The Genesis of the ECA Digital
This October, Brazil became the first Latin American country to enact rules protecting children’s rights in the digital sphere. Drawing inspiration from foreign legislation and guidelines — such as the EU Digital Services Act, the UK Online Safety Act, or the ICO’s Age-Appropriate Design Code — the Digital Statute of the Child and Adolescent (ECA Digital after its Portuguese initials – see unofficial translation to English here) is an important victory for Brazilian children. It is intended to update the most important Brazilian law on children’s rights — as well as the constitutional mandate to promote children’s rights with absolute priority — to meet the challenges of this environment. And, in Brazil, these are certainly not few.
The bill was originally proposed by Senators Flávio Arns and Alessandro Vieira in 2022 and unanimously approved by the Senate in November 2024. It awaited consideration in the Chamber of Deputies when the debate of children protection online suddenly gained visibility in the country following a video by influencer Felca, which denounced cases of “adultification” in social media. Through worrisome examples, he highlights how the business model of social media and video platforms incentivized the exposure and exploitation of children in Brazil, including through sexualized or age-inappropriate behaviour or presentation, the production of content by children monetized by parents, and the use of children in YouTubers’ reality shows.
The video went viral, triggering a public call for increased protection of children online. Less than two weeks after the publication of the video, the bill passed the Chamber of Deputies, despite intense lobby from the tech industry, and received final approval from the Senate just one week later.
Brazilian children, like other worldwide, are living the effects of structural flaws in the digital environment. The platforms they use most are built on important economic incentives to retain users and monetize their attention through design patterns that prioritize engagement. Children are also increasingly exposed to forms of online violence such as grooming, sexual exploitation, bullying, and harassment. These online risks are intensified by opaque moderation practices and by the lack of child-centred design and mitigation measures.
These practices, however, are not limited to social media or video-sharing platforms, with online games posing similar risks to children’s rights. This is especially important considering the growing market for online games in Brazil, with 82,8% of the population declaring playing them frequently. As reported by the ICT Kids Online Brazil 2024 survey, playing online games was the activity most performed by users 9 to 10 years old on the internet (81%). The ECA digital is therefore an important step towards building a digital environment that aligns with children’s special developmental stage and increased vulnerability. In this piece, we focus on the key legal developments introduced by the ECA Digital to online games.
ECA Digital’s Scope and Risk-Based Approach
The ECA Digital applies to all providers of information technology products or services directed at children or likely accessed by them (hereafter providers), including online games. The Brazilian system distinguishes between children (ages 0-12) and adolescents (ages 13-17). However, we use the term ‘children’ to refer to those between 0 and 18 years old, consistent with the Convention on the Rights of the Child, and highlight any age difference in the legislation when needed.
Providers must observe obligations of prevention, protection, transparency, and safety in accordance with the principle of the best interests of the child (Article 5). This includes specific prohibitions of certain practices, as will be discussed below, but mostly the adoption of measures following a risk-based approach. Articles 6 and 8(I) introduce the requirement for providers to adopt reasonable measures by design, with the aim of preventing and mitigating risks related to certain content, products or practices. This includes exposure to age-inappropriate material, such as violent content, sexual abuse–related material, incitement to harmful practices affecting children’s physical or mental health, or the promotion of products like gambling, tobacco, and alcohol (Article 6).
The ECA Digital does not distinguish between private sharing of content and public dissemination, which may create opportunities for providers to unduly interfere with private communications and encryption. Nonetheless, the law also introduces the need to apply, by default, the most privacy protective settings (Article 7), adapting the content to the child’s age and autonomy (Article 8, II). It remains to be seen how the designated authority will interpret the contours of this provision.
Age-assurance mechanisms
Age assurance mechanisms should also be put in place in certain cases, either as an obligation or an implicit requirement. The law requires providers to adopt measures that are age-appropriate, considering the evolving capacities of the child (Article 10), and mandates parental consent for downloading an app (Article 12, § 2º). These situations would implicitly demand a previous assessment of one’s age. More explicitly though, Articles 8(III) and 9 oblige providers to impede children from accessing illegal or inappropriate content, including pornography. App stores or operational systems must also provide age signals to internet application providers, including games (Article 12).
The law is rather imprecise regarding the language related to age assurance mechanisms, and there is no definition of concepts such as “age verification”, age “measurement” or “assessment”. The Brazilian data protection authority has recently released a technological radar on age assurance mechanisms, which is supposed to consolidate the international state of the art in this field. Though not binding, this guidance already provides a more nuanced approach to the different methods and views age assurance as an umbrella term for self-declaration, age verification and age estimation mechanisms, aligned with the international literature on the topic.
