What the law requires, how it's enforced, and why contextual advertising is now the only compliant path forward.
What is the Digital ECA and when did it take effect?
The Digital ECA is the name given to Law No. 15.211/25, signed on September 17, 2025 and in force since March 17, 2026, following a six-month vacatio legis period. It was regulated by Decree No. 12.880, signed on March 18, 2026, one day after it took effect. It is the most comprehensive and developed child online protection framework in the region, and the one most likely to be used as a template across the rest of Latin America.
What products and services does it apply to?
It applies to any digital product or service accessible to minors, whether or not it was specifically designed for them. This is the so-called "probable access principle." It covers international platforms operating in Brazil, regardless of where they are headquartered.
The law doesn't ask who the advertiser said the campaign was for; it asks whether a minor was likely exposed to that environment. If the environment (a YouTube channel, a social network, a gaming app) has a probable minor audience, the law applies automatically, with no need to prove that a minor actually saw or clicked the ad. That's why categories typically seen as "adult" (insurance, baby products, financial services) can still be covered if they run in environments with a high probability of family co-viewing.
What obligations does it impose on platforms and advertisers?
- Age verification: implement reliable mechanisms. Self-declaration alone is legally insufficient.
- Tracking ban: children and teenagers cannot be behaviorally tracked or individually profiled for advertising purposes.
- Maximum privacy by default: the highest privacy settings apply to U18 users without requiring them to opt in.
- Non-compulsive design: eliminate mechanics that encourage compulsive use, such as infinite scroll, autoplay, or loot boxes in games aimed at minors.
- No monetization of content that sexualizes minors.
- Parental oversight: provide effective tools for parents to supervise usage.
- Public biannual reports: mandatory for platforms with more than 1 million registered U18 users in Brazil, covering moderation, complaints, risks, and measures taken.
- Prior judicial authorization: required to use a minor's image in sponsored or boosted content on a recurring basis.
| Prohibited under the Digital ECA | Allowed and recommended |
|---|---|
| Behavioral tracking and individual profiling of minors | Contextual targeting by content environment |
| Any DMP that processes U18 personal data | N/A. A contextual DSP doesn't run a DMP |
| Behavioral DSP with cookies or U18 tracking | Contextual DSP with no personal data |
| Retargeting minors | Doesn't exist in a contextual model |
| Collecting personal data for ad targeting purposes | Zero personal data collected from minors |
| Age self-declaration as the only control | Inventory curated by age bracket, no registration required |
| Open algorithmic feed | Manually audited inventory, classified as brand-safe |
How is compliance enforced?
Enforcement has been active since March 17, 2026. ANPD (Brazil's National Data Protection Authority) is the lead regulator: it was turned into a regulatory agency by Law No. 15.352/2026, and Decree No. 12.880 expanded its powers to regulate, oversee, and sanction compliance with the Digital ECA across the country.
| Body | Role under the Digital ECA | Scope |
|---|---|---|
| ANPD | Lead regulator: regulates, oversees, and sanctions. | All platforms |
| Ministério Público (Public Prosecutor's Office) | Can open investigations and pursue criminal liability independently of ANPD. | Criminal + civil |
| Conanda | Oversees public policy and provides implementation guidance. | Public policy |
| Anatel | Supports ANPD in enforcement at the network infrastructure level. | Infrastructure |
| Centro Nacional (National Center) | Linked to the Federal Police; centralizes reports of digital crimes against minors. | Criminal reports |
| Judiciário (Judiciary) | Steps in for the most serious sanctions: suspension or permanent ban from operating in Brazil. | Serious cases |
Enforcement is being rolled out gradually, in three phases set by ANPD: from March 2026, monitoring of app stores and operating systems; from August 2026, expanded monitoring across other sectors; and from January 2027, systematic enforcement. Outside that timeline, ANPD can act at any time in response to a complaint or an identified violation. This doesn't mean the law isn't already in force: a platform or brand that behaviorally tracks minors or hasn't implemented age verification is already subject to investigation and sanctions.
What are the penalties?
