Brazilian Senate approves Landmark Digital Child Protection Bill: what are the next steps?

On 27 August 2025, Brazil’s Senate approved Bill PL 2628/2022, focused on protecting the rights of children in digital platforms. The legislation was filed almost three years ago and is now awaiting President Lula’s signature, expected in the coming days. The legislative journey started in the Senate’s, with Senator Alessandro Vieira, and after went to the thematic committees, where experts, civil society organizations, and industry representatives contributed to its evolution. Later, the Chamber of Deputies approved a substituted version that reflected various technical refinements and stakeholder contributions. 

This Bill, popularly referred to as the ECA Digital, represents a major development in Brazil’s efforts to modernize child protection in the digital era. This milestone positions Brazil as one of the first major democracies to adopt a comprehensive legal framework specifically designed to regulate the digital environment for children and adolescents.

Data Privacy Brasil’s Role in the Legislative Process

Throughout this legislative journey, Data Privacy has played a significant role in shaping the debate and informing the final text. Its contributions took place on multiple fronts:

• Coalition-Building and Advocacy: As part of the Coalizão Direitos na Rede (CDR), alongside organizations such as IDEC and Instituto Alana, Data Privacy Brasil engaged in advocacy efforts that sought to strengthen safeguards and ensure coherence in the text.
• Technical Expertise and Research: Data Privacy Brasil published detailed analyses, notably the Relatório e Substitutivo do Projeto de Lei 2628/2022: o que há de novo no ECA Digital. This report highlighted areas of progress as well as gaps, such as the need to explicitly prohibit behavioral profiling and emotional analysis in advertising aimed at minors.
• Public Debate and Transparency: By disseminating research and participating in hearings, the organization helped clarify complex issues, such as the balance between parental supervision and child autonomy, the definition of the “best interest” of children, and the practical enforceability of obligations imposed on platforms.

The Final Version of the Bill: Main Provisions and Critical Assessment

Through these efforts, Data Privacy Brasil contributed to a bill that is both more robust and better aligned with international human rights standards.

The approved text of PL 2628/2022 sets forth a comprehensive set of obligations for platforms, app stores, and other digital service providers, signaling a significant shift in Brazil’s digital governance landscape. Among the most notable provisions, the bill redefines the duty of care, requiring platforms to adopt clear measures aimed at prevention, protection, information, and security for children and adolescents. It also gives concrete meaning to the principle of the best interest of the child, listing examples such as privacy, physical and mental health, and overall safety.

The law further introduces requirements to mitigate access to harmful content, ranging from sexual exploitation to self-harm and online gambling. In doing so, it reframes parental involvement: rather than emphasizing “parental control,” the text opts for parental supervision, a formulation that seeks to balance the guidance of parents with the growing autonomy of young users. Alongside this, platforms must rethink their design choices to avoid features that encourage compulsive use and are expressly prohibited from employing behavioral profiling or emotional analysis for targeted advertising to minors.

Other provisions underscore the law’s practical orientation. App stores and operating systems are now responsible for implementing age-verification systems and sharing this information with app providers, while the rules on “loot boxes” limit the prohibition to those that allow financial gain or confer unfair competitive advantage. Large platforms will also be expected to publish semiannual transparency reports addressing risk assessments, moderation practices, and their services’ impact on minors. Finally, foreign companies will be required to appoint a legal representative in Brazil, ensuring that obligations can be enforced locally.

Despite these advances, implementation will not be free of challenges. Effective oversight of multinational platforms will require strong coordination between regulators and the judiciary, and certain terms—such as “compulsive use” or “emotional analysis”—may prove vulnerable to interpretive disputes. Smaller platforms could struggle with the costs and technical demands of compliance, while the need for detailed regulatory decrees leaves important questions unanswered, including timelines, responsible agencies, and enforcement procedures. Moreover, the delicate balance between protecting children and safeguarding freedom of expression will almost certainly give rise to new debates and potential litigation.

Even with these caveats, PL 2628/2022 represents an ambitious and forward-looking framework. By explicitly tying child protection to platform accountability, Brazil is positioning itself at the forefront of global debates, aligning its standards with emerging regulatory models in Europe and beyond.

Next Steps 

The immediate next step is presidential sanction. President Lula is expected to sign the bill into law within the coming week. While partial vetoes are possible, observers anticipate that the central provisions will remain intact.

Once sanctioned, the law will require further regulatory detailing, including decrees that specify oversight responsibilities. The National Data Protection Authority (ANPD) is expected to play a central role, in coordination with other relevant authorities.

Civil society organizations, including Data Privacy Brasil, will need to remain vigilant, monitoring not only the enforcement of obligations but also potential dilution of protections through regulatory loopholes or weak oversight.

The approval of PL 2628/2022 is a landmark in Brazil’s digital policy landscape. It establishes a pioneering model of child protection online, aligning with international best practices while reflecting Brazil’s unique social and cultural context. Its success, however, will depend on effective implementation, regulatory clarity, and ongoing engagement by civil society.

Data Privacy Brasil will continue to monitor this process closely, providing analysis, disseminating information, and holding both government and industry accountable. The coming months will be decisive in transforming the promise of the ECA Digital into tangible protections for Brazilian children and adolescents.