Games-specific obligations
More specifically to online games, the Brazilian Legal Framework for Electronic Games already mandated parental consent for all microtransactions that take place within them (Article 17). The ECA Digital goes one step further by prohibiting loot boxes in online games directed at children or likely accessed by them in its Article 20. It is not clear, however, whether the prohibition only concerns paid loot boxes or if loot boxes that can be obtained for free (e.g., through gameplay) are equally banned. By precaution, game providers should rather avoid offering randomized rewards to children.
Interaction between children and other players is also specifically prohibited in online games, unless parental consent is provided (Article 21). Online multiplayers games are, therefore, particularly impacted. Importantly, the law does not differentiate children based on their age, meaning that consent for interacting with other users would need to be collected for all users under 18, which might take a toll on adolescent’s autonomy and privacy in relation to their parents and go against the law’s general principles (Articles 5 and 10).
Prohibition of certain marketing practices
Article 22 prohibits all providers to profile children for commercial targeted advertisement. Though targeted advertisement to children could already be interpreted as an unfair practice under the Brazilian Consumer’s Code, as well as being against children’s best interests under Article 14 of the Brazilian General Data Protection Law, it was an important move to make it explicit in the ECA Digital. The prohibition, however, unjustifiably only applies to commercial profiling. In this sense, profiling for the purposes of targeting advertisements related to political propaganda, for instance, could be interpreted as lawful, even though it can also be used to unfairly manipulate children.
Another important rule related to marketing in online games is the prohibition of using emotional analytics and techniques of extended, augmented or virtual reality for targeted advertisement. Though targeted advertising generally includes profiling, the broad wording of the ECA Digital suggests that any form of advertising strategically placed or delivered within immersive environments — regardless of whether it is personalized through profiling, including contextual ads — would fall under the prohibition, aligning with the determinations found in the Committee on the Rights of the Child’s General Comment No. 25 (para. 42).
Parental controls
The law also requires all providers to offer parental controls in an easy and accessible way. It adopts a hybrid strategy, by both envisaging controls that parents can activate at their discretion (such as time monitoring settings), and a set of highly protective default settings that parents can modify (Articles 16-18). This could mean, for instance, disabling features that create continuous reward loops in certain games, such as push notifications, daily rewards, or ‘play-by-appointment’ mechanisms, or geolocation tracking. Furthermore, clear and visible warnings must be displayed when these settings are in effect, reinforcing transparency towards children in relation to the information gathered by their parents.
The role of the ANPD
Following the enactment of the law, Decree No. 12,622/2025 granted the Brazilian data protection authority the competence to oversee the implementation of the new legislation and regulate certain of its provisions. It also brought a significant change to the ANPD’s legal status, transforming it into a regulatory agency — now becoming the National Data Protection Agency (still ANPD as the Portuguese acronym) — with increased financial and administrative autonomy. With such a short period before the law enters into force, the experience the ANPD has gained in enforcing the Brazilian data protection law is crucial to ensuring that the ECA Digital achieves its intended goals.
In any case, this law should be seen as only a starting point. Every new law is a promise of change, and its success will hinge upon how it is taken seriously going forward. More importantly, the effective implementation of the ECA Digital will depend not only on regulatory clarity but also on the engagement of industry actors, civil society, and parents in making the law work in practice, transforming its provisions into concrete measures to promote a digital experience to children that is aligned with their fundamental rights.
Conclusion
The ECA Digital will take effect in March 2026. Given its broad scope of application – i.e., any information technology product or service “aimed at” or that are “likely to be accessed” by children in Brazil, irrespective of their provider’s location (Art. 1) – the entire gaming industry is concerned by the application of the ECA Digital. Indeed, regardless of their target audience, games — being games — are always likely to be accessed by children, even when the design and content are inappropriate for their age.
Consequently, to ensure that their game experience remains age-appropriate (Art. 10), providers will have to implement age assurance mechanisms in the situations mentioned above, disable social interactions in the absence of parental consent (Art. 21), and provide for parental controls tools and protective default settings (Art. 16-18).
Finally, ECA Digital’s combined obligations are likely to impact the game providers economically. Inevitably, implementing age-assurance and parental controls mechanisms will generate costs, and preventing loot boxes and targeted ads will reduce revenues, especially for free-to-play and freemium games which heavily rely on these monetisation strategies. Games aimed at children, or with large child audiences, may indeed need to rethink their business models, as non-compliance can lead to fines up to R$ 50 million or up to 10% of a company’s revenue in Brazil, along with potential warnings, suspension or prohibition of operations, depending on the severity of the violation.
