BrazilECA Digital (Lei nº 15.211/2025), children's personal data and profiling
Also known as ECA Digital, Lei nº 15.211/2025 (Law No. 15,211 of 2025), Estatuto Digital da Criança e do Adolescente (Digital Statute of the Child and Adolescent).
In force since .
A sensitive categories rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Market targeting
- Obligation class
- Design code, DPIA, Prohibition
- Audit expectation
- on_request
As of .
What it requires
- Configure any product or service directed at children and adolescents, or likely to be accessed by them, by default to the most protective privacy and data-protection setting available, and do not process their personal data in a way that causes, facilitates or contributes to a violation of their privacy.
- When you process the data of children and adolescents, above all for purposes not strictly necessary to run the product or service, map the risks, make efforts to mitigate them and prepare a data-protection impact, monitoring and evaluation report to share when the authority requests it.
- Do not use profiling techniques to direct commercial advertising at children and adolescents.
- Do not build behavioral profiles of child and adolescent users from their personal data, including data obtained in age verification, to direct commercial advertising.
These lines are LexLint's reading of the law's text, as of .
What it makes you log
Who may demand the log
Regulator
Logging duty
The impact, monitoring and evaluation report in article 16, sole paragraph, item II cannot be produced without records of the processing, and it is to be shared when the authority asks for it. The article names no log, retention period or format.
- Kind
- Implicit
- As of
- Provision
- Lei nº 15.211/2025, art. 16, parágrafo único, II
- Trigger
- personal_data_processing
What this law does
Article 7 requires a provider of an information-technology product or service directed at children and adolescents, or likely to be accessed by them, to configure it by default to the most protective privacy and data-protection setting available, and article 7, paragraph 2 bars processing their personal data in a way that causes, facilitates or contributes to a violation of their privacy.
Article 16, sole paragraph, requires a controller processing their data, above all for purposes not strictly necessary to run the product or service, to map the risks and make efforts to mitigate them, and to prepare a data-protection impact, monitoring and evaluation report that is shared when the authority requests it.
Article 22 bars profiling techniques to direct commercial advertising at children and adolescents, and article 26 bars building behavioral profiles of them from their personal data, including data obtained in age verification, for that advertising. The law applies to a covered product or service regardless of where it is located, developed, made, offered, marketed or operated, and article 41-A fixed as the date it enters into force.
When LexLint raises it
When your app profile says your app processes personal data, serves under-18s or makes high-risk automated decisions.