the guiding standard.
Article 11 lets the public authority act as regulator, certifier, or promoter of age-verification technical solutions.
Article 12 requires app-store and terminal operating-system providers to take proportionate, auditable, and technically secure measures to assess users' age or age range, to let parents or legal guardians configure voluntary parental-supervision mechanisms, and to make an age signal available to internet application providers through a privacy-by-design Application Programming Interface, limited to this law's purposes.
Article 14 requires the product or service provider itself, independently of the measures app stores or operating systems adopt, to implement its own mechanisms to prevent children and adolescents from accessing content unsuited to their age range. Articles 16 to 18 require parental-supervision tools, and article 18, § 2º prohibits designing, modifying, or manipulating an interface to undermine a user's autonomy or decision-making where doing so weakens those supervision tools or safeguards.
Article 35 authorizes an advertência, a simple fine of up to 10% of the economic group's revenue in Brazil in its last fiscal year, or, absent revenue, a per-registered-user fine, capped in total at R$50,000,000.00 per infraction, temporary suspension, or prohibition of activity, enforced by the Agência Nacional de Proteção de Dados (ANPD), which Decreto nº 12.622/2025 designates as the autonomous administrative authority for the protection of children and adolescents in digital environments.
Article 36-A, added by Lei nº 15.504, de 15 de setembro de 2026, directs the money from fines imposed under this law, for 5 years, to the Fundo Nacional para a Criança e o Adolescente, to be used in policies and projects to protect children and adolescents. The law's article 41-A entry-into-force date was set at six months after publication by Medida Provisória nº 1.319/2025 and then fixed at by Lei nº 15.352/2026, and the law has bound covered providers from that date.
When LexLint raises it
When your app profile says your app serves under-18s, operates an app store or ships a mobile app.
Back to the example · Lint your app
Page updated .