Brazil advances cyber law on vehicles

Brazil is moving ahead with a broad regulatory package that covers connected vehicles, cryptocurrencies, fintechs and digital platforms, while the ECA Digital has been in force since March 17, 2026. Congress is debating PL 298/2024 on vehicle cyber security, the Senate is reviewing changes to virtual assets and fintechs, and the ANPD has already begun enforcement against major digital services for compliance with the new framework for children and adolescents.

What changes for connected vehicles?

PL 298/2024, now moving through the Câmara dos Deputados, would amend Article 103 of the Brazilian Traffic Code to add cyber security rules for vehicles and bar companies from charging consumers for electronic operating system updates.

The bill also directs CONTRAN to define procedures for assessing vulnerabilities linked to intrusions or cyberattacks, along with testing methods for integrity checks and a timeline for adding security measures to new vehicle projects. The text is designed to push technical requirements into the auto industry at an early stage of design and development.

What is the Senate discussing on digital finance?

The Federal Senate is reviewing PL 4932/2023, which changes the legal framework for cryptocurrencies to strengthen investor security and impose new rules on virtual asset brokers, and PL 3572/2026, which creates specific rules for fintechs.

The debate comes amid broader proposals on Pix, cryptocurrencies and digital financial security, according to Rádio Senado. At the same time, PLP 235/2026, a complementary bill, was still in the Federal Senate plenary on August 18, 2026, with the status of awaiting referral.

How is the ECA Digital being enforced?

The Estatuto Digital da Criança e do Adolescente, Law No. 15.211/25, has been in force since March 17, 2026. It creates a legal framework to protect children and adolescents online, with obligations for social networks, video games, apps, video platforms, app stores and operating systems.

The regime requires mandatory age verification for restricted content, more protective privacy settings by default, parental supervision tools, a ban on advertising based on profiling and limits on loot boxes. It also requires the removal and reporting of content tied to child sexual exploitation, along with periodic transparency reports, under penalty of fines and other sanctions for noncompliance.

The ANPD has begun formal monitoring actions involving major digital platforms, app stores and generative AI tools to verify simultaneous compliance with the Marco Civil da Internet, as amended by Decrees No. 12.975/2026 and 12.976/2026, and the ECA Digital. The focus includes mechanisms to prevent illicit content and protect children, adolescents and women online.

What regulatory effect is already showing up on platforms?

The later implementing rules for the ECA Digital, through Decrees No. 12.880, 12.881 and 12.882/2026, added technical obligations for digital platforms, reorganized the ANPD’s role in child protection and centralized complaint and enforcement mechanisms for unlawful activity.

That regulatory shift is already showing up in concrete cases. Brazil’s Federal Prosecution Service opened a proceeding to require Discord to align its child and adolescent protection policies with the ECA Digital, while a legal and educational analysis notes that the law also reinforces the principle of full protection in school settings, with shared responsibilities among the state, families, society and technology companies.

What other initiatives complete the regulatory picture?

The Chamber’s Committee on Science, Technology and Innovation approved complementary bills tied to the national policy on digital education and AI inclusion, with incentives to develop AI skills in Brazil and incorporate them into digital education strategies.

That movement adds to international analyses that describe Brazil as a regulatory case combining mandatory technical age verification, linking accounts for users under 16 to a parent or guardian profile, bans on persuasive design algorithms, commercial profiling, targeted advertising and geolocation tracking for children’s accounts, with penalties that can reach 50 million reais or service suspension.