The ANPD (Brazil's National Data Protection Agency) opens proceedings, or a family goes to court: a child got into a service that was not suitable for them. The company says it verifies age. The question that decides the case is a different one: where is the record that proves it?
Law 15,211/2025 read as a system: age verification, parental supervision, removal and reporting, and the technical evidence that demonstrates each obligation.
The ECA Digital (Law 15,211/2025, Brazil's Digital Child and Adolescent Statute) has been in force since 17 March 2026, and the ANPD enforces it. Many of its obligations are design obligations: protection by default, age verification without self-declaration, parental supervision, removal and reporting. A design obligation is proven with versions, settings and logs, not with a written policy.
Evidence is lost in a paradox. The company verifies age, but must delete the image of the ID document right after capture. A company that keeps nothing cannot prove it verified. The way out is audit logs with metadata only, preserved with method.
The course translates the law into evidence, for those who defend the platform, those who accuse it and those who advise families. The question is a forensic one: how to demonstrate what the system was doing on the date of the events.
Pick as many courses as you like: they are kept and arrive ticked on the registration form.
Adriano Vallim is a co-author of the guidebook "Recomendações e boas práticas para o uso seguro das redes sociais por toda a família", from the Coordination for Guidance to Parents, Educators, Children and Adolescents of the OAB/SP Committee on Electronic Law and High-Technology Crime. Its 42 pages cover privacy, fake profiles, digital identity, civil and criminal liability, parental controls and reporting channels. There, the minimum age came from the terms of use, and parental control was a tool the family installed. The ECA Digital turned part of this into a duty of the provider.
A gaming platform has to demonstrate its age verification to the ANPD. It has the contract with the solution provider and a few screenshots, but no audit log for the period. The examination reconstructs what it can from the version history and the provider's records, and states the limit.
A family sues an app: their 14-year-old son was chatting with unknown adults, and the account had no link to a parent or guardian. The examination preserves the app version, the default settings on that date, the account creation record and the age signal received from the app store. Liability is a legal question.
In groups of four, with the fictitious description of a social network with teenage users, participants fill in the Matrix for five obligations in 15 minutes and point out the evidence that would be missing if the ANPD asked for it today.
Laws and rulings discussed
Law 15,211/2025 (ECA Digital, Brazil's Digital Child and Adolescent Statute) · Law 15,352/2026 · Decree 12,622/2025, art. 2º · Decree 12,880/2026 · ANPD (Brazil's National Data Protection Agency), Mecanismos confiáveis de aferição de idade: orientações preliminares (March 2026) · ANPD, news item of 16 September 2026 · ANPD, ECA Digital page · Marco Civil da Internet, art. 15 (Brazil's Internet Civil Rights Framework)
See also
LGPD, ANPD and Data Breach Forensics → Forensic Services in Digital Law and Technology → Digital Authorship and Subscriber Data Disclosure → Publications → See all courses →