Countries › Brazil › Guide › 13. Regulation › Internet platforms and children online in Brazil: Marco Civil log retention, platform liability after the 2025 Supreme Court ruling and the ECA Digital

Internet platforms and children online in Brazil: Marco Civil log retention, platform liability after the 2025 Supreme Court ruling and the ECA Digital

Argentina. For full detail on Argentina, go to The Argentine Thread.

Last verified: 2026-10-27 · Status: Changing

Any internet service that collects data in Brazil or serves Brazilian users must follow Brazilian law, keep access logs for 6 months (connection logs for 1 year) and faces fines of up to 10 percent of group revenue in Brazil. Since the Supreme Court's June 2025 ruling, platforms can be liable for most illegal third party content once notified, not only after a court order. The ECA Digital, in force since 17 March 2026 and enforced by the ANPD, requires age assurance, parental linking under 16 and bans loot boxes and profiling ads for minors, with fines up to R$50,000,000.

USD figures use the Banco Central do Brasil PTAX selling rate of R$5.3346 per US dollar for 27 October 2026. Conversions are for orientation only.

Key facts

Retention of connection logs by connection providers	12 monthsLei nº 12.965 art. 13, as of 2014-04-23 · in force
Retention of application access logs by commercial application providers	6 monthsLei nº 12.965 art. 15, as of 2014-04-23 · in force
Maximum Marco Civil fine, percent of group revenue in Brazil	10 %Lei nº 12.965 art. 12 II, as of 2014-04-23 · in force
ECA Digital fine cap per infraction	50000000 BRLLei nº 15.211 art. 35 II, as of 2026-03-17 · in force
Maximum ECA Digital fine, percent of group revenue in Brazil	10 %Lei nº 15.211 art. 35 II, as of 2026-03-17 · in force
Age up to which minors' accounts must be linked to a parent's account	16 yearsLei nº 15.211 art. 24, as of 2026-03-17 · in force
Registered minor users above which semiannual reports are required	1000000 usersLei nº 15.211 art. 31, as of 2026-03-17 · in force
ECA Digital entry into force	2026-03-17 dateLei nº 15.211 art. 41-A as added by Lei nº 15.352/2026, as of 2026-02-25 · in force

The rule

1. Brazilian law, privacy and data protection apply to any collection, storage or processing of logs, personal data or communications by connection or application providers when at least one of these acts occurs in Brazil, including data collected in Brazil and communications with at least one terminal in Brazil. This applies to companies based abroad that offer services to the Brazilian public or have a group member with an establishment in Brazil.Lei nº 12.965 of 23 April 2014 (Marco Civil da Internet), Art. 11 §§ 1 and 2, 2014-04-23 official text · verified 2026-10-27

2. Breaches of the privacy and data rules of arts. 10 and 11 are punished with a warning, a fine of up to 10 percent of the economic group's revenue in Brazil in its last fiscal year, net of taxes, temporary suspension or prohibition of the activities involving those acts. For a foreign company, its Brazilian subsidiary, branch, office or establishment is jointly liable for the fine.
Cost to do it: Fine exposure up to 10 percent of group revenue in Brazil.
Example: On group revenue in Brazil of R$2,000,000,000, the ceiling is R$200,000,000. / About US$37,491,096 on about US$374,910,959.Lei nº 12.965 of 23 April 2014 (Marco Civil da Internet), Art. 12 items I to IV and sole paragraph, 2014-04-23 official text · verified 2026-10-27

3. Connection providers must keep connection logs confidential and secure for 1 year. Application providers organized as companies and operating professionally for profit must keep application access logs for 6 months. Police, administrative authorities or prosecutors may ask for longer retention, but must seek a court order for access within 60 days, and disclosure always requires a court order.
Cost to do it: Storage and security cost for 6 months of access logs for every commercial application.Lei nº 12.965 of 23 April 2014 (Marco Civil da Internet), Arts. 13 caput and §§ 2, 3 and 5; 15 caput and §§ 2 and 3, 2014-04-23 official text · verified 2026-10-27

4. Art. 19 says an application provider is civilly liable for third party content only if it fails to remove it after a specific court order; art. 21 makes it liable after a private notice for non consensual intimate images. On 26 June 2025 the Supreme Court (Themes 987 and 533) held art. 19 partially unconstitutional. Until Congress legislates, a platform is liable if it fails to remove illegal content after a removal request, except for crimes against honor, where a court order is still needed. For serious content such as terrorism, child sexual abuse material, incitement to suicide, hate speech, violence against women and anti democratic acts, liability arises from systemic failure. Platforms can be liable without any notice for paid ads or boosted illegal content and for illegal bot networks. Art. 19 still governs neutral services such as email, closed meetings and private messaging. Platforms must keep complaint systems, user channels, appeal procedures and annual transparency reports. Theme 987 became final on 17 June 2026.Lei nº 12.965 of 23 April 2014 (Marco Civil da Internet); Supreme Court, RE 1.037.396 (Theme 987) and RE 1.057.258 (Theme 533), Arts. 19 and 21, 2025-06-26 official text · verified 2026-10-27 · changed: Supreme Court judgment of 26 June 2025 declared art. 19 partially unconstitutional and replaced the court order rule with a notice based regime for most illegal content; the Theme 987 ruling became final on 17 June 2026.

