Brazil advances cyber law and ECA Digital rules

Cybersecurity on Congress's agenda

Brazilian Congress placed PL 4752/2025 on the agenda as a possible national cybersecurity framework, with the aim of approving it in the Senate and then sending it to the lower house, according to Convergência Digital. The coverage also said the proposal sought language close to that of the CNCiber and included the creation of a National Cybersecurity Center as a real-time monitoring operator.

The reference to PL 4752/2025 added to the broader legislative push already underway around data protection and digital security, at a time when Brazil is pairing parliamentary debate with regulatory decisions that take effect immediately.

Transparency reports under ECA Digital

At the same time, Brazil's Senate said digital platforms accessible to children and adolescents must publish their first semiannual transparency report by September 17, 2026, under the Estatuto Digital da Criança e do Adolescente, known as ECA Digital. The law took effect on March 17, 2026.

The ANPD defined the scope of the first reporting cycle. The requirement applies to providers with more than one million users under 18. The first report must cover January 1 through June 30, 2026, or, if January and February data are not systematically available, March 17 through June 30. Publication is due on September 17, 2026.

An independent legal analysis added that the agency clarified the publication duty takes effect as soon as ECA Digital enters into force and that the documents must be posted on the platforms' websites. It also said the ANPD recommends sending them to an institutional monitoring email address.

Immediate enforcement against platforms

ECA Digital has already produced concrete enforcement action. Reuters reported that the ANPD ordered Discord to suspend its livestreaming feature in Brazil because of failures to protect children and adolescents from content involving violence, self-harm, and suicide. The company had three business days to show compliance or faced potential fines of up to 50 million reais per violation.

A separate technical analysis said the preventive order required deactivating Go Live and equivalent video streaming or sharing functions within three business days. It also said the inspection began on August 7 and that the case could escalate to daily penalties if there was no compliance.

For platforms and compliance teams, the message from Brazil is clear: ECA Digital is no longer limited to future transparency obligations, it already enables immediate enforcement against services that expose minors to online risk.