Brazil’s data watchdog adds child protection to enforcement agenda

Brazil’s Nationwide Knowledge Safety Authority authorized its enforcement priorities for 2026-2027 on December 22, 2025, considerably increasing its focus to incorporate baby safety in digital environments following the September passage of sweeping new laws. The regulatory agenda reshapes the company’s two-year planning doc amid institutional modifications that remodeled the ANPD right into a full regulatory company.

The December 22 directive from the Conselho Diretor establishes 4 precedence enforcement themes for the subsequent 24 months. Director Lorena Giuberti Coutinho’s vote outlined the company’s rationale in course of doc 00261.002292/2025-19, which was authorized unanimously after deliberation spanning from October via late December.

Defending kids on-line turns into enforcement focus

Probably the most important change facilities on defending kids and adolescents in digital areas, based on the authorized decision. The ANPD will conduct 15 inspection actions to confirm that expertise suppliers implement privacy-protective configurations by default for services and products “directed at kids and adolescents, or of possible entry by them.”

One other 15 enforcement actions will study whether or not suppliers undertake measures stopping kids and adolescents from accessing inappropriate or prohibited content material, together with age verification mechanisms. This represents a considerable dedication of sources to the newly designated regulatory space.

The shift follows Regulation 15.211/2025, which President Luiz Inácio Lula da Silva signed September 17, 2025. That statute, generally known as the Digital Baby and Adolescent Statute, grants the ANPD authority over defending minors’ rights on-line. Decree 12.622, additionally from September 17, formally designated the ANPD because the autonomous administrative authority for baby digital safety.

Director Coutinho’s vote emphasised that the regulation’s passage and the decree represent “new and pressing info” justifying agenda revisions underneath the company’s procedural guidelines. The statute’s six-month implementation interval creates strain for speedy regulatory motion, with full enforcement starting March 2026.

The enforcement priorities replicate what the ANPD phrases “security by design” ideas. This method emphasizes incorporating protecting measures throughout product improvement slightly than making use of fixes after deployment. The idea attracts from worldwide frameworks, together with OECD steering and practices adopted in Australia and the European Union.

Secondary use enforcement narrows to promoting

The ANPD will conduct 5 enforcement actions analyzing secondary use of non-public knowledge for focused promoting, based on the authorized map. This narrows from the unique proposal, which might have addressed incompatible secondary makes use of extra broadly, together with profiling.

The refinement aligns with provisions in Regulation 15.211/2025 prohibiting profiling strategies for guiding business promoting to minors. Article 22 of that regulation particularly bans “the usage of profiling strategies for guiding business promoting to kids and adolescents, in addition to the usage of emotional evaluation, augmented actuality, prolonged actuality and digital actuality for this goal.”

Director Coutinho modified terminology in her vote, changing “perfilização” with “perfilamento”—the time period truly utilized in Regulation 15.211/2025. This technical correction displays the statute’s adoption of particular language for knowledge processing practices.

The concentrating on of promoting practices for enforcement displays the ANPD’s evaluation that such makes use of characterize significantly related enterprise fashions for web purposes and digital providers. Earlier company evaluation recognized secondary knowledge use for promoting as meriting prioritization through the enforcement planning cycle.

Knowledge topic rights and delicate info

The company will carry out enforcement actions defending knowledge topic rights, significantly relating to biometric, well being, and monetary knowledge remedy. The precedence theme maintains concentrate on particular person rights whereas incorporating sensitivity to particular knowledge classes carrying heightened privateness dangers.

Director Coutinho’s vote specified that enforcement will handle rights of knowledge topics “particularly relating to the remedy of biometric, well being and monetary knowledge.” This language preserves the breadth of potential enforcement whereas signaling explicit consideration to delicate classes.

Authorities knowledge sharing oversight deferred

Monitoring authorities compliance with private knowledge sharing laws shifted to the agenda’s fourth section. The unique plan positioned this merchandise in section two, scheduled for the second half of 2026.

The postponement permits the ANPD to await finalization of laws governing knowledge sharing amongst public sector entities. A draft regulation on Shared Use of Private Knowledge by Public Authorities underwent public session, with the formal rulemaking course of nonetheless underway.

Director Coutinho’s vote defined that monitoring actions ought to happen within the second half of 2027, offering time for the regulation’s completion and publication. This sequencing ensures enforcement actions reference established regulatory requirements slightly than preliminary frameworks.

Synthetic intelligence scope expands

The fourth enforcement precedence addresses synthetic intelligence and rising applied sciences, with the ANPD planning 20 inspection actions. Director Coutinho expanded the unique scope past generative AI to embody AI techniques usually, together with suggestion techniques and facial recognition.

The broadening displays the company’s precise enforcement expertise throughout 2024-2025. The monitoring cycle report documented actions addressing facial recognition techniques and suggestion algorithms affecting kids and adolescents, not simply generative AI purposes.

The vote modified the target from “intensify ANPD motion relating to private knowledge remedy by rising applied sciences, particularly generative synthetic intelligence” to “intensify ANPD motion relating to supervision of rising applied sciences, particularly synthetic intelligence techniques.”

This modification acknowledges that a number of AI system sorts current knowledge safety issues. Suggestion algorithms, facial recognition expertise, and different automated decision-making instruments past generative fashions warrant regulatory consideration.

