ECA Digital Compliance (Lei 15.211/2025) + LGPD Art. 14

Last verified against official sources: 2026-07-10

When to Use

• App processes personal data of children (under 12) or adolescents (12-17)
• App is directed at children or adolescents (games, educational platforms, social media)
• App is likely to be accessed by children or adolescents (even if not specifically targeted)
• Building age verification or parental consent flows
• Reviewing code for children's data protection compliance
• Designing parental supervision features
• Implementing content moderation for minors

How to Respond

Applicability (Art. 1)

This law applies to any product or service of information technology directed at children and adolescents or likely to be accessed by them, regardless of where it was developed, manufactured, offered, or operated.

"Likely to be accessed" means (Art. 1, sole paragraph):

Key point: Even if your app is not "for kids", if children can easily access it, ECA Digital applies. The law uses a broad test — not just intent, but probable access.

Key Definitions (Art. 2)

Fundamental Principles (Art. 3-4)

All products/services must guarantee priority protection of child/adolescent users with these foundations:

1. Integral protection guarantee
2. Absolute prevalence of children's interests
3. Best interest of the child as the primary parameter
4. Recognition of the developing person condition
5. Safety against intimidation, exploitation, abuse, threats
6. Respect for progressive autonomy
7. Protection against commercial exploitation
8. Promotion of digital education
9. Transparency and accountability in data processing

Relationship with LGPD Art. 14

LGPD Art. 14 establishes the baseline for children's data processing. ECA Digital expands these requirements significantly.

LGPD Art. 14 Requirements (baseline)

ECA Digital Adds

Age Verification (Arts. 9-14)

Requirements

• Products with content inappropriate for minors must adopt effective mechanisms to prevent access (Art. 9)
• Self-declaration of age is prohibited (Art. 9, par. 1)
• Age verification data can only be used for verification purposes, nothing else (Art. 13)
• App stores and OS providers must implement age verification and share age signals via secure APIs (Art. 12)
• Download authorization for minors requires free and informed consent from parents; silence does NOT imply authorization (Art. 12, par. 2)

Implementation Pattern

# Pseudocode -- Age verification and gating

class AgeVerificationService:
    """
    Age verification must use reliable mechanisms.
    Self-declaration alone is NOT sufficient (Art. 9, par. 1).
    """

    def verify_age(self, user_id: str) -> AgeVerificationResult:
        """
        Use multiple signals to verify age.
        Data collected here can ONLY be used for verification (Art. 13).
        """
        signals = []

        # Signal 1: OS/app store age signal via API (Art. 12, III)
        os_age_signal = self.get_os_age_signal(user_id)
        if os_age_signal:
            signals.append(os_age_signal)

        # Signal 2: Document-based verification for restricted content
        if self.requires_strict_verification():
            doc_result = self.verify_with_document(user_id)
            signals.append(doc_result)

        # Signal 3: Parental confirmation
        parent_result = self.request_parental_confirmation(user_id)
        signals.append(parent_result)

        return self.evaluate_signals(signals)

    def classify_user(self, age: int) -> UserAgeGroup:
        """Classify user into age group for appropriate experience."""
        if age < 12:
            return UserAgeGroup.CHILD       # Most restrictive
        elif age < 16:
            return UserAgeGroup.ADOLESCENT_UNDER_16  # Account linking required
        elif age < 18:
            return UserAgeGroup.ADOLESCENT   # Parental tools available
        else:
            return UserAgeGroup.ADULT


class AgeGatedFeature:
    """Decorator/guard for age-restricted features."""

    def __init__(self, minimum_age: int, requires_parental_consent: bool = False):
        self.minimum_age = minimum_age
        self.requires_parental_consent = requires_parental_consent

    def check_access(self, user) -> bool:
        if user.age < self.minimum_age:
            return False
        if self.requires_parental_consent and user.age < 18:
            return user.has_parental_consent_for(self.feature_id)
        return True

Parental Consent (LGPD Art. 14 + ECA Digital)

Requirements

• Consent must be specific, informed, and prominent (LGPD Art. 14, par. 1)
• Must be separate from general terms of service
• Controller must make reasonable efforts to verify the consenting person is the legal guardian (LGPD Art. 14, par. 5)
• Download authorization requires consent; silence does NOT equal consent (Art. 12, par. 2)
• Consent can be revoked at any time

