Brazilian President Luiz Inácio Lula da Silva on September 17, 2025, signed the country's first law to protect children's rights online, Human Rights Watch said today.
The law, called the ECA Digital after its Portuguese initials, is intended to update the country's 1990 Statute of the Child and Adolescent to protect children's rights in the digital environment. Technology companies with services likely to be used by children would be compelled to design products with young users' best interests in mind and provide them with the highest levels of privacy and safety by default.
"Brazilian children are finally getting the protections they need and deserve to learn, explore, and play safely online," said Hye Jung Han, children's rights and technology researcher and advocate at Human Rights Watch.
The new law expands upon the protections for children provided by Brazil's General Personal Data Protection Law, which are insufficient.
Two of the ECA Digital's strongest provisions directly respond to concerns raised in recent Human Rights Watch investigations. One provision prohibits online services from using children's personal data in ways that "cause, facilitate, or contribute to the violation of their privacy or any other rights guaranteed to them by law … and the[ir] best interests." In June 2024, Human Rights Watch documented that Brazilian children's personal photos had been used to build powerful artificial intelligence tools later exploited to create abusive deepfakes of other children.
Another safeguard in the law bans online services from profiling children to target them with behavioral advertising, which entails tracking a child's online behavior to predict their characteristics and influence their behaviors and interests. This reflects recommendations in April 2023 and May 2022 Human Rights Watch investigations, which documented that children in Brazil and around the world had been secretly surveilled in their online classrooms and across the internet through invasive profiling and behavioral advertising techniques.
Passage of this law reflects strong political will to protect children's rights online, Human Rights Watch said. The law, which was first introduced by Senators Flávio Arns and Alessandro Vieira in 2022, unanimously passed the Senate in November 2024, cleared the Chamber of Deputies in August 2025 with support from all but one political party, and was then approved again by the Senate just one week later.
This broad support enabled the bill's passage into law despite fierce opposition from tech companies. Industry lobbying weakened some of the legislation's original proposals, including the removal of a ban on "loot boxes" in video games - features that encourage children to spend money for randomized rewards - in the version of the bill that was approved by the Chamber of Deputies. In a notable last-minute reversal, the ban was reinstated in the final text approved by the Senate after strong opposition to the removal by Senator Arns, one of the bill's co-sponsors.
The ECA Digital is set to take effect in March 2026 and will be enforced by Brazil's data protection authority. Companies that do not comply could face fines up to 50 million Brazilian reais (US$9.44 million), or up to 10 percent of the revenue they earn in Brazil. They may also face a suspension or a ban, depending on the severity of the violation.
How the law is enforced will determine whether Brazil will meaningfully protect children's rights online, Human Rights Watch said. The data protection authority should meaningfully consult with children as it begins developing protections for children's range of rights, and ensure that the agency's enforcement of the law protects everyone's rights. The government should also build on this momentum and continue to build strong data protections for Brazilians of all ages.
"Brazil has stepped forward as the first country in Latin America to pass a dedicated law to protect children's online privacy and safety," Han said. "Other governments should watch, learn, and do the same."
