ANDP publishes comprehensive guide to age assurance as Brazilian law takes effect

Brazil’s National Data Protection Agency, the ANPD, has published an edition of its Technology Radar publication series focused on age assurance. The document provides a wide-ranging and comprehensive overview of age assurance from a Brazilian perspective, as the country prepares to put its Digital Statute for Children and Adolescents (Digital ECA) into effect this week.

The Digital ECA (Law No. 15,211/2025) requires providers of information technology products or services directed at children and adolescents or likely to be accessed by them to adopt “mechanisms to provide age-appropriate experiences, respecting the evolving capacities and diversity of Brazilian socioeconomic contexts.” For social media, age verification must be in place to ensure the accounts of children below 16 are linked with one belonging to a parent or guardian.

Covered businesses must have risk mitigation policies and user-friendly parental controls available in Portuguese, implement reporting systems and, for businesses with over a million Brazilian users, produce transparency reports. Penalties include fines of up to 50 million Brazilian reals (US$9.44 million) or up to 10 percent of the non-compliant business’ revenue earned in Brazil. Repeat offenses can lead to shutdowns.

The ANPD was granted status as an independent regulatory agency in December 2025, and is responsible for rolling out the law. Its publication sums up the overarching problem as follows: “there is an urgent need to adopt age assurance mechanisms that protect children and adolescents from risks in digital environments, and the challenge of reconciling these mechanisms with the protection of personal data and the protection of privacy.”

The Technology Radar draws widely on precedent set elsewhere under various data protection laws, citing the Australian government’s Age Assurance Technology Trial, the ISO/IEC 27566 standard and the UK’s Age Appropriate Design Code, among other resources. Tracing the evolution of age assurance from self-declaration to the present moment, it runs through the various methods and their specifics, up to and including reusable cryptographic tokens and integration with sovereign digital identity wallets.

Data protection is identified as a key priority and core principle. “The search for age assurance solutions must respect principles such as data minimization, avoiding the unnecessary collection of sensitive information, such as biometrics,” says the publication. “Therefore, the main challenge is to develop technologies that effectively protect children and adolescents, preserve their fundamental rights, and align with the best interests of the child.”

The scope of the document, and its availability in English, both point to Brazil’s ambitions to be a global leader on age assurance, alongside Australia, the UK and the EU. Multiple countries in Latin America are adopting online safety regulations, but Brazil has perhaps the most established regulatory ecosystem in the region, having built some muscle through the introduction of regulated gambling.

Privately performs 350K age checks in a day in Brazil

Providers have been finding success in the region, and offering guidance on compliance.

Privately SA has logged its highest ever 1-day age estimations count, recording more than 350,000 age checks in under 24 hours. A social post from Deepak Tewari, CEO at Privately SA, says “Brazilians have overwhelmingly adopted Privately SA’s ‘On-device’ privacy preserving age checks!”

A post from Persona’s blog offers a guide for services that are covered by the law, which include companies that host adult content, advertise based on behavior, and offer gaming or social media features. Loot boxes, or virtual mystery rewards, are a particular target; Apple recently announced that apps identified to contain loot boxes through the age rating questionnaire for its Declared Age Range API will be given an automatic 18+ rating.

“The Digital ECA applies to you if your content is ‘provável de ser acessado,’ or likely to be accessed by users under certain age gates (e.g., 16 or 18),” it says. As such, it “expands the scope of other online safety guidelines, such as the UK’s Online Safety Act, which apply to services primarily targeting adults.”

The Digital Statute of Children and Adolescents formally comes into effect on March 17, 2026.

Article Topics

age verification  |  ANPD  |  biometric age estimation  |  Brazil  |  device-based age verification  |  Digital ECA  |  digital ID  |  Latin America  |  Privately