ECA Digital: what it is, what changes, and what parents should do.
Table of Contents
From day March 17th, 2026 the so-called ECA Digital, an update of Child and Adolescent StatuteThe law's proposal is clear: to reduce risks such as exposure to inappropriate content, improper data collection, and dangerous interactions on social networks and online games. However, along with this protection come practical challenges, especially for parents, who now need to understand how to adapt their children's digital routine to this new scenario. Learn more below.
What is the Digital ECA?
O ECA Digital (Law No. 15.211/2025) is the new legislation enacted on September 17, 2025, focused on online security. Contrary to what many believe, it is not merely a revision of the old text, but rather a separate law that works in conjunction with the existing framework. Statute of Children and Adolescents (Law No. 8.069/1990) The full text of the new legislation can be read at the original. official page of the Planalto Palace.
The creation of this approach arose not only from technological evolution, but also as a direct response to recent episodes that exposed serious flaws in the protection of minors in the digital environment. One of the most publicized cases was that of the influencer... Felcawhich brought to light discussions about the exposure of children on social media, the monetization of content involving minors, and the lack of effective control mechanisms on the part of the platforms, as presented in the video below:
The repercussions of this case broadened the public debate: the internet has evolved much faster than legislation. Previously, the system operated based on loopholes, such as the simple "self-declaration of age." With the ECA DigitalThis will end, and platforms will be required to adopt concrete measures to prevent the risks to which minors are exposed.
Furthermore, the legislation reinforces the understanding that children and adolescents are users in a situation of increased vulnerability in the digital environmentThis requires not only reactive protection, but also a preventative approach, from the design of the platforms to the algorithms that determine what will be displayed. In other words, the idea is not only to protect children and adolescents from the dangers of the digital world, but to promote the creation of tools that allow them to enjoy this technology more safely.
Main changes
The main disruption brought about by ECA Digital It lies in how the users' age is handled. self-declarationThe simple field where the user enters their date of birth is no longer considered sufficient. This forces companies to seek more sophisticated solutions, such as document verification, biometrics, or integration with digital identity systems. Below, you can find a detailed look at the four main structural pillars of the new [Brazilian digital identity system]. ECA Digital.
Prevention through social media
Technology companies and platforms are now legally obligated to adopt precautionary measures from the conception of their products. The rule of privacy by default (Maximum privacy by default) is now legally established in Article 7, paragraph 1This includes combating architectures that create dependencies: the Article 17, paragraph 4, items II and V, obliges platforms to limit features that artificially extend continuous use (such as scrolling (infinite and automatic video playback) and giving control over recommendation algorithms.
Police action and the fight against crime.
The fight against exploitation is gaining institutional strength, and platforms are losing the right to remain silent. According to the Article 27, paragraphs 1 and 2Providers are now required to retain data and send notification reports directly to the competent authorities when they identify content related to exploitation, sexual abuse, or solicitation. In addition to this, the Article 28, sole paragraphThe law stipulates that the platform must notify the authorities to initiate a criminal investigation upon being informed of violations.
Strengthening and empowering families
The law seeks to lessen the burden that previously rested solely on parents' shoulders, providing them with the necessary tools to take action. This initiative is guaranteed by all... Chapter V (Arts. 16, 17 and 18)which makes it mandatory to offer "Parental Supervision" mechanisms. Art 18Specifically, it guarantees parents the right to view, configure accounts, restrict financial transactions, and limit screen time for minors on the platforms.
Blocking inappropriate content
O Art. 6º It details the obligation to mitigate the risk of contact with strictly prohibited content (violence, pornography, encouragement of self-harm, gambling and loot boxes (children). For the blocking to be effective, the simple self-declaration of age ceases to exist. The Article 24 and its paragraphs They are now requiring companies to adopt robust age verification methods and systems (which may involve biometrics or document validation), with the technical challenge of doing so while collecting the minimum amount of data possible to avoid violating privacy.
Penalties and sanctions
With regard to sanctions, The text of the Digital ECA (Law No. 15.211) does not provide for direct and exclusive penalties for parents. in his articles. Despite this, the Chapter XV (On Sanctions)Article 35 of the law, more specifically, establishes strict penalties, such as warnings and fines that can reach... R$ 50 million or 10% of revenue, and the temporary suspension or prohibition of activities. However, All of these sanctions described in the law are directed at application providers and technology vendors. (platforms, social networks, game developers) that fail to protect children, not families.
It is also important to emphasize that, although the Digital ECA does not create new punishments directly applicable to parents in its own text, it acts in a complementary way to the existing legislation. Original Statute of Children and Adolescents (Law No. 8.069/1990) and Criminal CodeTherefore, serious failures in protection or the use of children for improper monetization (constituting exploitation and online child labor) subject parents to the penalties and legal liabilities that already exist in previous legislation, such as loss of custody or court fines.
What should parents do now?
Despite regulatory advancements, the role of parents remains central and, in many cases, even more relevant. This is because no technology completely replaces family guidance in internet use.
In practice, this means moving from a reactive stance (acting only when a problem arises) to a proactive and continuous approach. Parents need to understand that the digital environment is part of their children's lives and should be monitored with the same attention as other areas, such as school and friendships. Below are some essential steps parents should take.