Implementation Pattern

# Pseudocode -- Parental consent flow

class ParentalConsentService:
    """
    LGPD Art. 14, par. 1: specific, prominent consent from parent/guardian.
    LGPD Art. 14, par. 5: reasonable efforts to verify it's the guardian.
    """

    def request_consent(
        self,
        child_id: str,
        parent_id: str,
        purposes: list[str],
        data_types: list[str],
    ) -> ConsentRequest:
        """
        Each purpose requires SEPARATE consent (LGPD Art. 8).
        Consent must be specific -- blanket consent is void.
        """
        return ConsentRequest(
            child_id=child_id,
            parent_id=parent_id,
            purposes=purposes,           # e.g., ["profile_creation", "health_tracking"]
            data_types=data_types,        # e.g., ["name", "birth_date", "health_data"]
            presented_prominently=True,   # Must be highlighted, not buried
            separate_from_tos=True,       # Cannot be mixed with general terms
            language="simple_and_clear",  # LGPD Art. 14, par. 6
        )

    def verify_guardian(self, parent_id: str) -> bool:
        """
        LGPD Art. 14, par. 5: reasonable efforts to verify
        the consent was given by the legal guardian.
        Options: document upload, credit card verification,
        video call, government ID API.
        """
        return self.guardian_verification_service.verify(parent_id)

    def revoke_consent(self, child_id: str, parent_id: str, purpose: str):
        """Consent must be revocable at any time via simple procedure."""
        self.deactivate_consent(child_id, purpose)
        self.stop_processing(child_id, purpose)
        self.schedule_data_deletion(child_id, purpose)


# What you CANNOT do (LGPD Art. 14, par. 4):
# - Condition game/app participation on providing unnecessary data
# - Require data beyond what's strictly needed for the activity

# What you CAN do without consent (LGPD Art. 14, par. 3):
# - Collect data to contact parents (single use, no storage)
# - Collect data for child protection purposes

Data Minimization and Prohibited Practices

Prohibited for Children/Adolescents

Required Minimization

DO:
- Collect ONLY data strictly necessary for the stated purpose
- Delete age verification data after verification is complete (Art. 13)
- Use the most restrictive privacy settings by default (Art. 7)
- Document the purpose for each data field collected from minors
- Provide clear info on what data is collected and why (LGPD Art. 14, par. 2)

DON'T:
- Use children's data for behavioral advertising or profiling
- Create behavioral profiles from ANY data, including collective data
- Track children's location without explicit parental consent
- Store data beyond what's needed for the declared purpose
- Use dark patterns to expand data collection

Design Obligations (Art. 7-8)

Privacy by Default (Art. 7)

• Products must operate with the highest level of privacy protection by default
• Clear, accessible information must be provided for parents/children to make informed choices about reducing protections
• Data processing must NOT cause, facilitate, or contribute to privacy violations

Safety by Design (Art. 8)

Implementation

DEFAULTS for minor users:
- Profile visibility: PRIVATE (never public)
- Location sharing: OFF
- Direct messages from strangers: BLOCKED
- Personalized recommendations: OFF (or limited to non-profiling)
- Auto-play: OFF
- Push notifications: MINIMAL
- In-app purchases: BLOCKED (require parental authorization)
- Data sharing with third parties: OFF

Users/parents MAY relax settings, but the DEFAULT must be most restrictive.

Parental Supervision Tools (Arts. 17-18)

Mandatory Features

Providers must offer accessible and easy-to-use tools that enable parents to:

Default Parental Tool Settings (Art. 17, par. 4)

• Restrict communication with unauthorized users
• Limit features designed to extend usage (auto-play, time-based rewards, notifications)
• Provide tools for monitoring healthy usage
• Interfaces for immediate visualization and limitation of usage time
• Control over personalized recommendation systems (including option to disable)
• Restrict geolocation sharing with clear prior notice about tracking
• Regular review of AI tools for safety and age-appropriateness
• Provide emotional support resources when psychosocial risks are identified

Social Media Requirements (Arts. 24-26)

Account Linking for Under-16 (Art. 24)

• User accounts of children and adolescents up to 16 years old must be linked to a parent/guardian account
• If service is inappropriate for minors, providers must: inform all users clearly, monitor/restrict content attracting minors, continuously improve age verification

Suspected Minor Accounts (Art. 24, par. 4)

When there are reasonable grounds to believe an account is operated by a minor in violation of age requirements:

1. Suspend access immediately
2. Provide a swift, accessible procedure for the legal guardian to appeal and prove age

Data Processing Rules (Art. 25)

Social networks must have specific, concrete, and documented rules for processing children's and adolescents' data, based on their best interest.