The standard fine is up to 10% of the economic group's revenue in Brazil in the last fiscal year, capped at R$ 50 million per infraction; when no revenue is declared in the country, fines range from R$ 10 to R$ 1,000 per registered user, with the same cap. Foreign companies aren't exempt: their subsidiaries or offices in Brazil are held jointly liable, and international parent companies aren't immune to Brazilian enforcement. Repeat violations, refusal to cooperate with ANPD investigations, and large-scale impact on minors all increase the severity of the sanction.
| Sanction type | Description | Enforcing body |
|---|---|---|
| Warning | Formal notice to remediate. No financial penalty at this stage. | ANPD |
| Fine per infraction | Up to R$ 50 million per infraction. Each violation is counted separately. | ANPD |
| Fine per user | With no declared revenue: R$ 10 to R$ 1,000 per registered minor user. | ANPD |
| % of revenue | Up to 10% of the economic group's gross revenue in Brazil. | ANPD |
| Temporary suspension | Suspension of the platform's services in Brazil. | ANPD / Judiciary |
| Permanent ban | Total prohibition of the platform's activities in Brazil. | Judiciary |
| Criminal liability | Additional penalties under the Criminal Code for serious violations. | Judiciary / Public Prosecutor's Office |
Who is liable for non-compliance: the platform or the brand?
The law assigns primary responsibility to platforms, but brands and advertisers aren't exempt either. A brand running U18 advertising through a non-compliant DSP or a social network can be held jointly liable. A brand that runs U18 advertising through a behavioral DSP or a social network in Brazil isn't shielded by that platform's non-compliance. The joint liability set out in the Digital ECA explicitly applies to advertisers. That's why brands are advised to make sure every advertising partner they use in Brazil is natively compliant with the law.
How Kidscorp's DSP is aligned by design
Kidscorp is an advertising SaaS platform built exclusively for U18 audiences. Every architecture decision treated privacy protection as a design constraint, not as an add-on applied later. The result is a platform that was already compliant before the Digital ECA existed. Privacy by design isn't just one more component: it's the guiding principle behind the three pillars of its architecture: Declarative, Contextual, and Historical. That's why compliance with LGPD, the Digital ECA, COPPA, and GDPR-K is native, not applied retroactively.
- Declarative: data voluntarily contributed by more than 250,000 consenting households, under verified parental consent, always anonymized and aggregated by segment.
- Contextual: selects content environments by topic, IP, and context, never by user profile.
- Historical: uses aggregated patterns from past campaigns and content consumption, with no individual identification of minors.
The curated inventory spans three biddable inventories: YouTube (including CTV), Apps & Games, and Roblox, classified by age bracket before any purchase decision is made. The classification is proprietary: semantic analysis of context at the video level, complemented by the audience's declarative responses, with monthly reclassification through an automated process plus human validation. On Roblox, the leading metaverse platform for teenagers in Brazil, Kidscorp sells the 13+ segment and classification is done in-house, not outsourced. Segmentation covers country, age bracket (3 to 5, 6 to 9, 10 to 12, and 13 to 17 years old), gender, socioeconomic level, and Passion Points, all without touching a minor's personal data.
Certifications and coverage: the platform currently holds the kidSAFE SAFE CERTIFIED seal (United States), of which Kidscorp Ad Platform has been a member since 2018. The platform also operates in compliance with LGPD (Brazil), the Digital ECA Law No. 15.211/25 (Brazil, aligned by design), COPPA (United States), and GDPR-K (European Union).
In summary
The Digital ECA isn't an exception for Kidscorp. It's regulatory confirmation of a model the platform built before the law existed. No Kidscorp media plan requires additional legal review for the Digital ECA before it goes live. For a brand operating in Brazil, the choice is concrete: keep running behavioral advertising on non-compliant platforms and risk sanctions of up to R$ 50 million per infraction plus joint liability, or activate a contextual DSP that's natively aligned with the law.
This article was based on Kidscorp's Official Guide to the Digital ECA 2026. Download the full guide here.