Brazil's ANPD updates platform guidance, AI sandbox

Brazil’s ANPD released guidance on platform responsibilities for protecting children and adolescents, and also published the three latest interim monitoring reports from its sandbox on artificial intelligence and data protection. In both cases, the Brazilian authority drew a line centered on prevention, institutional learning and proof of effectiveness from providers, rather than direct enforcement.

What changes with the platform guidance?

The guidance says providers must show that the measures they adopt to protect children and adolescents are effective and, when legally required, publish transparency reports. The document, issued by the Ministry of Human Rights and Citizenship together with ANPD, is meant to organize the obligations of companies that run digital services affecting that audience.

The official material also clarifies that the new document interprets the duty of prevention and its scope for companies covered by the ECA Digital, according to Valor International. In practice, the regulatory debate is no longer limited to services designed exclusively for minors.

Who can the ECA Digital apply to?

UOL reported that the ECA Digital is not limited to apps designed for minors. It can also cover services aimed at adults when their features make use by children and adolescents likely. That reading expands the set of companies that could fall under regulatory scrutiny.

Data Privacy Brasil Research said the final guidance recognizes categories of providers with a presumption of likely access. These include social networks, app stores, operating systems, video games, adult content services, generative AI systems and certain marketplaces. That classification suggests the authority is prioritizing the type of service and its foreseeable use, not just the provider’s stated intent.

What did ANPD say about its AI sandbox?

ANPD said its three latest interim sandbox monitoring reports keep the initiative experimental, preventive and geared toward institutional learning. The authority also stressed that the initiative has no direct enforcement purpose, a relevant detail for defining the real scope of that testing space.

That approach points to a regulatory agenda that combines technical monitoring with criteria-setting, rather than relying only on sanctions. At the same time, the platform guidance on child protection shows how ANPD is broadening its role across the digital ecosystem through normative direction.

Were there sanctions during this period?

Some outlets reported sanctions, but those figures are not officially confirmed in the available material. Valor said ANPD would have fined ByteDance, TikTok’s parent company, R$153.7 million in August 2026 for irregularities in the processing of children’s and adolescents’ data, while DPO Expert said the authority concluded a case against the Prefeitura de Feira de Santana for improper disclosure of medical information belonging to 1,241 people, with a warning, publication of the violation and data governance corrective measures.