On Wednesday evening, August 20, the House of Representatives approved Bill 2628/22, known as the “Digital Child and Adolescent Statute.” The Bill will now move on to review and voting in the Federal Senate.

If the current text is approved, the law will apply to any information technology product or service directed at or likely to be accessed by children and adolescents in Brazil, regardless of its location, development, manufacturing, offering, commercialization, or operation — including social networks and online games.

Among the many requirements for child and youth protection, the law establishes that:

1. The most protective settings must be the default for applications aimed at this audience;
2. Risk management of features, functionalities, and systems must be carried out with regard to the safety and health of this audience;
3. Reliable age verification mechanisms must be implemented at each access, prohibiting self-declaration;
4. Internet app store providers must adopt mechanisms to prevent improper access according to age group;
5. A parental supervision panel must be made available to allow limiting and monitoring the time of use of the product or service; account and privacy options; restricting purchases and financial transactions; identifying profiles with which the child or adolescent communicates; among others.

In addition, the law will regulate loot boxes under specific conditions; prohibit profiling techniques for targeting commercial advertising at children and adolescents; require specific warnings on product packaging; and create differentiated rules for social networks, particularly regarding age authentication and monitoring of accessible content for this audience, including the obligation to remove illegal content without a court decision (through the notice and take down mechanism) and mandatory reporting to authorities.

To ensure the effectiveness of the legislation, providers must maintain a legal representative in the country with the authority to receive summons, subpoenas, or notifications from any local authority.

In case of non-compliance, the law provides for a simple fine of up to 10% of the economic group’s revenue in Brazil in the last fiscal year or, if revenue is not available, a fine ranging from R$10.00 to R$1,000.00 per registered user of the sanctioned provider, limited in total to R$50,000,000.00 per infraction.

For more information, please contact our Technology, Privacy & Data Protection team.