Consent guidelines postponed till 2027

The ANPD delayed work on consent as a authorized foundation for knowledge processing from section three to section 4. This strikes the initiative from the primary half of 2027 to the second half of that 12 months.

Director Coutinho’s vote famous that different ANPD initiatives handle consent points “in a cross-cutting method,” even when not their main focus. The postponement additionally permits the company to include views from Regulation 15.211/2025, stopping potential conceptual conflicts or overlapping interpretations.

Governance framework delayed

Greatest practices and governance guidelines shifted from section two to section 4 within the revised agenda. The ANPD cited dependencies on different foundational regulatory initiatives presently in improvement.

Particularly, work on governance frameworks will depend on finishing laws about Knowledge Safety Influence Assessments and knowledge topic rights. The Coordenação-Geral de Fiscalização indicated these “baseline” initiatives should end earlier than addressing governance comprehensively.

The company additionally emphasised the necessity for “fast and proactive actions on themes involving Regulation 15.211/2025,” based on Technical Observe 48/2025 from the normalization coordination workplace. Useful resource constraints and the urgency of kid safety priorities influenced the sequencing determination.

Company transformation context

The agenda revisions coincide with the ANPD’s institutional evolution. Provisional Measure 1.317 from September 17, 2025, remodeled the company right into a regulatory physique with “purposeful, technical, decisional, administrative and monetary autonomy.”

The change grants the ANPD standing as an impartial regulatory company underneath Regulation 13.848/2019, alongside authorities like ANATEL and ANVISA. This institutional improve expands the company’s enforcement powers, together with authority to order institution closures, seize items, and request police help when inspection actions encounter obstruction.

The transformation additionally requires the ANPD to align its processes with the Regulation of Regulatory Companies. A separate agenda merchandise addresses revising the company’s inside regulatory procedures to make sure compliance with the brand new authorized framework whereas probably incorporating mechanisms for baby and adolescent participation in rulemaking.

Methodology and public participation

The Coordenação-Geral de Fiscalização developed the enforcement map utilizing standards of danger, severity, timeliness, and relevance. The method started June 26, 2025, with session of ANPD technical items.

Technical Observe 54/2025 documented the methodology and priorities earlier than authorized evaluation by the Procuradoria Federal Especializada. That workplace issued favorable opinion 00060/2025 on October 6, 2025.

Decision CD/ANPD 10 from December 5, 2023, established the timeline requirement. The regulation mandates submitting the Precedence Themes Map for the 2026-2027 interval and the Monitoring Cycle Report for 2024-2025 to the Directing Council by November 30, 2025, with approval by year-end.

The authorized map addresses Articles 21-23 of Regulation CD/ANPD 1 from October 28, 2021. These provisions set up necessities for enforcement planning paperwork, together with decision-making data, goals, efficiency indicators, execution schedules, and indications of mandatory coordination with different public our bodies.

Timeline

• June 26, 2025: Coordenação-Geral de Fiscalização requests enter from ANPD technical items on enforcement priorities
• September 17, 2025: President indicators Regulation 15.211/2025 establishing Digital Baby and Adolescent Statute; Decree 12.622 designates ANPD as enforcement authority; Provisional Measure 1.317 transforms ANPD into regulatory company
• October 6, 2025: Procuradoria Federal Especializada points favorable authorized opinion on precedence map draft
• October 24, 2025: Course of distributed to Director Lorena Coutinho after project lottery
• November 19, 2025: Coordenação-Geral de Normatização submits monitoring cycle report after director requests further supplies
• December 11, 2025: Director Coutinho indicators vote approving revised enforcement priorities
• December 12, 2025: Director Miriam Wimmer votes approval
• December 22, 2025: Administrators Iagê Miola and Waldemar Gonçalves Ortunho Junior full votes, finalizing unanimous approval

For added context, the European Data Protection Board evaluated Brazil’s adequacy decision relating to LGPD framework compatibility with GDPR requirements.

Abstract

Who: Brazil’s Agência Nacional de Proteção de Dados (ANPD) and its five-member Conselho Diretor, led by Director-President Waldemar Gonçalves Ortunho Junior, with the enforcement map drafted by the Coordenação-Geral de Fiscalização.

What: Approval of the Precedence Themes Map for enforcement planning throughout 2026-2027, establishing 4 precedence areas: knowledge topic rights (particularly biometric, well being, monetary knowledge), baby and adolescent safety in digital environments per Regulation 15.211/2025, authorities knowledge sharing oversight, and synthetic intelligence techniques supervision. The map postponed work on consent authorized foundation and governance frameworks to late 2027.

When: The Conselho Diretor authorized the map December 22, 2025, following course of initiation June 26, 2025, and important legislative modifications September 17, 2025. The map governs enforcement actions via December 31, 2027.

The place: The enforcement priorities apply all through Brazil’s territory and to any supplier providing services or products to Brazilian residents, whatever the supplier’s bodily location. The ANPD operates from Brasília within the Federal District.

Why: Regulation 15.211/2025 and Provisional Measure 1.317 basically altered the ANPD’s institutional standing and regulatory scope. The Digital Baby and Adolescent Statute created pressing new enforcement obligations relating to minor safety on-line, requiring speedy regulatory response earlier than the March 2026 efficient date. The transformation right into a regulatory company necessitated procedural updates and useful resource reallocation. Current priorities like consent regulation and governance frameworks have been postponed to accommodate the brand new baby safety mandate whereas awaiting completion of foundational regulatory initiatives.