ECA Digital: 16 Practical Steps for Companies That Sell Children’s Products

Brazil’s Digital Child and Adolescent Statute (ECA Digital, Law No. 15,211/2025), also known as the Lei Felca, took effect on March 17, 2026, and represents a significant regulatory shift for companies that sell children’s products in the digital environment.

The regulatory landscape has moved quickly: two implementing decrees were signed on March 18—Decree No. 12,880/2026, with 54 articles, and Decree No. 12,881/2026, concerning the structure of Brazil’s national data protection authority (Autoridade Nacional de Proteção de Dados — ANPD). On March 20, the ANPD published preliminary guidance on age-assurance mechanisms.

Since 2025, companies had already received notices from the ANPD requesting information on their compliance measures. Enforcement, therefore, should not be treated as merely a future possibility.

In this analysis, we explain what the law changes, what the decree adds, who is affected, and which actions every company in the sector should consider.

What the ECA Digital Is

The ECA Digital establishes Brazil’s Digital Child and Adolescent Statute. Originating from Bill No. 2,628/2022 (Projeto de Lei nº 2.628/2022), the proposal gained momentum with the public mobilization around the “adultification” of children on digital platforms.

The statute applies to providers of information-technology products or services directed at children and adolescents—or likely to be accessed by them—regardless of where the provider is located or where the product is manufactured or operated.

The concept of “likely access” (acesso provável) is central. The question is not only whether the product is a children’s product, but whether the digital platform has features likely to be accessed by minors that create risks and call for reinforced controls.

The statutory criteria include the appeal of the digital service, its language, design, interactive features, the technological nature of the product, and its track record of use by minors.

What Decree No. 12,880/2026 Added

The implementing decree introduced structural elements that change the logic of corporate compliance.

Inappropriate Content and Prohibited Content

The Decree creates two categories subject to distinct regimes. Inappropriate content requires age-rating labels under Brazil’s content-rating system (classificação indicativa) and parental supervision. Prohibited content requires effective age verification and access barriers. Not every platform will need the same level of control.

Child Influencers

Article 34 addresses monetized or boosted content that exploits the image or daily routine of minors and requires assessing the need for judicial authorization under Article 149 of Brazil’s Child and Adolescent Statute (Estatuto da Criança e do Adolescente — ECA). The 90-day regulatory deadline, counted from the Decree’s publication, was set for June 2026. Brands that sponsor child influencers should review their exposure.

Obligations for Artificial Intelligence

Article 11 requires providers of artificial-intelligence systems—such as chatbots, virtual assistants, and generative AI that interact with minors—to adopt transparency about their automated nature, prevention of behavioral manipulation, algorithmic risk assessment, and safeguards for child development.

Editorial Exemption

Article 22 exempts certain providers of music, literary, journalistic, or sports content subject to editorial control from age verification, provided they offer child accounts and parental supervision.

Downloads with Parental Authorization

Article 25, paragraph 3, requires app stores and operating systems to request authorization from parents or guardians for the download and installation of apps by minors.

Who Is Affected

High Impact

• E-commerce operations selling children’s products with interactive features, games, gamification, or a dedicated children’s section.

• Developers of educational apps, games, or platforms with a child audience.

• Companies with a social media presence that use images of children in sponsored content.

Medium to High Impact

• Food-industry companies with a digital presence directed at children.

• Companies with chatbots or artificial-intelligence assistants accessible to minors.

• Retailers with a digital channel selling children’s products, depending on their interactive features.

Potentially Low Impact

• Conventional e-commerce selling children’s clothing or toys, without interactive features.

• Licensed editorial-content platforms that meet the requirements of Article 22.

An online store that merely sells children’s clothing or toys, without interactive technological features, does not automatically qualify as an information-technology product or service. Classification depends on the features directed at—or attractive to—children and adolescents.

The 16 Practical Steps

Short Term

• Exposure mapping. Identify which digital channels—such as website, app, social media, and marketplaces—qualify as a technology product or service likely to be accessed by minors.

