ECA Digital: How Does the Legislation Affect Educational Institutions?

Law No. 15,211/2025, known as the Digital Statute for Children and Adolescents (“Digital ECA”), establishes rules for the protection of children and adolescents in digital environments. Regulated by Decree No. 12,880/2026, the legislation sets forth obligations regarding prevention, protection, information, and security for providers of information technology products and services intended for this audience or likely to be accessed by them.

Although the obligations set forth in the law are intended for providers covered by its provisions, the issue also warrants attention from educational institutions that use educational platforms, communication and management applications, artificial intelligence tools, and social media in activities involving children and adolescents.

Simply contracting a platform does not, in and of itself, equate the school with the digital service provider. It is necessary to distinguish the provider’s obligations from the educational institution’s duties, without ruling out the possibility that the school itself may fall under the law’s scope when it offers digital products or services covered by its provisions.

It is up to each institution to assess the technologies adopted, the data processed, and the risks associated with their use, taking into account the Digital ECA and the obligations already set forth in the Statute of the Child and Adolescent (“ECA”), the General Personal Data Protection Law (“LGPD”), and other applicable regulations.

Below, we highlight the key points of attention for educational institutions:

1. Students’ Personal Data and Privacy

The use of educational platforms, communication apps, and academic management systems may involve the processing of personal data belonging to children and adolescents, such as registration information, performance records, and usage history of virtual environments.

The ECA Digital reinforces privacy protection and security in the digital products and services covered by its provisions. Schools are advised to map the data collected and shared and to review their privacy policies and contracts with vendors. This analysis should consider the purposes and legal bases for processing, the necessity of the data, and the best interests of children and adolescents, in accordance with the LGPD.

2. Use of Images and Publicity on Social Media

The publication of photographs and videos of students on social media, institutional websites, and promotional materials requires prior review. The Digital ECA should not be interpreted as a general prohibition on the use of images, nor as unrestricted authorization for their dissemination. The protection of the image, identity, and dignity of children and adolescents continues to require compliance with the ECA and other applicable regulations.

It is recommended to review authorizations and disclosure procedures, especially when the content allows for the identification of the student, their location, or aspects of their daily routine. The purpose of the publication, the authorizations, and the applicable legal basis, as well as the student’s best interests, must be considered in each case. The existence of authorization does not preclude an assessment of the risks of exposure and the restrictions applicable to the content.

3. Educational Platforms and Artificial Intelligence Tools

Adaptive platforms, virtual tutors, and artificial intelligence tools can offer pedagogical benefits, but they also require an assessment of the risks to students’ privacy, safety, and well-being.

This assessment should consider the features, age appropriateness, and the personal data involved. Recommendation systems, user interaction features, and gamification mechanisms—such as rewards and incentives to keep students engaged—deserve special attention when they may encourage excessive use or expose children and adolescents to risks.

In addition to educational suitability, it is recommended to examine the terms of use and contracts with providers, especially the rules regarding security, the use and sharing of personal data, and the responsibilities of each party. When using artificial intelligence, it is advisable to assess whether the information entered could be reused by the provider and what controls and forms of human oversight are available.

4. Parental Supervision and Involvement of Guardians

The Digital ECA provides for mechanisms of parental supervision and establishes specific obligations for digital service providers, such as monitoring tools and controls over certain features.

Educational institutions must clearly inform students about which technologies are made available to them, their intended purposes, and the necessary precautions for their use. It is also recommended to evaluate the supervision features offered by providers. Communication between schools, families, and providers contributes to a safer digital environment while respecting students’ progressive autonomy.

5. Prevention of Cyberbullying and Digital Violence

Measures to prevent bullying, harassment, and other forms of violence in the virtual environment are also part of the new protective framework. The law provides for measures related to the prevention and response to these practices by the agents for whom it is intended.

For schools, it is important to maintain structured processes for receiving reports, supporting those involved, and referring incidents that affect the school environment, while respecting students’ privacy and protection. These procedures must define communication channels and criteria for referring cases to the appropriate authorities, when applicable. Educational initiatives involving students, families, and school community professionals complement these prevention efforts.

What are the legal risks?

The ECA Digital provides for administrative sanctions for noncompliance with the obligations imposed on entities subject to the law. Its application to an educational institution requires determining whether the activity falls within its scope and identifying any obligation that may have been breached; liability does not automatically arise from the use of third-party platforms. Whether an educational institution can be held liable will depend on the specific circumstances, the role it plays, and the obligations applicable to the case.

In addition to potential legal consequences, incidents involving the improper exposure of students, the misuse of personal data, or security breaches can damage the institution’s reputation and erode the trust of families.

Preventive Legal Compliance

Protecting children and adolescents in digital environments requires institutional attention to the use of technology. Preventive measures encompass the selection of platforms, the contracting of vendors, the handling of information, and procedures for preventing and responding to incidents.

Compliance is not limited to reviewing documents: it requires assessing risks, implementing measures compatible with the school’s activities, and continuously improving institutional practices. Monitoring must take into account the characteristics of each institution and the technologies it uses.

How can LBM Advogados help?

The team at LBM Advogados provides legal guidance and can assist educational institutions in evaluating their current practices, reviewing documents and contracts, and identifying preventive measures related to the Digital ECA, the ECA, and the LGPD. Contact us so we can work together to assess your institution’s needs.

This content is for informational purposes only and does not replace a legal analysis of each institution’s specific circumstances.