ANPD Publishes Guide on the Scope and General Obligations of the Digital ECA

On October 28, 2026, the National Data Protection Agency (ANPD) published the Guidance Document “Providers of Information Technology Products or Services: Scope and General Obligations of the Digital ECA,” which provides guidance on the application of Law No. 15,211/2025  (Digital Statute of the Child and Adolescent – Digital ECA). The document was refined based on contributions received during a public consultation held between April and June 2026 and includes practical examples, explanatory tables, and a flowchart to assist in identifying likely access.

The guide seeks to answer two central questions: to whom does the Digital ECA apply; and what are the meaning and implications of the duty of prevention for regulated entities. Although it does not analyze specific obligations in detail, such as age verification, parental supervision, and content moderation, the ANPD understands that the duty of prevention is the central foundation for its interpretation and application.

We highlight the main points below:

Scope of application: providers of information technology products or services

The concept of an information technology product or service is defined based on three characteristics, assessed according to the specific offering and the manner of use:

• Remote provision: without the simultaneous presence of the parties;
• Electronic medium: use of equipment and networks for processing or transmission, especially via internet applications; and
• Individual request: activation or use upon the user’s request.

In addition to the general obligations applicable to all providers, the Guide details specific types of providers subject to particular obligations:

• Social media platforms: focused on open social interaction and the widespread circulation of content published by users themselves;
• App stores and operating systems: play a structural role in the implementation of the Law, serving as central hubs connecting developers and users, with duties such as providing age ratings and parental control mechanisms. Open-source operating systems (widely used in technical communities or embedded in Internet of Things devices) may be subject to modified obligations; and
• Services with editorial control and content protected by previously licensed copyrights (e.g., streaming with a curated catalog): may be exempt from certain obligations (such as the removal of content that infringes the rights of children and adolescents upon notification), provided that safeguards such as age ratings and parental controls are observed, without deviating from the most protective default settings.

Likely access by children and adolescents

The Digital ECA applies not only to services directed at children and adolescents but also to those likely to be accessed by this audience. To this end, three requirements must be met cumulatively, always interpreted in light of the principle of the best interests of the child and adolescent:

• Probability of use and attractiveness: this considers design, language, content, rewards, gamification, and other presentation strategies, even if the service is not formally designed for this audience;
• Considerable ease of access and use: technical, operational, and contextual conditions that reduce barriers to entry and use; and
• A significant degree of risk to privacy, safety, or biopsychosocial development, with a legal presumption of risk for services that enable social interaction and large-scale information sharing. Ordinary risks inherent in the use of technology are not sufficient.

Among the relevant clarifications in the guide, the following stand out:

• The provider’s self-assessment of the target audience is not binding on the ANPD: the analysis considers the actual characteristics and conditions of use of the product or service;
• Age verification mechanisms and other mitigation measures do not preclude classification as “likely access,” as they constitute compliance with a legal obligation that arises after the law’s applicability has been determined;
• Certain categories, such as social media platforms, app stores, and operating systems, are presumed to be targeted or likely to be accessed, subject to the specific circumstances of each case; and
• The presence of one or two requirements alone does not trigger the law’s application, but this interpretation cannot be used to unjustifiably restrict its scope when significant risks exist.

Duty of prevention

The duty of prevention is defined as the obligation to act proactively and diligently, taking appropriate, proportionate, and effective measures throughout the entire life cycle of products and services. The guide organizes it into four complementary dimensions:

• Prevention in the strict sense: identifying, assessing, avoiding, and mitigating risks, including managing risks related to features, resources, and systems, and assessing the impact on children’s safety and health (article 47 of Decree No. 12,880/2026);
• Protection: ensuring comprehensive, special, and priority protection, including against commercial exploitation, such as prohibiting profiling for targeted advertising;
• Information: providing simple, clear, and accessible information, both prospectively (regarding operation, data processing, risks, and security measures) and retrospectively (through semiannual transparency reports); and
• Security: prevent accidental or unlawful situations that impact the well-being of children and adolescents or result in the improper processing of their personal data.

To operationalize the duty of prevention in the strict sense, the guide proposes a four-step risk management process:

• Identify risks in the product or service’s functionalities, features, and systems;
• Assess the probability and severity of the impact, and indicate the risk level (low, medium, or high);
• Adopt appropriate measures and safeguards to prevent and mitigate the risks; and
• Document and demonstrate the effectiveness of the measures through testing, data, and continuous monitoring metrics.

Proportionality and modulation of obligations

The obligations of the Digital ECA must be tailored according to the following factors:

• The nature, risk, and business model of the service;
• The extent of the provider’s influence over the content made available; and
• The number of users and the size of the provider.

According to the guide, proportionality does not reduce the provider’s liability but rather guides the form and extent of the expected measures. The analysis must always be conducted on a case-by-case basis.

For more information on this topic, please contact Mattos Filho’s Technology practice.