Cybersecurity Policy Report, Preliminary Age Verification Guidelines Released in Brazil, (Mar 23, 2026)

By Tony Foley

The National Authority for Protection of Data (ANPD), Brazil’s data protection authority, published preliminary guidelines last week for the adoption of reliable age verification mechanisms by suppliers of information technology products and services aimed at children and adolescents.

The preliminary guidelines may be accessed from this web page but are available only in Portuguese. According to a Friday press release from ANPD, the guidelines present initial parameters for the implementation of the mechanisms contemplated in Law No. 15.211/2025, the Digital Child and Adolescent Statute (Digital DCA), which was enacted in September 2025 and took effect March 17, as well as Decree No. 12.880 of March 18, 2026, which was designed to provide predictability and legal certainty to regulated agents from the moment the law took effect. The law establishes a comprehensive framework for the protection of children and adolescents in digital environments. The agency launched a consultation late last year to clarify terminology in the new law (CPR, Dec. 1, 2025).

The preliminary guidelines are designed to ensure that the implementation of the mechanisms is compatible with the right to privacy and the protection of personal data of children and adolescents. It reflects the ANPD’s institutional position and will serve as a reference for its monitoring activities until the publication of definitive guidelines following further public consultation.

In addition to outlining the factors that businesses should consider when selecting an age verification method, the guidance establishes a schedule for monitoring the compliance of digital product and service providers, which ANPD began last year and plans to expand in the coming months. The schedule contemplates two additional monitoring phases; the first stage, which will begin immediately, will prioritize monitoring app stores, which play a foundational role in the protection of children and adolescents by enabling age verification and the configuration of parental supervision mechanisms on the device itself, and the second stage, scheduled to begin in August 2026 after the publication of definitive guidelines, expanding monitoring to other sectors and groups of suppliers. The monitoring schedule does not exclude other oversight activities that the ANPD may carry out at any time based on the receipt of complaints or the identification of violations representing a high risk to the protection of children and adolescents.

News: InternationalLegislation DataPrivacy