The National Data Protection Agency has begun enforcing Brazil’s child online safety law, and the agency's president told MLex in an exclusive interview that the watchdog will not interfere with tech firms’ age-verification tools if they protect children online.
The National Data Protection Agency (ANPD) has begun enforcing Brazil’s child online safety law, and the agency's president told MLex in an exclusive interview that the watchdog will not interfere with tech firms’ age-verification tools if they protect children online.But "I want them to adapt to our law,” Waldemar Gonçalves Ortunho Júnior told MLex in an exclusive interview after a conference* panel, stressing that ANPD is merely seeking compliance with the law and doesn't aim to harm companies financially.
Ortunho Júnior commented on ANPD’s requirement for major investments as greater corporate responsibilities arise. He also shared his thoughts on age-verification mechanisms, how Brazil’s government is racing to build its own solution, and his top priority under the law aimed at protecting the rights of minors under 18 in digital environments.
The Digital Statute for Children and Adolescents (ECA Digital) creates new obligations for social media networks, apps, gaming, streaming platforms, and other digital services operating in Brazil. The initiatives include presenting reliable age-verification systems, the immediate removal of illegal content and the adoption of safety-by-default settings for minors’ accounts.
The ECA Digital was approved Sept. 17, and President Luiz Inácio Lula da Silva accelerated the law’s effective date to March 17. In conjunction, the government passed a weighty structural reform at the ANPD, allowing the arrival of hundreds of new employees, including those aimed at building a career in data protection — a long-standing demand.
— Age-verification a challenge —
Ortunho Júnior believes that finding the most accurate age-verification tool is the greatest challenge in the child online safety field. He said the ANPD won't interfere in a tech firm’s decision to opt for one solution or another, as long as it ensures a safer environment for teenagers.
“At no point will we require the adoption of solution A, B, or C,” the ANPD chief said. “We expect the adoption of a solution that achieves a high success rate in age verification.”
In ANPD’s recent preliminary guidelines on age-verification tools, it said such protections must bring about the collection of sensitive data. Its guiding principle is to balance safety with the least exposure of minors’ information, he said.
Unlike large, well-resourced tech corporations, small companies are likely to face financial difficulties in finding the ideal age-validation system. This is why the government is supporting the development of its own tool to be offered to under-resourced firms.
According to Ortunho Júnior, Brazil will deliver a “basic option,” although he didn't provide additional details. There is no estimation of when the government will introduce its own tool, but a 100 million reais investment to develop mechanisms for protecting minors in digital environments was announced the day ECA Digital took effect.
“If the mechanism fails and a child figures out how to bypass it, the next day they will share it with their friends. This is a never-ending responsibility. Even those who have reached a high level [of efficiency] must keep working, because the other side will try to circumvent the system,” he said.
Ortunho Júnior was a prominent participant at the IAPP Global Summit 2026, participating in a panel on privacy issues in Latin America with the data protection chiefs of Argentina and Ecuador. The prominence of child-protection issues for privacy and online safety at the conference was evidence that Brazil's adoption of the ECA Digital is very much in harmony with the concerns of data protection regulators around the world.
— More staff —
In these first two weeks, Brazil’s data agency has been upholding what it says is its "conciliatory" approach built in a short five-year window. Ortunho Júnior said the ANPD has been talking with several companies to better understand their challenges and also to demand appropriate information regarding age-verification tools.
There are no expectations that the watchdog will start investigations or sanction tech companies in 2026. The ANPD set a timeline for age-verification mechanism oversight in the upcoming months divided into two parts: the first focuses on monitoring app stores and operating systems stating immediately, while the second amplifies this coverage by adding new companies to be supervised from August on.
This means effective enforcement under the ECA Digital is likely to begin next year. Until then, the ANPD has to update oversight and sanctioning parameters in regulations. The agency has been monitoring a group of 37 tech firms over the past six months under the child online safety law, including giant firms such as Amazon, Meta Platforms, Netflix, TikTok and X.
Ortunho Júnior is confident in the timeframe as the ANPD plans to get new staff in the following months. He said it takes at least one month to train new employees on both the state bureaucracy and the new legislation.
Within a one-year period, ANPD plans to more than triple its staff, which was stuck at 200.
“I view the addition of 700 staff this year very positively, but it will not stop there,” he said. “We will increasingly need more personnel and will take on new responsibilities, such as AI, which will have implications for our structure and expertise,” he added.
Brazil has been considering a bill to regulate AI, but the draft has been shelved in Congress for nearly a year.
In line with adequate staffing, the ANPD is pursuing a larger building to accommodate a larger number of people. The agency currently occupies two and a half floors of a building within a shopping mall in Brasília, and an increase in staff must be accompanied by a more adequate headquarters.
Ortunho Júnior said the watchdog is eager to receive a real estate asset from the government. This is a real possibility in Brazil as debtors clear their debts by transferring their properties. “We identified a reasonably large space to support a future expansion of the ANPD and are seeking to secure it. Whether we succeed or not, it will be a long process, but it is part of our plans,” he said.
— Trust in compliance —
The ANPD chief said he's confident the tech companies will comply with ECA Digital without the agency needing to take a harder line. He noted that the gaming industry has been making “radical" moves — Riot Games requires legal guardian consent in several games, while Rockstar Games suspended the sale of its digital games on its own webstore — in response to the law’s application.
Ortunho Júnior said the gaming industry wanted to “shock” at first, but he's confident it will present “adequate solutions.” Under child online safety, only loot boxes — virtual items giving random rewards that can be purchased with real money — are prohibited in online games, as the government identified them as an addiction risk.
The ECA Digital seeks to block access to pornography, alcohol and cigars, guns and ammunition, fireworks, and betting and gambling.
“Our goal is to create a safe digital environment for children. It is not fair for a child to be excluded from the benefits the internet offers, such as access to educational information and the ability to connect with friends, just because there are inappropriate topics for their age group,” he said.
—Additional reporting by Mike Swift
*IAPP Global Summit 2026: Privacy-AI Governance, Washington, DC, March 30-April 1, 2026.
Please email editors@mlex.com to contact the editorial staff regarding this story, or to submit the names of lawyers and advisers.