Approval of ECA Digital brings challenges to privacy
Approval of ECA Digital brings challenges to privacy
Protecting children and adolescents in digital environments raises technical and ethical questions.
After three years of processing, the Chamber of Deputies approved the Digital Statute for Children and Adolescents (ECA Digital) on August 27, 2025, which provides for the protection of this public in digital environments. Complaints made by digital influencer Felipe Bressanim, known as Felca, about the adultification and exploitation of minors on social media accelerated discussions and prompted government responses. One of the challenges now is to define effective age verification mechanisms without infringing on the right to privacy of users of communication networks and platforms. Law No. 15.211/2025 was sanctioned in September by President Luiz Inácio Lula da Silva and celebrated by various sectors of society.
Rafael Evangelista, a researcher at the Laboratory for Advanced Studies in Journalism (Labjor) at Unicamp and advisor to the Brazilian Internet Steering Committee (CGI.br), views the change with optimism, but with reservations. “The Digital ECA is an important step that should be taken to protect individuals in general. However, by protecting children and discussing issues of platform responsibility, it contributes to the protection of other audiences.”
The Statute mandates that providers of information technology products or services that offer content or services that are inappropriate, unsuitable, or prohibited for minors under 18 years of age must adopt effective measures to prevent access by children and adolescents, such as age verification, prohibiting self-declaration. Age verification mechanisms have become central to the debate, given the risks of personal data leaks and loss of privacy on major social media platforms.
Such mechanisms raise challenges because, as they have been proposed, they generally involve the indiscriminate collection of user data. Identification documents, facial biometrics, and behavioral profiles are some examples of information that can be retained and monetized by large commercial conglomerates, exposing users to risks of leaks, sale to third parties, and use of data for illicit purposes.
Lawyer Helena Secaf, research coordinator at the independent interdisciplinary center InternetLab, believes that age verification is not a tool that works in isolation, but rather one of multiple factors that contribute to a safer environment. Secaf emphasizes the importance of differentiating age verification from identity verification. "To know someone's age, you don't need to know who the person is, or even their date of birth," she points out.
The Brazilian National Data Protection Agency (ANPD) published a report in October on the different age verification mechanisms used worldwide. According to Evangelista, the initiative is very positive, "because it not only demands age verification but also indicates that it should occur in dialogue with regulations aimed at protecting personal data," he argues. "This statement opens the door, among other things, for us to have a public digital infrastructure for age verification."
Decentralized networks
The challenge for data protection is even greater in decentralized networks, as it involves the ability of independent initiatives, with their technical and financial limitations, to implement a costly age verification system. Instead of a centralized service in a single global company, as is the case with social networks from the Meta group and their counterparts, a decentralized network has thousands of servers or instances, like small social networks that self-govern and moderate content on a human scale. Because they respect privacy, these systems do not collect user data, do not sell profiles to advertisers, nor do they seek profit, which makes it impossible for them to finance the implementation of verification systems that require significant investment in technology and maintenance.
Networks like Bluesky and Mastodon, which are decentralized, have already been affected by strict age verification measures. In 2025, Bluesky lamented the broad reach of US law HB 1126, which requires age verification by online social networking services throughout the state of Mississippi. The company believes the law imposes barriers to innovation and has implications for privacy, requiring "every user to provide sensitive personal information and undergo age verification to access the site," under penalty of high fines for the platforms. Mastodon, on the other hand, stated that it cannot comply with Mississippi law because it lacks the means to do so, since it does not track its users.
The Electronic Frontier Foundation, a non-profit organization that has been working for freedom and privacy in the digital space for over 35 years, believes that age verification requirements concentrate and consolidate power in the hands of large companies, the only ones with the resources to build expensive compliance systems and absorb potentially costly fines.
The concerns cited by Bluesky and Mastodon regarding HB 1126 were the same raised by a segment of Brazilian society about the Felca Law—the way Law No. 15.211/2025 became known. For Caio Carrara, a software developer and member of the digital culture promotion association Alquimídia, the text only looks at the scenario from the perspective of centralized networks. “When this bill introduces various requirements for media in a broad sense, regardless of whether it is centralized or not, it speaks of needs and requirements that the open and decentralized ecosystem often cannot meet.” Evangelista argues that this could be resolved with a law that considers asymmetrical regulation, that is, “a greater incidence on large players and less focus on small non-profit initiatives.”
The Federal Government, through the Ministry of Justice and Public Security (MJSP), appears to be considering the differences between centralized and decentralized networks. This was observed in a public consultation in October on the topic of "Age verification on the Brazilian internet," in which participants were asked to consider decentralized or federated architectures based on the following question: "How should the responsibility for age verification be assigned among protocol developers, server operators, and application creators?"
CGI.br participated in the consultation with a document containing recommendations for age verification as stipulated in the Digital ECA (Brazilian Statute for Children and Adolescents), reinforcing the importance of protecting children and adolescents. At the same time, the Committee warns about factors such as the technical complexity of implementing age verification; the need to preserve fundamental user rights, such as privacy and inclusion; the open and decentralized architecture of the network; the cross-border nature of the internet; and interoperability, essential for the functioning of the web as a global communication network.
This report was produced by students of the specialization course in Scientific Journalism at the Laboratory for Advanced Studies in Journalism (Labjor) at Unicamp, under the supervision of journalist Guilherme Gorgulho.