5. The Digital Statute of Children and Adolescents (ECA Digital) applies to every information technology product or service aimed at children and adolescents in Brazil or likely to be accessed by them, wherever it is developed, offered or operated. Likely access depends on attractiveness to minors, ease of access and the degree of risk, especially for services enabling large scale social interaction. Suppliers must keep a legal representative in Brazil able to receive service of process and answer to authorities.Lei nº 15.211 of 17 September 2025 (ECA Digital), Arts. 1 and 40, 2025-09-17 official text · verified 2026-10-27

6. App stores and operating systems must use proportionate, auditable and secure age assurance, enable parental supervision and provide an age signal to apps through a privacy protective API; downloads by minors require parental consent, which cannot be presumed. Services must link accounts of users up to 16 years old to a parent's account. Loot boxes in games aimed at or likely to be accessed by minors are banned, and so are profiling, emotional analysis and immersive techniques to target commercial ads to minors, behavioral profiles of minors for advertising, and monetization of sexualized content depicting minors. Providers must remove and report apparent child sexual exploitation, abuse, kidnapping and grooming content to the authorities. Services with more than 1,000,000 registered minor users in Brazil must publish semiannual reports in Portuguese.Lei nº 15.211 of 17 September 2025 (ECA Digital), Arts. 12, 20, 22, 23, 24, 26, 27 and 31, 2025-09-17 official text · verified 2026-10-27

7. Sanctions are a warning with up to 30 days to correct, a simple fine of up to 10 percent of the economic group's revenue in Brazil in its last fiscal year or, without revenue, R$10 to R$1,000 per registered user, capped at R$50,000,000 per infraction, temporary suspension and prohibition of activities. Warnings and fines are applied by the administrative authority; suspension and prohibition only by the courts and may be enforced by blocking orders to internet providers. A foreign company's Brazilian branch or office is jointly liable for the fine. Fine amounts are updated yearly by the IPCA.
Cost to do it: Fine exposure up to R$50,000,000 per infraction.
Example: A service with no revenue in Brazil and 20,000 registered users could face up to R$20,000,000 at R$1,000 per user; a larger user base hits the R$50,000,000 cap. / About US$3,749,110 and a cap of about US$9,372,774.Lei nº 15.211 of 17 September 2025 (ECA Digital), Art. 35 items I to IV and §§ 2, 4, 5 and 6, 2025-09-17 official text · verified 2026-10-27

8. Lei nº 15.352 of 25 February 2026 set the ECA Digital's entry into force at 17 March 2026. Decreto nº 12.622 of 17 September 2025 designated the ANPD as the autonomous administrative authority that enforces it, and Decreto nº 12.880 of 18 March 2026 regulated the law. The ANPD's plan provides for monitoring of app stores and operating systems from March 2026, an adaptation and monitoring period from August to November 2026, updated inspection and sanction regulations from November 2026 and enforcement on priority themes, focused on age assurance, from January 2027.Lei nº 15.352 of 25 February 2026 (ECA Digital art. 41-A); Decreto nº 12.622 of 17 September 2025; Decreto nº 12.880 of 18 March 2026, Lei nº 15.352 art. 19; Lei nº 15.211 arts. 34 and 41-A, 2026-03-17 official text · verified 2026-10-27 · changed: ECA Digital entered into force on 17 March 2026 (art. 41-A added by Lei nº 15.352 of 25 February 2026); Decreto nº 12.880 of 18 March 2026 regulated it; ANPD enforcement on age assurance is planned from January 2027.

Content or service	When the platform becomes liable
Most illegal content	If not removed after a removal request (notice)
Crimes against honor (libel, slander, insult)	Only after a court order (art. 19)
Serious content listed by the Court (terrorism, child abuse material, hate speech and others)	Systemic failure to prevent or remove (art. 21 logic)
Paid ads, boosted content, illegal bot networks	Without notice or court order
Email, closed meetings, private messaging	Art. 19 court order rule for interpersonal communications
Replicated content already held offensive by a court	Removal of identical copies on judicial or private notice

Platform liability for third party content after the Supreme Court ruling of 26 June 2025 (Themes 987 and 533). Source: STF.

Worked example

Foreign social app. A platform based abroad with Brazilian users must keep access logs for 6 months (Marco Civil art. 15), act on removal notices for most illegal posts after the 2025 ruling, and, because teenagers are likely users, implement age assurance, link accounts of users up to 16 to a parent and appoint a legal representative in Brazil (ECA Digital arts. 24 and 40).
Game publisher. A mobile game rated for teenagers sells random reward boxes. Under ECA Digital art. 20 the feature is banned for that audience; a fine can reach 10 percent of group revenue in Brazil, capped at R$50,000,000 (about US$9,372,774) per infraction (art. 35 II).

Step by step

1. Decide whether the service is aimed at or likely accessed by minors using the three tests of ECA Digital art. 1 sole paragraph.
2. Appoint a legal representative in Brazil with powers to receive service (art. 40).
3. Implement log retention: 6 months for application access logs, 1 year for connection logs.
4. Build notice and takedown, appeal and transparency processes that match the 2025 Supreme Court thesis.
5. For services used by minors: age assurance, parental linking up to 16, no loot boxes, no profiling ads, removal and reporting of abuse content, and semiannual reports above 1,000,000 minor users.
6. Track ANPD guidance: adaptation period to November 2026 and enforcement from January 2027.

Common traps

Relying on the old court order rule. After June 2025, waiting for a court order exposes platforms to liability for most illegal content, except crimes against honor.
Thinking the ECA Digital covers only children's apps. It reaches any service likely to be accessed by minors (art. 1).
Ignoring the foreign group's Brazilian entity. It is jointly liable for Marco Civil and ECA Digital fines (art. 12 sole paragraph; art. 35 § 2).
Collecting more data for age checks. Age verification data may be used only for that purpose (ECA Digital art. 13) and the LGPD still applies.

Sources

← Personal data protection in Brazil (LGPD): legal bases, data subject rights, officer, breaches, transfers and how ANPD fines are calculatedAnti corruption in Brazil: Clean Company Act liability, fine calculation, integrity programs, leniency and procurement rules →