Brazil advances new digital security rules

Brazil’s Federal Senate filed PL 5093/2026, authored by Senator Jorge Kajuru, to amend the Older Persons Statute and add rights to inclusion, autonomy and security in digital environments. The bill also would bring communication, computing and new technology content into courses for older adults, while the ANPD said it spent 2026 focusing its agenda on implementing new rules for digital platforms.

What does PL 5093/2026 propose?

The bill seeks to explicitly recognize digital rights for older adults and add technology training to courses aimed at that audience. According to the Federal Senate, the proposal was filed on Aug. 17, 2026 and is in an initial stage, awaiting action in the plenary, with no vote yet on its substance.

Atlas Público reported that the text entered the Senate on that date and remains in an early phase of consideration. The bill is identified as PL 5093/2026 and its author is Jorge Kajuru, from the PSB party in Goiás.

What did the ANPD prioritize in the first half of 2026?

The ANPD said it prioritized rulemaking and implementation of the Digital Statute for Children and Adolescents and Decrees 12.975 and 12.976 of 2026, which cover updates to the Marco Civil da Internet and guidelines for protecting women in digital environments. That focus was detailed in its report tracking the regulatory agenda for the semester.

The ANPD opened a call for submissions until Aug. 17, 2026, to receive input on implementing the new rules for digital platforms stemming from those decrees, including obligations to prevent systemic risks and a duty of care under the Marco Civil da Internet. Digital Policy Alert also recorded that on Aug. 17 the authority closed a public consultation on the implementation framework for platform obligations to protect women in digital environments under Decree 12.976/2026.

How do the obligations for platforms change?

According to legal analysis and specialized coverage, Decrees 12.975 and 12.976 expanded the ANPD’s authority over digital platforms, with a focus on duty of care, systemic risk prevention, transparency and liability for third-party content. They also added specific guidance on violence against women and on the use of artificial intelligence to generate or alter intimate content.

Lefosse Advogados said those rules opened a new regulatory front for platforms and digital services. In the same vein, Portal do Holanda said that, since August 2026, the rules no longer apply only to app stores and operating systems, but now also cover social networks, video platforms, games and streaming services, with a requirement to implement age-verification mechanisms by November 2026.

What regulatory impact does the ANPD expect?

The authority said it will focus on guidance and business support through the end of 2026 and that systematic enforcement with fines for noncompliance with the ECA Digital will begin in January 2027. CNN Brasil added that the ANPD is reviewing and updating its inspection and sanctions rules to incorporate the new powers derived from the ECA Digital.

That framework includes penalties that can reach 10% of the economic group’s revenue in Brazil or per-user fines, capped at 50 million reais per violation, according to CNN Brasil’s coverage. Exame, meanwhile, reported that the ANPD is considering expanding the number of platforms subject to oversight after suspending Discord live streams in Brazil.

How does this fit into the LGPD agenda?

The debate comes as the LGPD marks its eighth year, and Senate media recalled that the law guarantees stronger safeguards for Brazilian citizens’ personal data. At the same time, legal analysis of the framework says the ANPD appears stronger and faces growing pressure on companies.

LH Lawyers said the ANPD’s Priority Topics Map 2026-2027 is organized around four pillars: data subject rights, with a focus on biometric, health and financial data, protection of children and adolescents in digital environments, public-sector data processing, and artificial intelligence and automated decisions. LexLegal agreed that the map includes protection of children and adolescents, public-sector data and artificial intelligence, and added that Decrees 12.975 and 12.976/2026 gave the ANPD authority over digital risks, fraud, transparency and reporting mechanisms tied to violence against women.