ANPD tightens oversight on Discord, LGPD

August 21, 2026 update: according to specialized analysis, Brazil’s ANPD has moved from a mostly educational phase of LGPD implementation to a more active enforcement posture. The review folds in that shift, along with the Discord case, the suspension of facial recognition in Paraná and new requirements for platforms.

The ANPD ordered Discord to suspend live broadcasts in Brazil as a precaution while it investigates whether the company is meeting data protection obligations for children and adolescents under the ECA Digital. The order covers Go Live and similar features, but does not block the entire platform. The authority also warned that if it finds irregularities, it can apply the administrative sanctions set out in Article 35, with fines of up to R$ 50 million per violation.

Discord under scrutiny

The agency opened a proceeding to determine what mechanisms the company uses to prevent and respond to serious violations against children and adolescents. According to coverage by EBC, the ANPD gave Discord five business days to explain those controls. At the same time, the company said it could not comply with the suspension order within three business days and asked for it to be revoked, adding a formal response to the scope of the decision.

The technical note that supported the suspension said the live-stream design offered weaker protections and that encryption made monitoring harder. In coverage by G1, the ANPD clarified that the measure targets the live-streaming feature, not the entire platform, until the company proves effective child and adolescent protection measures.

Brazilian media also reported that, in this context, the ANPD can impose fines of up to R$ 50 million for each irregularity tied to noncompliance with the LGPD and the ECA Digital, in line with the legal caps.

What changes in LGPD enforcement?

The ANPD considers the mostly educational phase of LGPD implementation to be over and is now in a more active enforcement stage, with a focus on the administrative sanctions provided in Article 52. That range includes warnings, simple and daily fines, public disclosure of the violation, blocking or deletion of data, and suspension of processing activities.

That shift helps explain the rest of the measures the authority took in August 2026. In practice, the ANPD has moved beyond compliance monitoring and toward a model that includes administrative proceedings, requests for information and sanctions when it detects violations.

Paraná and biometrics

In another preventive measure announced in August 2026, the ANPD ordered the immediate suspension of facial recognition for attendance tracking in public schools in Paraná. The order covers biometric processing of children and adolescents in the state public system, through the Escola Paraná Biometria platform, and remains in effect until the authority decides otherwise. The most detailed independent source also said the ANPD treated the decision as a preventive measure, not a punitive one.

Later coverage added that the program had been operating since 2023 and that the Education Department said it had stopped using it in July 2026, before the ANPD’s decision.

More demands for platforms

The regulatory shift has not been limited to those two cases. Recent reports say the ECA Digital expanded the ANPD’s role in overseeing digital platforms, giving it authority to monitor child and adolescent protection measures, require age-verification mechanisms and impose sanctions for noncompliance. In August 2026, the authority also launched investigations into at least 18 adult-content sites to prevent minors from accessing them and warned that platforms relying only on self-declared age could face fines or blocking.

The ANPD also expanded its enforcement structure to monitor artificial intelligence systems, biometric uses and the processing of children’s and adolescents’ personal data. At the same time, it published an official notice on transparency reports for platforms accessible to children and adolescents, with the first deadline set for September 17, 2026 and, starting in 2027, fixed deadlines on February 1 and August 1.

The regulatory move aligns with a stricter phase of the LGPD. Compliance analyses describe the ANPD as having left the so-called educational phase and now being able to open administrative cases, request documents and information, and apply warnings, simple and daily fines of up to 2% of revenue in Brazil, capped at R$ 50 million per violation, along with data blocking and deletion. Guidance materials for companies add that the authority has been requiring evidence of data governance processes that are implemented, documented and operating.

There are also operational changes on the company side. Microsoft said it will implement age verification in Microsoft Store and Xbox in Brazil to comply with the ECA Digital, using methods that include email, CPF, selfie, credit card or official documents. For August and November 2026, specialized analysis expects a period of adaptation and monitoring for age-verification solutions, before the update to ANPD enforcement and sanction rules scheduled for November.