Brazil’s House of Representatives approves bill on protection of minors in the digital sphere

On August 20, 2025, Brazil’s House of Representatives approved a bill to create rules to protect minors in relation to the use of internet applications, electronic games, social media, and computer programs. Referred to as the ‘ECA Digital’ (after the Portuguese acronym for the Brazilian Child and Adolescent Statute), Bill No. 2,628/2022 is set to establish a series of obligations for information technology product and service providers, such as internet apps, computer programs, terminal operating systems, internet application stores, and electronic games.

Obligations

The approved version of the bill establishes a number of obligations for information technology product and service providers, including the need to:

• Take appropriate technical measures to prevent minors from inappropriate access and use;
• Ensure the most protective privacy and personal data protection model is applied to products and services by default from the outset;
• Avoid processing minors’ personal data in a way that causes, facilitates, or contributes to the violation of their privacy or any other rights;
• Evaluate content to ensure minors only access material suitable for their respective age groups, in line with Brazil’s age rating system (classificação indicativa);
• Provide systems and processes designed to prevent minors from encountering illegal, pornographic content via the product or service, as well as other content manifestly inappropriate for their age group; and
• From the outset, develop and implement default configurations that stop minors from compulsively using the products or services.

Age verification mechanisms

The ECA Digital Bill would also require information technology product or service providers to adopt age (or age group) verification mechanisms when their products and services target or are likely to be accessed by minors. Minors aged 12-18 will require the consent of a parent or legal guardian to download online apps.

Parental supervision

The bill establishes rules for providers of information technology products or services targeting or likely to be accessed by minors to ensure parents, guardians, and minors themselves are aware of the risks and security measures adopted, including those linked to privacy and data protection. In addition, such providers must:

• Make accessible, easy-to-use settings and tools available in order to facilitate parental supervision, considering the available technology and the nature and purpose of the product or service;
• Provide easily accessible information to parents or legal guardians regarding existing tools for carrying out parental supervision;
• Display clear, visible warnings that denote when parental supervision tools are in effect and which controls or settings have been applied; and
• Offer features that allow for limiting and monitoring the time spent using the product or service.

Loot boxes

According to the approved version of the bill, electronic games that target or are likely to be accessed by minors must comply with certain conditions regarding the use of loot boxes.

Loot boxes are virtual items that players can acquire within a game. By opening a loot box, the player receives random rewards, such as skins, weapons, characters, or other items that can customize or enhance the experience of the game.

The bill’s obligations include:

• Prohibiting empty boxes, or those that result in no benefit to the gaming environment;
• Providing clear information on the probability of obtaining items or advantages;
• Prohibiting the sale, exchange, or conversion of virtual items obtained through loot boxes into any form of currency, financial credit, or advantage outside the gaming environment;
• Prohibiting pay-to-win practices where players obtain significant or disproportionate competitive advantages upon payment, to the detriment of equality between paying and non-paying players.

Advertising

In addition to other related provisions in the bill, the use of profiling techniques targeting commercial advertising at minors is to be prohibited, as well as the use of emotional analysis, augmented reality, extended reality, and virtual reality for the same purpose.

Monetization

Internet application providers will be prohibited from monetizing and boosting content that portrays minors in erotic or sexually suggestive ways, or in contexts specifically linked to the adult sexual universe.

Social media

Providers of products and services targeting or likely to be accessed by minors must ensure that profiles or accounts of minors aged 16 and younger are linked to the profile or account of one of their legal guardians.

Notification, reporting, and content removal

Providers of information technology products or services available in Brazil must report the contents of any apparent exploitation, sexual abuse, kidnapping and grooming of minors directly or indirectly detected in their products or services to the competent Brazilian and international authorities. Furthermore, providers must retain the data associated with such reports for a minimum of six months.

The ECA Digital Bill will also establish a requirement for providers of information technology products or services targeting or likely to be accessed by minors to include mechanisms notifying users of violations of the rights of minors.

Providers must also take steps to take down content that violates the rights of minors as soon as they are notified of the offensive nature of the content by the victim, their representatives, the Public Prosecutor’s Office or entities defending the rights of minors, regardless of a court order.

Reporting and legal representation in Brazil

The bill determines that certain providers of internet apps that target or are likely to be accessed by minors must prepare semiannual reports (in Portuguese) and publish them on their respective websites. This requirement applies to apps with over one million registered users under the age of 18 with internet connections inside Brazil.

These reports must contain information on:

• Available channels for receiving complaints and the systems and processes for investigations;
• The number of complaints received during the period;
• The extent of content or account moderation, according to type;
• Measures adopted to identify minors’ accounts on social media;
• Technical improvements to protection mechanisms for personal data and the privacy of minors;
• Technical improvements regarding the verification of parental consent; and
• Details of the methods used, as well as impact assessment results and the identification and management of risks to minors’ health and safety.

Foreign companies must have a legal representative based in Brazil with powers to receive, summons, subpoenas or notifications (among others) related to any lawsuits and administrative proceedings. The representative would also be responsible for responding to government authorities, judicial bodies and the Public Prosecutor’s Office, as well as assuming the foreign company’s responsibilities in relation to Brazil’s public administration.

National Authority

The ECA Digital Bill also proposes creating (via a law) an independent administrative authority to oversee the protection of the rights of minors in the digital sphere. This authority would be responsible for monitoring compliance throughout Brazil and may issue supplementary rules regulating the provisions of the ECA Digital.

Next steps

The ECA Digital Bill is now set to be reviewed once more in the Senate, which has the power to establish the final version of the text. If approved in the Senate, the bill will be sent for presidential assent/vetting, and if signed into law, it will take effect one year after it is published.

For more information on this topic, please contact Mattos Filho’s Data Protection & Cybersecurity practice.