Brazil ANPD orders Discord livestream suspension

Brazil’s ANPD ordered Discord to suspend livestreaming features for users in the country and made clear that any return will depend on the platform showing reasonable safeguards for children and adolescents. At the same time, HackZero updated its privacy policy for transfers from Brazil to the United States and for incident reporting under the LGPD.

What happened with Discord in Brazil?

The ANPD ordered Discord on August 12, 2026, to suspend livestream features for users in Brazil because of inadequate safeguards for minors, and the company said it is complying with the order. The measure affected Go Live and other equivalent real-time video streaming tools, along with features such as screen sharing and, according to some coverage, traditional video calls.

Agência Brasil reported that the suspension is indefinite and was imposed under the Digital Child and Adolescent Statute. Exame said Discord had three business days to disable the feature and can only reactivate it after showing that it corrected the issues identified. Folha de S.Paulo added that the return will depend on the presentation of reasonable measures, backed by effective technical, security and governance actions, with full or partial authorization.

What does the case show about LGPD enforcement?

The Discord case reinforces that the ANPD has been enforcing the LGPD with a strong oversight approach toward local and international companies, including firms based in the United States. ManageEngine Insights describes the regulator as having aggressive enforcement powers, and the Discord episode adds to other interventions involving platforms and data processing systems.

PolicySignal reported that the ANPD also ordered the Paraná state Department of Education to suspend a facial recognition system used to track student attendance, concluding that operational convenience does not satisfy the necessity standard for sensitive biometric data involving minors. The move shows that the regulator’s reach is not limited to digital platforms, but also extends to technology vendors.

What privacy obligations are companies already adjusting to?

HackZero said in its privacy policy that for transfers from Brazil to the United States it will use the Brazilian Standard Contractual Clauses adopted under ANPD Resolution No. 19/2024 when there is no ANPD adequacy decision. That rule is listed as mandatory since August 23, 2025.

In the same policy, the company said that under the LGPD and ANPD Resolution No. 15/2024, it will notify the ANPD and affected data subjects of a security incident within an initial three business days, with the option to provide additional information within another 20 business days. ManageEngine Insights added that this notification must also be sent directly to data subjects through channels such as phone, email or letter. Minuto da Segurança said the three-day deadline applies when there is a risk or relevant harm, especially if the data involved is sensitive, belongs to minors, is financial, authentication-related or protected by secrecy.

What financial exposure do US companies face?

Article 52 of the LGPD allows the ANPD to impose fines of up to 2% of prior-year annual revenue in Brazil, capped at 50 million reais per violation, along with sanctions such as suspension of data processing activities, according to TechTimes and TecDiario. Folha de S.Paulo Internacional noted that same cap in the Discord case, while Gadgets Now, citing Reuters, said the ANPD warned of penalties of up to 50 million reais for noncompliance with the order.

G1 reported that the Federal Public Prosecutor’s Office opened a procedure seeking details from Discord about its child and adolescent protection policies. Veja added that the MPF issued an order to monitor the effects of the decision and review internal moderation and security measures. The case leaves a US-based company under administrative pressure and also under review by other Brazilian authorities.