Quick Take

How Brazil’s ECA Digital Can Protect Kids Without Compromising Encryption

September 24, 2025

On 17 September, Brazil became the latest country to adopt a sweeping law to protect children and teenagers from online harms. The Digital Statute for Children and Adolescents, (“ECA Digital” in Portuguese) imposes far-reaching duties on technology companies, ranging from stronger data-privacy safeguards to design-based requirements meant to enhance users’ autonomy.

Passed despite intense lobbying from major platforms, the statute reflects Brazil’s determination to assert digital sovereignty. Yet its most significant weakness is the absence of any exemption for end-to-end encrypted services. Without regulatory clarification, the new rules risk undermining encrypted messaging apps such as WhatsApp by imposing obligations that are incompatible with their architecture.

Among the statute’s most notable provisions is its requirement that online services design their products with the best interests of children and adolescents in mind and offer the highest levels of privacy and safety by default. It prohibits profiling minors for personalized advertising and bans the processing of children’s and adolescents’ data in ways that infringe their privacy or other rights. It also outlaws “loot boxes,” the gambling-like reward mechanisms common in video games. More controversial measures include mandatory age verification, which raises its own privacy concerns unless implemented thoughtfully, and extensive parental-control features that services must enable for minors’ accounts.

ECA Digital’s scope is both its strength and its vulnerability. It applies to all information-technology products or services directed at, or likely to be accessed by, children and adolescents in Brazil, explicitly covering apps, computer programs, operating systems, app stores, online games, and other connected services. This goes well beyond many other jurisdictions’ online-safety laws, which focus on a subset of online platforms. But by failing to exclude end-to-end encrypted services or differentiate among types of platforms, the statute risks imposing one-size-fits-all obligations that may be ill suited to privacy-protective technologies.

In particular, the statute obliges online services to put in place systems for reporting and removing content that appears to involve exploitation, sexual abuse, kidnapping, or grooming. Articles 28 and 29 clearly frame these systems as reactive — triggered by notifications from users, the Public Prosecutor’s Office, or child-protection entities. Article 27, however, is more ambiguous: it establishes an affirmative duty to report such content without spelling out whether the obligation is limited to material the service becomes aware of, or whether it extends to proactive scanning. To ensure that ECA Digital remains compatible with end-to-end encryption, regulators and enforcers should make clear that Article 27 does not require proactive monitoring or “client-side scanning” of encrypted messages.

This clarification is especially urgent in light of developments abroad. In Europe, lawmakers are once again considering a “Regulation to Prevent and Combat Child Sexual Abuse,” widely nicknamed the “Chat Control law,” that would compel messaging services to inspect content before it is encrypted and report suspected child-sexual-abuse material to authorities. Although presented as privacy-friendly because the scanning would occur locally on the user’s own device rather than on company servers, this approach would still require a “backdoor” — essentially a way for authorities to access encrypted messages — that would undermine the fundamental security that end-to-end encryption provides.

Because ECA Digital will not take effect until March 2026, Brazil’s digital-rights authority still has time to clarify and tailor the scope of the reporting duties in a way that upholds both child-protection goals and the fundamental rights to privacy and freedom of expression. Getting that balance right would give providers regulatory certainty and help position Brazil as a leader in child-protection law that does not sacrifice secure communications.