Asking someone to provide their age is different from requiring that person to prove it. It is also different from just receiving a signal from the operating system indicating that the user belongs to a certain age group.
These distinctions should gain importance with the next stage of implementation of the Digital Statute of Children and Adolescents, the ECA Digital. The National Data Protection Agency's schedule foresees, from August 2026, the publication of guidelines and parameters on age measurement mechanisms, followed by a period of adaptation and monitoring until November.
This does not mean, however, that all applications have already been forced to adopt the same screen, ask for a document or use facial recognition. Until August 5, 2026, the official page consulted still presented the guidelines as preliminary and did not inform a specific day for the start of the second stage. The English version of the page said the guide would be updated by the end of the third quarter of 2026.
The immediate change for users may therefore be uneven: some services may adjust registrations, parental controls or access barriers before others. The central point is to know what purpose justifies the verification and what data is really needed to fulfill it.
What the ANPD schedule predicts for August
ECA Digital has been in force since March 2026, and its implementation was divided into stages. In the first, the ANPD prioritized application stores and operating systems, which can measure the user's age group and transmit an “age signal” to applications through a secure interface. In June, the Agency reported that initial monitoring covered Apple, Google and Microsoft.
In the second stage, official planning envisages:
- publication of guidelines and normative parameters on age measurement;
- disclosure of sectors or groups of suppliers that will be prioritized;
- expansion of monitoring, depending on the risk of each product or service;
- transition period between August and November 2026;
- monitoring and evaluation of implemented solutions;
- update of inspection and sanctions regulations from November;
- inspection actions planned from January 2027.
Monitoring is not synonymous with automatic application of a penalty. The step was planned to guide, collect information and monitor the suitability of suppliers. This also does not prevent the ANPD from adopting other measures in the face of complaints or violations that pose a high risk to children and adolescents.
Which is already a legal obligation
Law No. 15,211, of September 17, 2025, is not limited to applications made exclusively for children. It reaches technology products and services aimed at children and young people or likely to be accessed by them, considering factors such as attractiveness, ease of access and risk to privacy, security or development.
Among the rules already included in ECA Digital are:
- priority protection and adoption of measures proportionate to the risk;
- most protective configuration of privacy and personal data by default;
- information about the age group indicated for the service;
- parental supervision mechanisms;
- measures to prevent minors from accessing inappropriate, inappropriate or prohibited content and services;
- limitation of the use of data collected to verify age.
For content, products or services whose offer or access is prohibited or inappropriate for minors under 18, the law requires reliable verification mechanisms for each access and prohibits protection from being limited to self-declaration. A box asking “Are you over 18?” is not enough in these cases.
Reach should not be confused with a universal order for every application to document all users. The choice of solution must consider the context and risk of the service.
Asking age, checking age and estimating age are not the same thing
The ANPD uses age measurement as a general term for procedures designed to verify, estimate or infer age or age group. This may involve documents, biometrics, usage patterns or other technically appropriate means.
In practice, the user may encounter different approaches:
| What the application asks for or uses | What this can do | Risk to watch out for |
|---|---|---|
| Declared date of birth | Records the age informed by the user | May not be sufficient for areas restricted to adults |
| System age range signal | Informs the app of a category, without necessarily revealing the date of birth | Check if the app receives only the required attribute |
| Identity document | Confirm date of birth or age of majority | Display of name, number, photograph and other unnecessary data |
| Face image | Can be used to estimate age | Biometric processing, error, bias and image retention |
| History or usage pattern | Can infer an age range from behavior | Opaque profiling and excessive monitoring |
| Verifiable credential | Can only prove one attribute, such as “over 18 years old” | Check who issued the credential and what information is shared |
No method appears in the preliminary guidelines as a unique and mandatory solution for all contexts. The Agency recommends evaluating both the risk of the service and the risks created by the mechanism itself, including the processing of sensitive data, expanded sharing, discrimination, undue barriers and security incidents.
Can the app ask for a document or selfie?