Content Moderation (Arts. 6, 27-30)

Harmful Content Prevention (Art. 6)

Providers must take reasonable measures from design through operation to prevent and mitigate risks of exposure to:

1. Sexual exploitation and abuse
2. Physical violence, cyberbullying, and harassment
3. Content inducing self-harm, substance abuse, self-diagnosis, self-medication, or suicide
4. Gambling, betting, tobacco, alcohol, narcotics, or prohibited products
5. Predatory, unfair, or deceptive advertising
6. Pornographic content

Reporting Obligations (Art. 27)

• Content involving apparent exploitation, sexual abuse, kidnapping, or grooming must be removed and reported to national and international authorities
• Data associated with reports must be retained per Marco Civil da Internet (Art. 15 of Law 12.965/2014)

Content Removal (Art. 29)

Content violating children's rights must be removed immediately upon notification by the victim, their representatives, prosecutors, or child protection organizations -- no court order required.

The removal process must include (Art. 30):

• Notification to the user who posted the content
• Reason and basis for removal (human or automated analysis)
• Possibility of appeal
• Easy access to appeal mechanism
• Defined timelines for appeal and response

Penalties (Art. 35)

Penalty Criteria (Art. 35, par. 1)

• Severity of infraction and extent of individual/collective damage
• Recidivism
• Economic capacity of the infringer
• Social purpose and impact on national information flow

Note: ECA Digital penalties are harsher than LGPD -- up to 10% of revenue vs. LGPD's 2%. Warnings and fines are applied by the autonomous administrative authority; suspension and prohibition require judicial order (Art. 35, par. 5).

Transparency Reports (Art. 31)

Providers with more than 1 million minor users registered in Brazil must publish biannual reports in Portuguese containing:

1. Available reporting channels and investigation processes
2. Number of reports received
3. Content/account moderation actions by type
4. Measures to identify child accounts and illegal acts
5. Technical improvements for children's data protection and privacy
6. Technical improvements for parental consent verification
7. Impact assessment methods and results for children's safety

Implementation Checklist

Data Collection and Consent

• Age verification implemented (self-declaration prohibited)
• Parental consent flow -- specific, prominent, separate from general terms
• Guardian verification mechanism (reasonable efforts to confirm identity)
• Consent revocation -- simple, free procedure
• Purpose documented for each data field collected from minors
• No conditioning of app participation on unnecessary data collection
• Data collection without consent only for contacting parents (single use, no storage)

Data Processing and Storage

• Data minimization enforced -- only strictly necessary data
• No behavioral profiling of minors
• No targeted advertising based on children's data
• No emotional analysis, AR/VR for advertising to minors
• Age verification data deleted after verification (Art. 13)
• Encryption at rest for children's data (especially health data)
• Access control -- principle of least privilege for children's data
• Audit logs for all access to children's data

Privacy and Design

• Most restrictive privacy settings by default
• Profile visibility set to private by default
• Location sharing off by default
• Direct messages from strangers blocked by default
• Anti-compulsive design (no auto-play, no time-based rewards by default)
• No loot boxes if directed at minors
• Age rating displayed at access

Parental Supervision

• Parental supervision tools available (account/privacy management)
• Purchase/transaction restrictions for parents
• Usage time monitoring and limitation tools
• Communication monitoring (identify adult profiles)
• Safeguard controls accessible and in Portuguese
• Under-16 accounts linked to parent/guardian account (social media)

Content Moderation

• Harmful content prevention measures implemented
• Reporting mechanism for rights violations available to users
• Immediate removal upon notification (no court order needed for child rights violations)
• Appeal process with notification, reasoning, and defined timelines
• CSAM detection and reporting to authorities

Transparency

• Children's data section in privacy policy
• Information in simple, clear, accessible language
• Public information on data types collected, usage, and rights (LGPD Art. 14, par. 2)
• Biannual transparency reports (if over 1M minor users)
• Data Protection Impact Assessment for children's data (Art. 16, sole paragraph)

Deletion

• Parents can request deletion of all child's data
• Deletion cascades to all systems including backups
• Retention policy with defined expiry for children's data
• Third parties notified of deletion requests

References

• Lei 15.211/2025 (ECA Digital)
• Lei 13.709/2018, Art. 14 (LGPD -- Children's Data)
• Lei 8.069/1990 (ECA -- Estatuto da Crianca e do Adolescente)
• Decreto 12.622/2025 (ECA Digital Regulation)

See Also

• lgpd-compliance — Use together for the full data protection picture. LGPD Art. 14 is the foundation; ECA Digital expands it with design obligations, age verification, and content moderation.
• lgpd-document-generator — Use when generating privacy policies or consent forms that include a dedicated children's data section.
• lgpd-sanctions — ECA Digital penalties (up to 10% revenue) are harsher than LGPD (2%). Use for risk assessment when processing children's data.
• moderation-legal-framework — Use for content moderation obligations that overlap with ECA Digital's child safety requirements.