Brazil's ANPD expands LGPD enforcement in 2026

Update August 24, 2026: ANPD said it is revising its inspection and sanctions rules so it can act on new powers under the Digital ECA and Brazil’s Marco Civil da Internet. It also opened two enforcement actions covering 22 digital services, with a focus on social networks, AI, app stores, children, adolescents, and women.

Brazil’s ANPD moved in 2026 to revise its inspection and administrative sanction rules while broadening its compliance agenda across several fronts. At the same time, it opened two enforcement actions covering 22 digital services and kept biometric data, health, financial data, artificial intelligence, and public-sector processing under scrutiny.

What changed in ANPD’s regulatory agenda?

The authority added the review of its inspection and sanctions rules to a broader supervision and compliance agenda, according to its 3rd Semiannual Report on Monitoring and Execution of the 2025/2026 Regulatory Agenda. The report, published on August 18, 2026, says the adjustment is meant to give the agency room to act under new powers set out in the Digital ECA and the Marco Civil da Internet.

ANPD also said in its first-half 2026 monitoring report, published on August 18, that the regulatory review is one of the key actions now underway. In practical terms, the signal is a tougher supervision effort, not just a list of abstract priorities.

What happened with facial recognition in Paraná schools?

ANPD ordered the suspension of biometric data collection from children and adolescents for school attendance through facial recognition and gave authorities ten days to prove compliance with the measure, according to specialized coverage. Data Privacy Brasil described the decision as preventive rather than punitive, citing Decisive Order No. 2/2026/SFI and Technical Note No. 4/2026/CPDP/CGF/SFI/ANPD.

Biometric Update reported that the order affects school attendance tracking in Paraná. Tech Policy Press framed it as a landmark case for protecting children’s and adolescents’ data in Brazil and as a precedent for addressing systemic risks in other sensitive data uses tied to fundamental rights, including social welfare programs.

What other signs of stricter enforcement did ANPD show?

ANPD’s 2026 agenda also shows tighter oversight of specific sectors. LHLaw said ANPD’s 2026-2027 Priority Topics Map includes four pillars, data subject rights with an emphasis on biometric, health, and financial data, protection of children and adolescents in digital environments, public-sector data processing, and artificial intelligence and automated decisions.

The same legal coverage said ANPD opened 19 new sanction cases in June 2026 alone. LexLegal likewise said the map points to a more active ANPD with greater pressure on companies, turning these topics into concrete supervision and compliance priorities.

In health, Medicinasa said ANPD resolutions CD/ANPD No. 30 and 31/2025 set an explicit 2026 target of at least ten enforcement actions focused on health, biometric, and financial data processing. That reading matches the broader picture of a more demanding enforcement agenda.

What signals appeared in international transfers and AI?

On international data transfers, TozziniFreire reported that in 2026 ANPD issued an adequacy decision recognizing European Union countries as eligible destinations for data sent from Brazil. The same publication said that adequacy is reciprocal from the European side as well.

The legal coverage also placed artificial intelligence among enforcement priorities, with an emphasis on transparency and the explainability of automated decisions even without a specific AI rulebook. In that area, the 2025/2026 regulatory agenda and the 2026-2027 Priority Topics Map both place the issue among the authority’s operational priorities.

What is the scope of the new platform probes?

ANPD opened two enforcement actions involving 22 digital services and notified the companies to respond within ten business days about the steps they have taken to comply with the new online user protection rules, with a focus on children, adolescents, and women. According to G1, the stated goal is to check compliance with the Marco Civil da Internet, the decree on protecting women in digital spaces, and the Digital ECA.

G1 said the actions cover social networks, artificial intelligence platforms, and app stores. Gazeta do Povo published the full list of the 22 platforms notified by ANPD: 11 social networks, 2 messaging apps, 7 AI tools, and 2 app stores.

The same coverage said the companies have ten business days from notification to respond. In June 2026, ANPD also opened 19 new sanction proceedings, a figure that reinforces the scale-up in its oversight activity.

In health, Medicinasa said ANPD resolutions CD/ANPD No. 30 and 31/2025 set an explicit 2026 target of at least ten enforcement actions focused on health, biometric, and financial data processing. That reading matches the broader picture of a more demanding enforcement agenda.

What signals appeared in international transfers and AI?

On international data transfers, TozziniFreire reported that in 2026 ANPD issued an adequacy decision recognizing European Union countries as eligible destinations for data sent from Brazil. The same publication said that adequacy is reciprocal from the European side as well.

The legal coverage also placed artificial intelligence among enforcement priorities, with an emphasis on transparency and the explainability of automated decisions even without a specific AI rulebook. In that area, the 2025/2026 regulatory agenda and the 2026-2027 Priority Topics Map both place the issue among the authority’s operational priorities.