{"id":3207,"date":"2026-10-12T13:02:45","date_gmt":"2026-10-12T16:02:45","guid":{"rendered":"https:\/\/lbm-legal.com.br\/?p=3207"},"modified":"2026-10-13T13:05:57","modified_gmt":"2026-10-13T16:05:57","slug":"digital-eca-age-verification","status":"publish","type":"post","link":"https:\/\/lbm-legal.com.br\/en\/digital-eca-age-verification\/","title":{"rendered":"Digital ECA and Age Verification Mechanisms in the Digital Environment"},"content":{"rendered":"

The growing digitization of social and commercial interactions poses significant challenges to the protection of personal data, especially when it involves children and adolescents. In Brazil, the General Data Protection Law (LGPD), the Statute of the Child and Adolescent (ECA), and, more recently, Law No. 15,211\/2025 (Digital ECA), regulated by Decree No. 12,880\/2026, establish the legal framework aimed at protecting the rights of this demographic in the online environment.<\/p>\n

The National Data Protection Authority (ANPD), in its regulatory and supervisory capacity, has issued crucial guidelines for companies operating digital platforms, internet applications, and online services, with particular emphasis on the guides regarding reliable age verification mechanisms and the protection of children and adolescents in the digital environment. This newsletter aims to present the ANPD\u2019s key guidelines regarding age verification mechanisms, contextualizing them within the current legislation and highlighting their practical implications for companies.<\/p>\n

The ANPD Guide and the Six Minimum Requirements for Age Verification<\/p>\n

The ANPD\u2019s Guidance Document, \u201cPreliminary Guidelines on Reliable Age Verification Mechanisms<\/a>,\u201d reflects the agency\u2019s institutional position and serves as a reference for its activities to monitor and enforce compliance with Article 9 of the Digital ECA and Article 24 of Decree No. 12,880\/2026.<\/p>\n

The minimum legal requirements for age verification mechanisms have been grouped as follows:<\/p>\n

    \n
  1. Proportionality: <\/strong>The age verification solution must be proportionate to the level of risk associated with the digital service or product. Companies must identify and assess in advance the risks inherent in the digital service or product and those arising from the verification mechanism, especially those involving biometric data. Tools such as the Personal Data Protection Impact Assessment (PDPA) are recommended for this analysis.<\/li>\n
  2. Accuracy, Robustness, and Reliability: <\/strong>The implemented mechanism must be accurate, resistant to fraud attempts, and capable of operating stably under real-world conditions. Solutions based exclusively on user self-declaration have a low degree of reliability, are easily manipulated, and are therefore insufficient to meet regulatory requirements.<\/li>\n
  3. Privacy and Personal Data Protection: <\/strong>Solutions must adhere to the principles of data minimization, privacy protection, information security, prohibition of secondary use, prohibition of traceability, and prohibition of continuous, automated, and unrestricted sharing of personal data. Technologies such as verifiable credentials and zero-knowledge proofs are cited as examples of approaches that reduce data exposure, aligning with privacy best practices.<\/li>\n
  4. Inclusion and Non-Discrimination: Age verification mechanisms must not result in the undue exclusion of users or perpetuate discriminatory biases. It is recommended to provide for alternative methods of age verification to ensure accessibility and avoid disparities, for example, in the accuracy of biometric solutions across different population groups.<\/li>\n
  5. Transparency and Auditability: Providers must clearly and accessibly disclose the purpose of the mechanism, the data used, and the consequences of the verification, in addition to offering channels for appeal and correction. It is essential to maintain audit logs, but without unnecessarily storing biometric or documentary data for this purpose.<\/li>\n
  6. Interoperability: Solutions must allow for the exchange of strictly necessary age attributes between systems, without creating extensive integrated databases or continuously sharing personal data. Double-blind architectures, trusted intermediaries, and cryptographic tokens are examples of technical approaches that promote secure interoperability.<\/li>\n<\/ol>\n

    Digital Chain of Responsibility and Specific Requirements for Technical Solutions<\/p>\n

    The ANPD Guidance Document establishes a digital chain of responsibility, distributing age verification obligations according to the provider\u2019s role in the digital environment. This model provides for a two-tier protective system that requires coordinated action among the various stakeholders.<\/p>\n

    At the first level, app stores and operating systems are responsible for the initial age verification and for sharing an \u201cage signal\u201d via API with other providers.<\/p>\n

    At the second level, other providers of products and services must ensure the proper receipt and processing of these age signals, in addition to establishing contingency mechanisms for any failures in signal transmission. Additional age verification mechanisms may be required, depending on the risk and nature of the product or service.<\/p>\n

    The guide also details specific requirements for technical solutions, such as:<\/p>\n