Active and continuous care
Cell phones and tablets can no longer be considered passive "electronic babysitters." ECA Digital It reinforces that a child's integration into the digital world requires monitoring. This means maintaining an open and frequent dialogue about what children are consuming, what games they are playing, and who they are talking to. Active care involves educating the child to have critical thinking skills when browsing, understanding that not everything on the internet is true or safe, and creating a trusting environment where they can report anything disturbing they see.
Use of control tools
The new legislation requires platforms to provide easy-to-use and accessible parental supervision mechanisms. However, the responsibility for setting up and activating these safeguards rests entirely with the parents. In practice, parents/guardians must:
- Restrict transactions: Block the possibility of in-app purchases or subscriptions without prior adult approval via password.
- Adjust privacy: Ensure that minors' accounts are private and that location sharing (GPS) is disabled for strangers.
- Limit screen time: Use the native tools to set device blocking times, such as during classes or at bedtime.
Risk prevention and exploitation.
O Article 6, paragraph 1 do ECA Digital It explicitly states that the new obligations of technology companies do not exempt parents from acting to prevent their children from being exposed to harmful situations. It is essential to educate children and adolescents about real threats, such as recruitment by sexual predators disguised as online game predators, etc. cyberbullying and the dangers of sending intimate photos. In addition to prior guidance, parents need to be attentive to warning behavioral signs, such as social isolation, aggression when the device is taken away, or a sharp drop in school performance, which may indicate digital addiction or that the child is being victimized by some online crime.
The obligations of companies and technology
O ECA Digital It doesn't suggest; it compels. big tech to change their structural operation. Companies must implement age verification and ensure that their environments operate with maximum safety by default for minors. In practice, the requirements of the law already impose the following adjustments:
- Instagram (Meta): The social network has started to adopt what are called "Teen Accounts" (Teen Accounts), which make profiles of minors under 16 years of age private by default, directly applying the concept of privacy by default required by law. In addition to restricting the sending of direct messages (DMs) by unknown adults and activating strict filters against sensitive content, Instagram now uses artificial intelligence (facial analysis by selfies (in video) and submission of identity documents to block users who try to lie about their age to circumvent the restrictions.
- X (Former Twitter): Historically known for more flexible policies regarding adult content, X had to adapt to blocking inappropriate content. The platform began integrating third-party identity verification systems, requiring the submission of official documents and selfies to verify the user's age before granting access to sensitive content (NSFW) or allowing profile monetization, ending the old model that relied solely on the user's word.
- Google: To access accounts, create profiles, or consume age-restricted services on YouTube, the company will need to request real document verification or use validated artificial intelligence, abandoning the old "confirm your date of birth" box.
- Roblox: The gaming platform will have to apply strict and automatic restrictions to chat and mature experiences for underage accounts, requiring parental control panel approval for any communication with strangers to occur.
- Nintendo (and the Games market): Developers are required to abolish the sale and promotion of loot boxes (mechanisms of luck/chance) in children's games, in addition to integrating systems that prevent the purchase of adult games (18+) without biometric or documentary validation from guardians.
- Pornhub (and adult websites): The classic "Yes, I am over 18" button on the homepage becomes illegal. Access to these sites will require the implementation of a robust "age signal" (official identity verification) that categorically blocks entry to children and teenagers.
The role of the Financial System in overseeing the Digital ECA (Statute of Children and Adolescents).
The great technological dilemma posed by ECA Digital It's age verification. How can digital platforms be sure that a user is of legal age without requiring them to send photos of sensitive documents to dozens of different websites, which would generate an immense risk of leaks and violate the law? General Law on Data Protection (LGPD)? The NubankFor example, it's a digital bank that already offers a account for children between 6 and 17 years old with age verification via documents and parental controls. However, the problem may be bigger, and the answer to this structural bottleneck lies in the financial system.
Unlike social media platforms, which have historically prioritized rapid user growth with minimal friction in the registration process, banks operate under strict regulations from the Central Bank. They already possess well-established infrastructures... KYC (acronym in English for Know Your Customer, or “Know Your Customer”). This means that financial institutions already have validated databases, with checks of official documents, biometrics, and facial recognition of a large part of the Brazilian population.
In this new scenario, the financial system takes on a dual and strategic role:
- Acting as a provider of "Age Rating" information for third parties. Instead of each social network, adult website, or gaming platform creating its own database of civil identities, banks can act as "guarantors" of the user's age. The bank securely processes biometrics in its own environment and does not share the person's name, CPF (Brazilian tax identification number), or any financial data with the social network. The institution only issues an encrypted "age signal"—a digital confirmation stating strictly "Yes, this user is within the permitted age range" or "No, they are a minor." This fulfills the requirement of the ECA Digital (Brazilian Statute of Children and Adolescents) to block access to inappropriate content, while simultaneously guaranteeing the user's complete privacy.
