Law No. 15,211 of 2025 establishes protection rules for minors in the virtual environment in Brazil
The , called ECA Digital, comes into force in Brazil this Tuesday (17th March 2026). The text brings strict rules for the protection of minors in virtual environments, directly affecting technology companies, social networks and game developers.
In September 2025, , emerged to regulate targeted or “targeted” information technology products and services.likely access” to children. The basis of the standard is the principle of full protection and the vulnerability of the developing person. The law seeks to prevent commercial exploitation, abuse and digital violence committed against this public.
For the coordinator of the (Private Law and Vulnerabilities Center of the Faculty of Law of the Federal University of Minas Gerais), Mariana Lara, elements such as the probability of use, the attractiveness of the service (playful universe or accessible language) and the ease of access (free of charge or lack of entry requirements) will help the law enforcer to identify this likely access.
The professor stated that the public outcry accelerated the processing of important provisions, although the discussion is older. According to the specialist, who has a doctorate in Civil Law from USP (University of São Paulo) and a master’s degree from UFMG, the of public opinion around viral videos, such as that of the influencer –known as Felca–, it speeded up the legislative process.
PREVIOUS ADJUSTMENT
Before ECA Digital came into force, the protection of minors online was fragmented between different legal provisions. The Child and Adolescent Statute () already included concepts of full protection, but lacked specificities regarding the virtual environment. The Marco Civil da Internet () establishes general rules for the network, while only one article in the LGPD () concerns the processing of children’s data.
According to the professor, this diffuse legislation was insufficient to cover topics such as advertising and virtual items purchasable in electronic games, the “loot boxes” (reward boxes). “For the first time, Brazil has a specific law that celebrates the vulnerabilities of developing people and demands priority protection at all points of the digital environment”declared Mariana.
THE INNOVATIONS OF THE LAW
The new Brazilian legislation presents the concept of “likely access”. This means that platforms are not exempt from complying with the law just because they declare in their terms of use that they are aimed at people over 13 or 18 years old. For Mariana Lara, “what the platform writes in its terms does not prevail over the duty to comply with the ECA Digital”.
Among the main changes that come into effect are:
- end of self-declaration of age: suppliers of inappropriate content must adopt reliable verification mechanisms (with each access, simple declaration by the user being prohibited);
- prohibition of “loot boxes”: reward boxes in electronic games accessible to children and teenagers are prohibited;
- ban on advertising profiling: it is prohibited to use minors’ data to create behavioral profiles for commercial advertising purposes;
- protective setting by default: services must operate with maximum privacy enabled by default (privacy by design);
- parental supervision: Companies should offer easy tools for parents to limit screen time and monitor content.
SUPERVISION AND SANCTIONS
Monitoring compliance with standards and issuing additional regulations will be the responsibility of the (National Data Protection Agency), which assumes the role of autonomous administrative authority determined by law.
Companies that fail to comply with the rules are subject to warnings and fines of up to 10% of the economic group’s revenue in Brazil, limited to R$50 million per infraction. In cases of serious violations, the Judiciary may order the suspension or prohibition of the company’s activities.
According to the professor, tools that use data such as biometrics, document analysis or age estimation have gaps, as they contain the risk of using data, in addition to not being completely reliable. “Behavior will not always give you certainty about the age of the person in the virtual environment”, he declared.
Mariana Lara stated that the effectiveness of the law will depend on the supervision and technical regulations of the Ministry of Justice, such as the definition of “zero knowledge test” to verify age without identifying the citizen. According to the professor, this method would make it possible to confirm the age of majority without revealing who the user is or for which service the information is intended, which is compatible with the principle of minimizing data collection, already present in the LGPD.
Furthermore, a risk matrix: “critical risk” applications (gambling and adult content) will require more robust checks than “low risk” games, the lawyer said. “The general idea is that platforms should consider what is best for young people as a priority, rather than their own financial interests,” he stated.
This report was produced by the Journalism trainee at Poder360 Rúbia Bragança, under the supervision of editor Marina Ferraz.
