Brazil Wants to Reshape The Internet for Kids. The Hard Part Just Began.

Tatiana Dias is a fellow at Tech Policy Press.

In Brazil, there is a saying: there are laws that stick, and laws that don't. Starting this week, Brazil will find out whether its new legislation creating stricter rules to protect children online, known as the ECA Digital, will be one of those that sticks.

The law officially takes effect on Tuesday, six months after its approval in Congress. Under the law, platforms could face warnings and fines of up to $10 million for violations. In extreme cases, the companies may face suspensions and outright bans from the country, imposed by Brazilian courts.

The ECA Digital was passed in a lightning-fast vote last year, propelled by a wave of national outrage after an influencer named Felca exposed that a series of YouTube channels were profiting and racking up millions of views from sexualized videos of children. The case in the 30-minute video, which drew more than 52 million views, became a national scandal and drove the debate that led to the law's approval.

The ECA Digital law takes its name from Brazil's foundational child protection statute — the Estatuto da Criança e do Adolescente — but has been adapted for the digital environment. After it passed, the government gave technology companies six months to comply while preparing a decree detailing how the law would actually be enforced.

The decree's text has not been officially published yet, but a preliminary draft obtained by Tech Policy Press offers a fuller picture of how the law will be implemented.

Beyond spelling out how provisions like those requiring companies to implement age-verification mechanisms will work in practice, the decree also goes a step further by defining key terms and effectively establishing new restrictions. It equates sexualized AI-generated images of children with pornography, requires that companies certify they have obtained judicial authorization to monetize content featuring minors and requires that platforms avoid features that drive compulsive use, such as those that mask instances when a user might stop using a product, that offer up new content unsolicited or that serve excessive notifications.

Coupled with the decree, the new Brazilian law establishes a broad set of obligations for platforms:

• Age verification: The law stipulates that services containing inappropriate content must restrict access to minors using reliable age-verification mechanisms. Restrictions are tiered according to content type: inappropriate content is subject to age-rating classification, prohibited content is legally forbidden for minors and illegal content must be reported to authorities and removed by the platform.
• Age-gating enforcement: The decree details that verification must be carried out by app stores and operating systems at the account creation level. Sites and services that may pose a higher risk, such as those featuring pornography, also must adopt age verification mechanisms, as do social media companies that allow prohibited content or advertising of prohibited products, unless they offer versions of their service without high-risk content.
• Preventing compulsive use: Under the ECA Digital, providers of digital services aimed at minors must adopt stronger privacy settings and implement measures to prevent compulsive use, such as by avoiding the use of emotional analysis, reward boxes or profiling techniques that direct commercial advertising at children and teens.
• A new notice-and-takedown system: Under the law, companies must remove criminal content involving children and notify authorities. They must also create mechanisms to remove content upon notification from victims, prosecutors or representative organizations — without requiring a court order.
• A new oversight and enforcement system: The law tasks Brazil’s data protection authority, known as ANPD, with enforcing it. The decree additionally establishes a new dedicated screening center within the Brazilian Federal Police to triage reported violations.

Maria Mello, coordinator at Instituto Alana, a Brazilian child protection organization, said that it’s one thing for tech companies to deploy addictive design features on and manipulate the behavior of adults. It’s another thing to do so for children and teens. But now they have not only the means to change their practices, but an obligation to do so, she said.

“It's about ceasing to do it, it's not even a matter of spending money, is it?” she said.

Challenges implementing the law

Brazil's experience could serve as a model for other countries that are currently discussing internet restrictions for children and teenagers.

According to a Tech Policy Press tracker, at least 42 countries are considering or have passed age-restriction measures for social media. Indonesia, Malaysia, France and the United Arab Emirates have passed laws that are not yet fully implemented — much like Brazil.

"This is a global trend," said Ricardo de Lins e Horta, director of Digital Safety and Risk Prevention at the Ministry of Justice and Public Security, at a Senate hearing on the new law in early March. "However, other countries took one to three years to begin implementing these solutions. In Brazil, Congress approved the law and then, at the executive's initiative, we gave a six-month adaptation period for the ECA Digital.”

