Brazil data regulator gets agency status just in time for age verification fight

Brazil’s National Data Protection Authority, the ANPD, has new status as an independent regulatory agency, and a big first task. The regulator will oversee the development and implementation of the country’s incoming age verification and online safety law.

Provisional Measure No. 1.317/2025 gave the ANPD an official statutory role at the end of September equivalent to the regulators in areas like energy, health and telecommunications, IAPP reports. The change gives the ANPD enforcement powers, notably including over the Digital ECA.

The lack of enforcement powers has not prevented the ANPD from exercising conducting investigations, such as the one into biometrics use at soccer stadiums, and issuing orders, like earlier this year when it told World parent TfH to stop offering financial compensation for biometric data.

Introducing the Digital ECA’s parental consent wrinkle

The Digital ECA comes into force on March 17, 2026 with requirements for businesses to have risk mitigation policies and user-friendly parental controls available in Portuguese, implement reporting systems and in the case of businesses with over a million Brazilian users produce transparency reports. Penalties are up to 10 percent of the non-compliant business’ revenue from the country, or 50 million Brazilian reals (approximately US$9.1 million) per violation. Eventually, repeat offenders could be suspended or banned.

Age verification must be in place to ensure the accounts of children below 16 are linked with one belonging to a parent or guardian.

The law leaves the door open for a certification scheme for age assurance, and does not take any position regarding facial age estimation or age inference.

The ANPD has also been running a consultation on the Digital Statute for Children and Adolescents (Digital ECA), which continues through this Friday, December 12.

The ANPD has also been in consultation with the UK’s Ofcom, which is responsible for enforcement of that nation’s age assurance and online safety laws. Brazil’s new law follows the UK’s Online Safety Act, Australia’s OSA and the EU’s Digital Services Act in building age checks into a larger overall framework of responsibilities for businesses targeting or providing services to children online. Australia’s new rules to keep teens below 16 off social media went took effect Wednesday.

mLex quotes Stefani Vogel, chief of staff at the Chamber of Deputies (Brazil’s lower legislative house), as saying the Digital ECA translates “safety by design” into concrete architecture, technical and policy characteristics.

Article Topics

age verification  |  ANPD  |  biometrics  |  Brazil  |  children  |  Digital ECA  |  regulation