Brazil tightens cyber rules, ECA Digital

August 21, 2026 update: Brazil’s ANPD added new technical grounds and institutional details to its order against Discord, while the scope of enforcement under ECA Digital is becoming clearer. The PL 4752/2025 bill also remains on the agenda as a possible cybersecurity framework.

Cybersecurity on Congress’s agenda

Brazil’s Congress has put PL 4752/2025 on the agenda as a possible Cybersecurity Legal Framework, with the aim of passing it in the Senate and then sending it to the lower house, according to Convergência Digital. The coverage also said the proposal seeks language close to that of CNCiber and includes the creation of a National Cybersecurity Center as a real-time monitoring operator.

The reference to PL 4752/2025 adds to the broader legislative movement already underway around data protection and digital security, at a time when Brazil is combining parliamentary debate with regulatory decisions that take effect immediately.

Transparency reports under ECA Digital

At the same time, Brazil’s Senate said digital platforms accessible to children and teenagers must publish their first semiannual transparency report by September 17, 2026, under the Digital Statute for Children and Adolescents, known as ECA Digital. The law took effect on March 17, 2026.

The ANPD clarified the scope of the first reporting cycle. The obligation applies to providers with more than 1 million users under 18. The first report must cover January 1 through June 30, 2026, or, if there are no systematized data for January and February, March 17 through June 30. Publication is due by September 17, 2026.

An independent legal analysis added that the agency clarified that the reporting obligation is triggered as of the ECA Digital’s entry into force and that the documents must be posted on the platforms’ websites. It also said the ANPD recommends sending them to an institutional monitoring email address.

Immediate enforcement against platforms

The practical application of ECA Digital has already led to concrete measures. Reuters reported that the ANPD ordered Discord to suspend its livestreaming feature in Brazil over failures to protect children and adolescents from content involving violence, self-harm, and suicide. The company had three business days to show compliance or face potential fines of up to 50 million reais per violation.

In the technical justification for the preventive measure, the ANPD said it relied on robust evidence that Discord had not adopted reasonable steps to prevent and mitigate risks of exposure of children and adolescents to content or practices involving serious rights violations, including inducing, inciting, or assisting violence, self-mutilation, and suicide, with explicit reference to article 6, II and III of ECA Digital.

An independent technical analysis said the preventive order required disabling Go Live and equivalent video transmission or sharing features within three business days. It also noted that the inspection began on August 7 and that the case could escalate into daily sanctions if the company did not comply.

Specialized privacy analyses in Brazil describe the ANPD’s preventive measure against Discord as having been issued by the Superintendence of Supervision, or SFI-ANPD, and say the agency’s recent intensification of ECA Digital enforcement is being handled institutionally through that unit. They also say the three-business-day deadline applies both to Go Live and to other equivalent video transmission and sharing features.

That regulatory front sent a clear signal to platforms and compliance teams: in Brazil, ECA Digital is no longer limited to future transparency obligations, but now enables immediate enforcement against services that expose minors to online risks.