At the hearing, government and civil society representatives acknowledged the difficulties of implementation. The timeline alone appears daunting, with just six months between the law's passage and its enforcement date. "It was far too little time for us to carry out a proper listening process," said Horta.

In practice, the decree delegates much of the implementation to ANPD, but sets no intermediate deadlines for its enforcement. "We need to proceed very carefully and cautiously, while also enforcing rigorously," ANPD’s director Iagê Miola, said at the same hearing. The agency, he said, will need to hash out its enforcement priorities. "We certainly cannot monitor everything at once."

In a statement to Tech Policy Press, ANPD said it "has been preparing and is working on the development of the regulatory instruments necessary for the adequate implementation of the new legislation." The agency said it plans to develop guidance documents and recommendations in the coming months, and has already launched monitoring initiatives targeting technology products and services to assess compliance with the law.

Another challenge is the country's stark socioeconomic inequality. Data shows that Brazilian children on average have greater access to the internet than to housing, basic sanitation or food security. According to TIC Kids 2025 — the country's largest survey on technology use — 85% of children and teens between 9 and 17 have some kind of social media profile and 93% access the internet.

"Many families aren't even in a position to supervise their children's daily lives. Many single mothers, many mothers need to work and leave their kids with a neighbor, or in makeshift daycares," Zilda Barbosa, a member of the National Congress's Social Communication Council, said at the March hearing. She pointed to the difficulty of placing the burden of online child protection on families that are themselves often vulnerable.

Big Tech's response: from lobbying to parental controls

Big Tech companies have spent years challenging claims of social media harms before the Brazilian government and arguing that the responsibility for children's safety lies primarily with families.

During an earlier 2024 Senate hearing, an industry-linked researcher presented a study arguing that screentime exposure was just one of 15 factors influencing the mental health of children and teens on social media.

The study was conducted by an organization called Conselho Digital, funded by tech companies including Meta, TikTok, X and Google. (The organization did not respond to a request for comment at the time.) The same organization launched the website "Rede que cuida" ("Network that cares"), which adopted the common Silicon Valley framing of empowering parents to use platforms' parental control features.

Meanwhile, as the ECA Digital measure was being debated in Congress, far-right lawmakers introduced a series of amendments aimed at weakening the law — including exempting companies from transparency requirements, removing their duty to manage risks and eliminating the requirement that minors' accounts be linked to those of their parents.

As I reported for The Intercept, document metadata revealed that at least two of those amendments were written by a Meta lobbyist in Brazil — a fact that was not disclosed by those introducing it. One sought to exempt companies from publishing content moderation reports. The other proposed eliminating the possibility of fines and criminal sanctions against platforms. The lawmaker said at the time that many of his proposals "come out of conversations" with organizations. "My mission is not to represent the defense of any specific interest." Meta stated that its contribution to the legislation was "publicly known."

When the ECA Digital passed, platforms scrambled to get ahead of the new rules. Roblox, Discord and YouTube announced selfie-based age verification and TikTok launched safety guides, educational resources and a public campaign.

Publicly, their messaging has largely focused on technical solutions, such as surfacing screen time warnings and offering greater parental controls. At a “Safe Internet Day” event in February, YouTube representatives advocated for a risk-based approach to age verification and emphasized shared responsibility with families. The same month, the company launched a guide for content-creation for teenagers in Portuguese and announced its AI-powered age verification technology in Brazil. “Families trust YouTube to provide a safe and enriching experience,” wrote James Beser, director of product management.

Technical solutions are only part of the solution, however, Mello said.

“Most of these features barely touch on design, architecture or content moderation. Sure, having more parental controls is a relevant effort, but at the same time there is an absurd amount of content circulating that violates the rights of children and adolescents,” Mello said.

While the law takes effect this week, it’s unclear how big a gap may exist between its written text and its effect in practice. The decree delegates over a dozen regulatory responsibilities to the ANPD — an agency that was only just into a full regulatory body, and that is still onboarding some 200 temporary staff.

This all suggests the real battles over compliance are yet to come.