• Digital advertising audit. Review campaigns on search engines, social media, and programmatic platforms. Behavioral profiling for advertising to minors calls for specific attention.

• Review of terms of use and privacy policy. Update these documents to reflect parental consent, limits on data collection, and specific purposes.

• Content classification. Map content against the Decree’s categories. Prohibited content requires effective verification; inappropriate content allows age-rating labels and proportionate measures.

• Mandatory notices. Check the notices applicable to electronic devices offered for sale.

• Authorization for content featuring minors. If the company uses monetized or boosted content with images of children, confirm that any required authorization exists and assess the exposure of each campaign.

Medium Term

• Implementation of age mechanisms. Assess which age-assurance or age-verification mechanisms are proportionate to the risk, and follow the ANPD’s guidance.

• Parental supervision tools. Implement controls that allow the legal guardian to restrict purchases, transactions, and features.

• Interface redesign. Identify potentially manipulative patterns—such as variable rewards and a false sense of urgency—on platforms accessible to minors.

• Team training. Marketing, technology, product, customer service, and legal teams need to understand the new obligations.

• Compliance of artificial-intelligence systems. Chatbots and assistants accessible to minors must ensure transparency, prevent manipulation, and assess risks.

Long Term

• Regulatory monitoring. Track the ANPD’s definitive guidance, public consultations, and enforcement timeline.

• Transparency reports. Companies subject to reporting obligations should prepare data, assign responsibilities, and establish review processes.

• Business model review. Monetization through gamification, child profiling, or reward mechanisms may require redesign.

• Integrated compliance. Incorporate the ECA Digital into the company’s existing program covering Brazil’s General Data Protection Law (Lei Geral de Proteção de Dados — LGPD, Federal Law No. 13,709/2018), consumer relations, and the protection of children and adolescents.

• Editorial exemption assessment. Licensed-content platforms should verify whether they meet the requirements for exemption from age verification.

Regulatory Timeline

The ANPD has signaled an assisted-implementation approach for certain obligations, with the expectation that companies demonstrate diligence and a structured compliance process.

The published timeline divided enforcement into stages: the first focused on app stores and operating systems, and another expected to reach the remaining sectors starting in August 2026.

The government has also allocated funding through Finep, Brazil’s federal innovation funding agency (Financiadora de Estudos e Projetos), to technological solutions for digital protection—a signal that the regulation has a long-term horizon.

Open Debates

Four lines of discussion help frame the implementation challenges:

• Comprehensive digital protection: on this view, the ECA Digital would be an extension of Article 227 of Brazil’s Federal Constitution and would require responsible design from conception.

• Regulatory overreach: there is criticism concerning the risk of mass data collection for age verification and the costs of implementation.

• Harmonization with the LGPD: age verification involves the processing of personal data and must observe necessity, data minimization, and proportionality.

• Limits of regulatory power: certain obligations in the Decree may raise questions about their relationship to the text of the Law.

Conclusion

The ECA Digital is not just one more regulatory obligation. It changes the relationship between companies and children in the digital environment. The logic no longer centers solely on the interaction with the child; it now demands dialogue, transparency, and tools for the family.

Companies that adapt in a structured way will be able to communicate compliance as a brand value. Those that wait expose themselves to regulatory, reputational, and operational risks.

Compliance begins with mapping your exposure. If the company sells children’s products and has a digital presence, this diagnosis should not be postponed.

Sources Consulted

• Law No. 15,211/2025, the ECA Digital.

• Decrees No. 12,880/2026 and No. 12,881/2026.

• Preliminary guidance from the ANPD, published on March 20, 2026.

• Decree No. 12,622/2025.

• Ordinance No. 1,048/2025 of Brazil’s Ministry of Justice and Public Security (Portaria MJSP nº 1.048/2025).

• Resolution No. 163/2014 of Brazil’s National Council for the Rights of Children and Adolescents (Resolução CONANDA nº 163/2014).

This content is informational and reflects the sources indicated as of the publication date. It does not replace an analysis of the specific circumstances of each company or case.