Brazil lays out preliminary guidelines for biometric age assurance under Digital ECA

Brazil’s data watchdog has published preliminary guidelines for adopting age-assurance technology to restrict underage users from products and services. The guidelines recommend caution with methods based on facial biometrics, due to “surveillance risks, algorithmic biases, and excessive collection of sensitive data.

​The guidelines, published by the National Data Protection Agency (ANPD) last Friday, lay out general requirements for implementing the Digital ECA (Digital Statute for Children and Adolescents), Brazil’s landmark child-safety law, which came into force on March 17th.​

The Digital ECA will ensure young people can be online safely, President Luiz Inácio Lula da Silva declared while signing the law.

“At the same time, we are putting an end to criminals who physically and mentally threaten children and adolescents,” he says.

According to the rulebook, organizations such as gaming, social media, and adult entertainment companies must implement age-assurance methods beyond self-attestation. Penalties include fines of up to 50 million Brazilian reais (US$9.44 million) or up to 10 percent of the non-compliant business’s revenue earned in Brazil.​

Organizations should choose the most appropriate method not just based on the accuracy of age verification, but also compatibility with users’ rights and personal data protection requirements, the ANPD recommendations note. Biometric methods need more robust justification for implementation, especially when there are less intrusive alternatives capable of achieving an equivalent result.​

Companies should also identify and assess the risks associated with the age verification mechanism, particularly when it involves the processing of biometric data. When the age verification solution involves the processing of biometric data, appropriate and specific security measures must be adopted, says the document.​

The definitive guidelines are expected to be published in August 2026, following public consultations, according to the ANPD.

The agency began monitoring the compliance of digital product and service providers in 2025 and plans to expand its activities in the coming months. In the first stage, starting immediately, ANPD will monitor app stores and proprietary operating systems. The second stage will start in August and include other sectors or supplier groups.

Last week, ANPD also published an edition of its Technology Radar publication series focused on age assurance from a Brazilian perspective.

Article Topics

age verification  |  ANPD  |  biometric age estimation  |  Brazil  |  children  |  data protection  |  Digital ECA