Goiás

Complementary Law 205 of 2025 institutes the state policy to stimulate the development of innovation in artificial intelligence in Goiás. In automated decisions, people have a right not to be discriminated against unlawfully and to prior, free, accessible and easily understood information about the use of the system, its purpose and the automated character of the interaction.

Article 8 does not apply to systems used solely for security, cyberdefense or military purposes, to systems that take no part in decisions or take none that affect the legal sphere of third parties, or where a human takes the final decision. The Law forbids developing, implementing or using an AI system whose purpose is contrary to fundamental rights, public order, the guiding principles of the democratic rule of law or the security of public institutions.

Outside experimental contexts, autonomous AI agents must meet minimum mandatory requirements: transparency about their artificial nature and autonomous decision-making capacity, effective mandatory human supervision, and, when they operate under that supervision, periodic technical audits by independent accredited third parties.

Developers, operators and distributors of embedded (edge) AI must meet five mandatory requirements: transparency to end users, reinforced cybersecurity, periodic independent audits for devices in critical areas, human supervision and intervention with remote shutdown where technically feasible, and clear technical documentation. Users of AI in state public services have rights to a reasoned decision, to contest and obtain review of it, and to human review on appeal.

Complementary Law 215 of 10 September 2026 moved the Núcleo de Ética e Inovação em Inteligência Artificial into the administrative structure of the Secretariat of State for Science, Technology and Innovation (SECTI), which now chairs it.

A biometric identification system at the entrances and an image-monitoring system over the whole common-use area are mandatory in football stadiums with a capacity above 10,000 people in Goiás on days of football matches.

The biometric system is used to build a database of people with a history of violence in and around stadiums and to cross it in real time with databases made available by security bodies, such as those of people barred from the vicinity of stadiums, fugitives, arrest warrants, members of organized supporter groups and other databases of public security bodies and the Judiciary.

The information in the database must be kept for at least five years, under the responsibility of the stadium owner, and made available to the state security bodies, the Judiciary and the Public Prosecutor's Office on request. Sharing or using the database for any purpose other than those the Law provides is forbidden. Entry to a football stadium is forbidden to a person convicted by a final judgment of violence inside or around stadiums.

The cost of acquiring, installing and maintaining the equipment and software falls on the budget appropriations of the stadium owners.

A supplier of products or services as defined in the federal Consumer Defense Code, a public or private person, a financial institution included, may not pass on, share, disclose, sell or transfer a consumer's personal information to anyone else, even free of charge, without the consumer's express consent. The consumer may revoke the consent at any time. The consumer may also limit the privacy to particular items of personal information.

Where the consent is obtained through an adhesion contract, it must be given in a clause drafted with emphasis that is easy to understand at once. The Law does not apply to information covered by secrecy, or to the relationship between the supplier and whoever keeps a consumer database or registry under article 43 of the federal Consumer Defense Code.

A breach carries a fine of R$ 1,000 to R$ 500,000, set by the seriousness of the infraction and the number of consumers involved, and paid double on a repeat breach.

A supplier of products or services, which under the federal Consumer Defense Code may be a public or private person, may not ask a consumer for personal data abusively, which means demanding the data in a way that does not comply with federal law, above all the General Personal Data Protection Law (LGPD).

A supplier may offer special conditions and advantages in return for the consumer's consent to the processing of personal data, provided that the consumer is told the purpose of the processing and the supplier observes good faith, transparency and the other principles of article 6 of the LGPD, and that the consumer is told whether the personal data will be shared and with which public or private entities.

If the consumer refuses to provide the personal data, the supplier must tell the consumer the consequences of the refusal, and the special conditions and advantages are not guaranteed. A breach carries the sanctions of article 56 of the federal Consumer Defense Code and of article 52 of the LGPD, as far as they apply.

Article 1 institutes the State Policy for the Protection of Children and Adolescents against Harmful Games and Dangerous Challenges in Virtual Environments, with the objective of preventing, identifying and combating practices that put the physical and mental integrity of children and adolescents at risk. Article 3, item IV, makes it a guideline to stimulate the availability of channels for reporting cases or suspected involvement in harmful games and dangerous challenges.

Article 3, item VI, makes it a guideline to stimulate parents' awareness of the importance of using applications and tools that let them monitor their children's browsing. Article 5 has the Executive Branch regulate the Law and set the way the policy is monitored and evaluated. Article 6 enters the Law into force on the date of its publication.

Article 1 institutes the State Policy of Parental Control of the Access of Children and Adolescents to the Internet. Article 2 states the policy's objective as promoting the safe and responsible use of the internet by children and adolescents. Article 4, item II, makes it a guideline of the policy to stimulate the development and implementation of parental control and filtering tools for improper content on electronic devices that children and adolescents use.

Article 4, item VII, makes it a guideline to stimulate cooperation with internet service providers and digital platforms to protect the data and privacy of children and adolescents. Article 6 requires the state public authority to establish ways of monitoring and evaluating the policy. Article 7 enters the Law into force on the date of its publication.

Article 1 institutes the State Week of Awareness of the Use of Social Networks by Children and Adolescents, to be held every year in the second week of October. Article 2, item I, sets as an objective of the Week to spread information and guidance on the conscious and responsible use of social networks. Article 3 provides that, during the Week, activities aimed at awareness of the use of social networks by children and adolescents are to be stimulated. Article 5 enters the Law into force on the date of its publication.