Human Rights Watch (HRW) on Thursday welcomed the signing of a new law in Brazil designed to protect children’s rights online, describing the legislation as a significant advancement and encouraging the government to further enhance data protection for all citizens.
The new law, known as the ECA Digital (for Child and Adolescent Statute), seeks to modernize child protection in the digital era and extend the safeguards provided by the General Personal Data Protection Law. The legislation established a series of obligations on information technology providers, including internet applications, application stores, and electronic games. These requirements mandated technology companies offering services to children to design products and services that prioritize the interests of young users and ensure the highest standards of privacy to protect them from online risks.
For instance, online service providers must implement technical measures to prevent minors from inappropriate access or use of their services. They are also required to avoid processing minors’ personal data in ways that would lead to an intrusion on their privacy or other rights. ECA Digital further requires technology companies to adopt age verification mechanisms, and minors aged 12 to 18 will need parental or legal guardian consent to download online applications.
The legislation also prohibits the use of “loot boxes” in video games, despite opposition from some deputies and technology companies. Loot boxes are virtual items in video games that can be purchased with real or virtual currency without the ability to know the content of the package beforehand.
Companies that do not comply with the bill’s provisions could face fines up to 50 million Brazilian reais ( $9.44 million) or up to 10 percent of their revenue in Brazil. Depending on the severity of the violation, companies may also be subject to a suspension or a ban.
ECA Digital was signed into law by the Brazilian President Lula Da Silva on September 17 and is scheduled to take effect in March 2026. According to Da Silva, the legislation will provide Brazilian parents with effective tools to protect their children’s online privacy by enabling the use of devices that can restrict access to inappropriate content.
Online data protection has become an increasingly prominent issue in recent years, affecting not only children but internet users of all ages. Multiple technology companies have faced legal action for breaches of data privacy. In March 2025, the French competition regulator fined Apple $162 million for privacy violations. In 2024, the Irish Data Protection Commission imposed a 91 million euros fine on Meta Platforms Ireland Limited for improper password storage, violating the European Union’s General Data Protection Regulation. The social media platform X also faced numerous complaints across the EU regarding illegal use of personal data. Furthermore, Amnesty International criticized TikTok for failing to address risks that threatened youth mental health.
More recently, the Texas attorney general initiated investigations into AI chatbot services that may have misled children into believing they were receiving mental health support while delivering generic responses without medical oversight.
