This Wednesday, October 28, the Brazilian Data Protection Agency (ANPD) published the Guidelines titled “Providers of Information Technology Products or Services: Scope and General Obligations under the ECA Digital”. The document was developed based on contributions received during the call for contributions conducted between April and June 2026, and includes practical examples, explanatory tables, and flowcharts.

According to the ANPD, the publication of the Guidelines forms part of the Agency’s broader efforts to implement the ECA Digital, strengthen providers’ accountability, and promote safer digital environments for children and adolescents.  

As stated by the Agency, the Guidelines aim to clarify two issues that have created uncertainty since the Digital Statute for Children and Adolescents (ECA Digital) took effect: (i) which entities are subject to the statute’s provisions; and (ii) the meaning and implications of the duty of prevention imposed on regulated entities. These questions are particularly relevant because Article 1 of the ECA Digital broadly states that the statute applies to any products and services directed at or likely to be accessed by children and adolescents.

In this context, the Guidelines address topics such as the definition of providers subject to the ECA Digital, the criteria used to determine likely access by children and adolescents, and the content of the preventive duties established by the statute.

Which providers fall within the scope of the ECA Digital?

The Guidelines clarify that the concept of a provider of information technology products or services subject to the ECA Digital encompasses all entities that offer services or market products in the digital environment, provided that said products or services are directed at or likely to be accessed by children and adolescents. These include social networks, applications, app stores, content-sharing platforms, electronic games, operating systems, messaging services, and online marketplaces.

For an activity to fall within this category, the Guidelines indicate that the product or service must meet three requirements: it must (i) be offered remotely; (ii) operate through electronic means; and (iii) be made available at the individual request of the user.

What does the ANPD mean by “likely access”?

One of the most noteworthy aspects of the Guidelines is the interpretation of the concept of likely access, which the ECA Digital uses to determine situations in which the legislation may apply even to services directed at the general public.

According to the ANPD, three statutory criteria must all be met for a product or service to qualify as being likely accessed by children and adolescents:

• The attractiveness of the product or service to children and adolescents and the likelihood that they will use it;

• The ease of access and use; and

• The existence of a significant degree of risk to their privacy, safety, or biopsychosocial development.

The Guidelines emphasize, however, that these criteria should not be used to unduly restrict the scope of the ECA Digital, particularly in situations involving significant risks to children and adolescents. Instead, they must be interpreted in light of the principle of the minor’s best interests.

The document also highlights that certain categories of services, such as social media, app stores, and operating systems, are generally regarded by the ECA Digital itself as being presumptively likely to be accessed by children and adolescents, subject to the particular circumstances of each case.

Furthermore, the ANPD clarifies that a provider’s statement regarding the intended audience of its service is not, by itself, sufficient to exclude the application of the statute. Accordingly, even platforms that claim to be intended exclusively for adults may be considered subject to the ECA Digital if the Agency determines that their characteristics indicate otherwise.

The duty of prevention applicable to regulated entities

With respect to the duty of prevention introduced by the ECA Digital, providers are expected to act before violations occurs, rather than waiting for them to happen. They must proactively identify the risks associated with their products and services, assess the likelihood and severity of potential impacts, and implement measures capable of preventing or mitigating them.

The Guidelines organize these obligations into four dimensions: (i) prevention; (ii) protection; (iii) information; and (iv) security. In practice, these obligations include the adoption of more protective privacy settings, age assurance mechanisms, parental supervision tools, content moderation systems, and measures intended to reduce patterns of compulsive use. In addition, providers are expected to demonstrate the effectiveness of the measures they adopt.

Obligations proportionate to the risks posed by each service

The Guidelines further reinforce that the ECA Digital does not impose identical obligations on all regulated entities. Instead, the statute adopts a risk-based approach that takes into account factors such as the size of the provider, the number of users, the functionalities offered, and the provider’s ability to influence content and interactions within the platform.

Our team closely monitors developments related to the ECA Digital and the regulation of digital platforms in Brazil, and is available to assist companies in assessing their regulatory obligations. For further information, please contact us at techregulationbr@lickslegal.com.