- The suitability of the banking products themselves. In addition to serving as support infrastructure for the big techFinancial institutions themselves are also subject to the new law. Banking apps will be required to include even more transparent parental supervision tools, ensuring that parents have complete, real-time control over spending limits and transactions. Furthermore, banks are prohibited from using aggressive marketing techniques, behavioral advertising, or manipulative designs that encourage rampant consumerism or early debt among young people.
What experts think
The implementation of ECA Digital This raises significant technical challenges, especially when it comes to age verification, one of the most complex aspects of the new legislation. To better understand this scenario and the practical challenges of... ECA Digital, showmetech talked to Carla do Couto Hellu Battilana, partner at TozziniFreire Advogados. For her, the financial system can play a strategic role in this scenario, acting both in adapting its own products and as support for other platforms.
“The financial system can contribute in two main ways. The first, and most immediate, is as an obligated party: institutions that offer accounts and applications accessible to minors need to review their own products to ensure compliance with the Digital Statute of Children and Adolescents (ECA Digital).”
This includes adjustments such as clearer terms of use, parental supervision tools, and more restrictive privacy settings. However, according to the expert, the greatest potential lies in the possibility of banks acting as age verification providers for third parties.
“Banks already carry out robust KYC and document verification processes. This capability can be made available through APIs that only confirm whether the user has reached a certain age range, without sharing personal data.”
In practice, this would allow digital platforms to validate users' ages more securely, receiving only an "age signal" without access to sensitive information. However, Carla emphasizes that this does not exempt technology companies from their responsibilities.
“Age verification is just one element of digital protection for children and adolescents. This does not transfer the responsibility of platforms for full compliance with the law.”
Another important point is the structural difference between banks and big tech companies. While technology companies have prioritized growth and ease of access, the financial sector has always operated under strict regulatory requirements.
"Banks are legally required to verify identity from the moment an account is opened. This has created an infrastructure that big tech companies don't have—and which can now be leveraged."
Despite the opportunities, regulatory barriers still exist. Carla points out that there is a lack of clear definitions regarding which age verification methods will be considered valid, as well as specific rules for data sharing within Open Finance.
“There is still legal uncertainty. The Central Bank would need to regulate 'age signal' APIs, and any solution must also consider financial inclusion, since not everyone has a bank account.”
Despite these challenges, the outlook is seen as promising. With existing infrastructure and active regulatory bodies, Brazil can advance rapidly — provided there is coordination between technology, the financial system, and regulation.
Essential tools for protecting children online.
Even with the changes brought about by the Digital ECA (Statute of Children and Adolescents), the use of control tools remains one of the most effective forms of protection.
Today, both operating systems and applications offer native features and dedicated solutions for monitoring and limiting internet use by children and teenagers. Ideally, different approaches should be combined to create a more comprehensive layer of protection.
Parental controls on Android and iOS
Google's native tool allows parents to fully manage their child's Android phone. It's possible to approve or reject app downloads, hide inappropriate apps, monitor daily screen time, set bedtimes (by locking the device), and track the device's location in real time.
You can download the Family Link free of charge by Google Play Store.
Integrated into the Apple system, the feature Usage Time (Apple Screen Time) It allows parents to set strict limits for categories of apps (e.g., limiting social media to 1 hour per day). Additionally, the "Communication Limits" feature blocks messaging or calls with people who are not previously authorized in the child's contact list.
This feature is already native to iOS devices and can be accessed via Settings -> Usage Time.
In addition to native solutions, there are third-party apps which expand upon these functionalities, offering more detailed monitoring and real-time alerts.
Security settings on social networks
Social media also offers important tools that often go unnoticed. Platforms such as Instagram, Tik Tok e YouTube They have specific settings for accounts belonging to minors.
Key features include:
- private profiles by default
- Restricting messages from unknown senders
- comment control
- sensitive content filters
- Activating and reviewing these settings regularly is essential to reducing risks.
Monitoring apps and time limits
In addition to native tools, dedicated apps can help strengthen parental control. Solutions such as Kaspersky Safe Kids They allow you to track usage across different devices, set custom rules, and receive alerts about potentially dangerous behavior.
These apps typically offer features such as:
- app blocking
- navigation monitoring
- screen time control
- activity reports
You can download the Kaspersky Safe Kids It can be downloaded for free. Windows, Android, iOS e MacOS.
It is important to remember that the use of these tools should not be seen as excessive surveillance, but as part of a protection strategy, especially for younger children.
O ECA Digital This marks a new moment in how Brazil approaches the protection of children and adolescents in the online environment. By demanding more responsibility from companies and encouraging safer practices, the law represents an important step forward, but it doesn't solve everything on its own.
In practice, digital security remains a joint effort. Companies need to invest in technology and transparency, while parents and guardians must take an active role in guidance and monitoring.
More than restricting internet use, the challenge now is to teach children how to navigate safely, preparing them for a digital environment that is both full of opportunities and risks. Even so, the success of this initiative will depend not only on the law, but on how it is implemented in practice—and on the active participation of families, businesses, and regulators.
Related Videos
And you, what do you think of the new rules that aim to change how children and teenagers access the internet? Tell us in the comments!
Learn more
Sources: Planalto Palace, G1, CNN Brazil
Discover more about Showmetech
Sign up to receive our latest news via email.
