This Wednesday, August 27, the Brazilian Senate approved Bill #2,628/22, which outlines rules for the protection of children and adolescents in the digital environment. The Bill originated in 2022 and gained strength following a viral video by influencer Felipe Bressanim Pereira, known as “Felca”, denouncing the sexualization of minors on social media platforms.

After being approved by the Brazilian House of Representatives on August 20, the proposal returned to the Senate, which ratified the changes with a few adjustments. Now the Bill will be forwarded to the President of the Republic for analysis, who may approve it, or veto it in whole or in part.

The Bill introduces extensive obligations for Online Service Providers (“OSPs”) operating in Brazil. Key provisions are:

• Scope and applicability: the new rules are applicable to all OSPs whose products or services are targeted at or probable to be accessed by minors. “Probable access” is defined as: (i) sufficient probability of use and attractiveness to minors; (ii) considerable ease of access and use; and (iii) a significant degree of risk to privacy, safety, or biopsychosocial development.
• Priority protection and best interests: digital products and services targeted at or likely to be accessed by minors must ensure priority protection of these users. They must be guided by the minors’ best interests and incorporate adequate and proportionate measures to ensure a high level of privacy, data protection, and safety.
• Risk prevention by design: providers of digital products and services targeted at or likely to be accessed by minors must adopt reasonable measures from the design stage to prevent and mitigate risks of exposure to harmful content, including content related to sexual exploitation and abuse, physical violence, cyberbullying, incitement to self-harm or substance abuse, gambling, predatory advertising, and pornography.
• Age verification and restrictions:
  • Providers of digital products and services targeted at or likely to be accessed by minors must implement mechanisms that ensure age-appropriate user experiences. These service providers must ensure that user accounts belonging to minors up to 16 years must be linked to the account of one of their parents.
  • Providers of app stores and operating systems must implement proportional, auditable, and technically secure measures to verify users’ age or age range, and enable, through API, the transmission of age signals to OSPs.
  • OSPs offering content, products or services deemed inappropriate for minors must implement effective measures to prevent access by minors. This includes deploying reliable age verification mechanisms at each access. Self-declaration is explicitly prohibited. For the scope of this rule “inappropriate” content, products, or services are defined as those containing pornographic material, as well as those classified as not recommended for the corresponding age group, according to age rating guidelines or any other restrictions established by current legislation.
• Parental supervision:
  • OSPs must offer accessible and user-friendly parental supervision features allowing parents to: (i) view, configure, and manage account and privacy settings; (ii) restrict purchases and financial transactions; (iii) identify adult profiles interacting with the minor; (iv) access consolidated metrics on total usage time; (v) activate or deactivate safeguards through accessible controls; and (vi) access all information and control options in Portuguese.
  • Providers of app stores and operating systems must allow parents to configure voluntary parental supervision mechanisms and actively monitor the access of minors to applications and content.
• Reporting and removal obligations: OSPs must report and remove any detected content involving apparent sexual exploitation, abuse, abduction, or grooming of minors to the appropriate national and international authorities, following the requirements and deadlines to be defined in further regulation.
• Data preservation: OSPs are required to retain for 6 months relevant data from cases reported as sexual exploitation. This includes the reported  content, metadata referring to said content, and data and metadata from involved users.
• Notice-and-takedown: OSPs must promptly remove content that violates the rights of children and adolescents upon notification, regardless of a court order. For the purpose of this rule, content related to sexual exploitation and abuse, physical violence, cyberbullying, incitement to self-harm or substance abuse, gambling, predatory advertising, and pornography is considered a violation. Users whose content is removed must be notified and granted the right to appeal, with clear justification, access to the appeal process, and defined procedural deadlines. This rule does not apply to content of a journalistic nature and subject to editorial control.
• Prohibition of loot boxes: in electronic games targeted at or likely to be accessed by minors, loot boxes are prohibited.
• Transparency reports: OSPs with over 1 million underage users must publish semi-annual transparency reports in Portuguese. These include, at least: (i) the channels for receiving complaints; (ii) the number of complaints received; (iii) the number of content or account moderation actions, by type; (iv) the measures to identify child accounts and detect illicit activities; (v) the technical improvements for data protection and privacy; (vi) the mechanisms for verifying parental consent; and (vii) the methods and results of impact assessments and risk management related to the safety and health of minors.
• Local legal representation: OSPs operating in Brazil must maintain a legal representation in the country with the authority to receive judicial and administrative summons, notices, and communications and to respond to Executive, Judiciary, and Public Prosecutor’s Office authorities;
• Sanctions: non-compliance with legal obligations may result in: (i) warning; (ii) fines of up to 10% of the economic group’s revenue in Brazil or up to BRL 50 million per violation; (iii) temporary suspension of activities; or (iv) permanent ban.
• Governance: the government will create an autonomous regulatory authority to oversee enforcement and issue guidelines.

Once sanctioned by the President, the Bill will be effective one year after its publication in the Official Gazette. During this period, the government shall draft regulations on the matter to complement the law.

Our team is closely assessing the new framework and its impacts on OSPs operating in Brazil. For more information, please contact us at info@lickslegal.com.

‍