Digital ECA and Age Verification Mechanisms in the Digital Environment

The growing digitization of social and commercial interactions poses significant challenges to the protection of personal data, especially when it involves children and adolescents. In Brazil, the General Data Protection Law (LGPD), the Statute of the Child and Adolescent (ECA), and, more recently, Law No. 15,211/2025 (Digital ECA), regulated by Decree No. 12,880/2026, establish the legal framework aimed at protecting the rights of this demographic in the online environment.

The National Data Protection Authority (ANPD), in its regulatory and supervisory capacity, has issued crucial guidelines for companies operating digital platforms, internet applications, and online services, with particular emphasis on the guides regarding reliable age verification mechanisms and the protection of children and adolescents in the digital environment. This newsletter aims to present the ANPD’s key guidelines regarding age verification mechanisms, contextualizing them within the current legislation and highlighting their practical implications for companies.

The ANPD Guide and the Six Minimum Requirements for Age Verification

The ANPD’s Guidance Document, “Preliminary Guidelines on Reliable Age Verification Mechanisms,” reflects the agency’s institutional position and serves as a reference for its activities to monitor and enforce compliance with Article 9 of the Digital ECA and Article 24 of Decree No. 12,880/2026.

The minimum legal requirements for age verification mechanisms have been grouped as follows:

1. Proportionality: The age verification solution must be proportionate to the level of risk associated with the digital service or product. Companies must identify and assess in advance the risks inherent in the digital service or product and those arising from the verification mechanism, especially those involving biometric data. Tools such as the Personal Data Protection Impact Assessment (PDPA) are recommended for this analysis.
2. Accuracy, Robustness, and Reliability: The implemented mechanism must be accurate, resistant to fraud attempts, and capable of operating stably under real-world conditions. Solutions based exclusively on user self-declaration have a low degree of reliability, are easily manipulated, and are therefore insufficient to meet regulatory requirements.
3. Privacy and Personal Data Protection: Solutions must adhere to the principles of data minimization, privacy protection, information security, prohibition of secondary use, prohibition of traceability, and prohibition of continuous, automated, and unrestricted sharing of personal data. Technologies such as verifiable credentials and zero-knowledge proofs are cited as examples of approaches that reduce data exposure, aligning with privacy best practices.
4. Inclusion and Non-Discrimination: Age verification mechanisms must not result in the undue exclusion of users or perpetuate discriminatory biases. It is recommended to provide for alternative methods of age verification to ensure accessibility and avoid disparities, for example, in the accuracy of biometric solutions across different population groups.
5. Transparency and Auditability: Providers must clearly and accessibly disclose the purpose of the mechanism, the data used, and the consequences of the verification, in addition to offering channels for appeal and correction. It is essential to maintain audit logs, but without unnecessarily storing biometric or documentary data for this purpose.
6. Interoperability: Solutions must allow for the exchange of strictly necessary age attributes between systems, without creating extensive integrated databases or continuously sharing personal data. Double-blind architectures, trusted intermediaries, and cryptographic tokens are examples of technical approaches that promote secure interoperability.

Digital Chain of Responsibility and Specific Requirements for Technical Solutions

The ANPD Guidance Document establishes a digital chain of responsibility, distributing age verification obligations according to the provider’s role in the digital environment. This model provides for a two-tier protective system that requires coordinated action among the various stakeholders.

At the first level, app stores and operating systems are responsible for the initial age verification and for sharing an “age signal” via API with other providers.

At the second level, other providers of products and services must ensure the proper receipt and processing of these age signals, in addition to establishing contingency mechanisms for any failures in signal transmission. Additional age verification mechanisms may be required, depending on the risk and nature of the product or service.

The guide also details specific requirements for technical solutions, such as:

• Facial Estimation: Aims to estimate age based on biometric attributes captured from images or videos, without the need for identification documents. The provider must file a RIPD and ensure that the purpose is not identification or authentication. Robust anti-fraud controls, high reliability, and technical security are essential.
• Document Verification: This mechanism verifies the information on an official document and compares it to the age criteria; it is best suited for higher-risk services. The provider must ensure the document’s authenticity, integrity, and validity, as well as protection against forgery and compliance with data protection and privacy requirements.
• Verifiable Credentials: The user presents an age attribute previously issued by a trusted entity (e.g., a government authority). The credentials must contain only the attributes strictly necessary to verify age or age range, ensuring data minimization.

Ongoing Enforcement

The ANPD has already begun the phase of enforcing compliance with the obligations introduced by the Digital ECA, demonstrating that the issue has moved beyond the purely advisory sphere to effective regulatory and enforcement action, as indicated in the Monitoring Report on the Regulatory Agenda for the 2025–2026 Biennium.

The Authority is already monitoring app store providers and operating system developers to verify the implementation of age verification mechanisms and the infrastructure necessary to provide so-called “age indicators.” In addition, cases involving violations of the LGPD now include compliance plans for age verification mechanisms, as was recently the case with Bytedance, the parent company of TikTok, and the gaming platform Discord.

Although the initial action was directed at large digital infrastructure providers, monitoring and enforcement activities are likely to be progressively expanded to include other data controllers subject to the provisions of the Digital ECA, particularly digital platforms, applications, and services intended for or accessed by children and adolescents.

In this context, companies operating in the digital environment should review their internal processes, age verification mechanisms, privacy policies, and personal data processing practices to ensure compliance with the LGPD, the ECA Digital, and ANPD regulations, in accordance with the timeline proposed by the Agency.

This intensification of government action is not limited to the administrative sphere of the ANPD. In July 2026, the Campina Grande, Paraíba, Children and Youth Court ordered the nationwide suspension of the betting platforms Pixbet, Flabet, and Bet da Sorte due to flaws in the mechanisms designed to protect children and adolescents from accessing these sites, which ultimately allow minors to register and place bets using third parties’ CPF numbers, without effective biometric verification of the user’s identity.

The team at LBM Advogados closely monitors key legislative and jurisprudential changes that impact the business environment and is available to assist its clients in assessing the impacts of new regulatory guidelines on personal data protection, privacy, and digital governance.

Our services include reviewing internal policies, analyzing age verification mechanisms, preparing Personal Data Protection Impact Assessments (RIPD), evaluating digital products and services from a regulatory perspective, as well as providing support for inspection procedures and engagement with the ANPD.