A request for a document or facial image is not automatically illegal, but it also does not become appropriate just because the application mentions ECA Digital.
The solution needs to be proportional, necessary and fit for purpose. Biometric data is classified by the General Data Protection Law as sensitive personal data. According to preliminary guidelines, its use tends to require more robust justification, especially when there is a less intrusive alternative capable of achieving equivalent results.
Before sending a document, video or selfie, it's worth checking:
- which age group or requirement the service needs to confirm;
- why a simple credential or system signal would not be enough;
- which document fields will be collected;
- whether the full image will be stored or just analyzed;
- how long the data will be retained;
- which companies will it be shared with;
- how to dispute a wrong result;
- what alternative is there for those who cannot or do not wish to use that method.
A generic justification such as “legal requirement” is not very informative. The service must explain what obligation it is fulfilling and how it has limited collection.
Does the law authorize saving data for other purposes?
Article 13 of the ECA Digital determines that data collected to verify the age of children and adolescents is used solely for this purpose. The law also requires that the age signal provided by application stores and operating systems observe minimization and prohibits the continuous, automated and unrestricted sharing of personal data of this audience.
The ANPD guidelines reinforce that the solution must only handle the necessary data or age attribute, limiting collection, use and retention. They cite as a possible alternative credentials capable of simply proving that a person meets a requirement — for example, being of legal age — without revealing date of birth, document number or other identifiable information. The Agency itself emphasizes that this is not a unique or mandatory solution.
Thus, an age verification should not automatically become authorization for behavioral advertising, commercial profile creation or registration enrichment.
What might change in the application experience
During adaptation, users may encounter new steps when registering, downloading or accessing certain functions. Possible changes include:
- age range confirmation in the operating system;
- authorization from parents or guardians to download applications;
- activation of more protective settings by default;
- restrictions on purchases, contacts, location or recommendations;
- blocking areas unsuitable for minors;
- age review when the user tries to access a restricted function;
- indication of an alternative means when verification fails.
These possibilities arise from the architecture provided for in the law and the guidelines under discussion, but there is no confirmation that all applications will adopt the same screens or the same method. The Agency intends to define priorities based, among other factors, on the risk level of the product or service.
Privacy checklist before proving age
1. Check the purpose
Is the request linked to restricted content, age-appropriate configuration, downloading or parental supervision? Be suspicious when the explanation is vague.
2. Note the amount of data
To simply prove that someone is over 18 years old, does the service really need to store their full name, address, document number and their full image?
3. Look for an alternative
Does the application offer system sign-in, credentials, manual review, or another less invasive method?
4. Read about storage and disposal
See if there is clear information about retention, deletion, security and third-party companies.
5. Check the origin of the request
Do not send documents or selfies via links received in messages. Directly open the app or the official website.
6. Log issues
Save screens and protocols in case the method generates undue blocking, discrimination or apparently excessive collection.
7. Use the appropriate channels
First, look for the service's privacy channel or data officer. If the problem persists, consult the official ANPD channels, including the page dedicated to ECA Digital.
What parents and guardians should watch out for
Measuring age does not replace supervision, dialogue and digital education. The law itself combines companies' obligations with tools for families to manage downloads, purchases, screen time, privacy and contacts.
It is also important to avoid the reverse effect: technology designed to protect children should not subject them to disproportionate surveillance. The preliminary guidance recognizes that the mechanism may create risks for minors and adults, including through misclassification, exposure of sensitive data or unfair barriers to access.
What still needs to be confirmed
On August 5, 2026, the schedule indicated the beginning of the second stage “from August onwards”, but the page consulted did not record a specific day nor did it present the publication of the definitive guidelines as completed. Subsidy taking on the guide ended on July 9, and the topic continued to be classified as “in progress” on the Regulatory Agenda.
Therefore, the safest reading is:
- the law and its fundamental obligations are already in force;
- monitoring of stores and operating systems has begun;
- the expansion scheduled for August depends on the evolution of the schedule and ANPD guidelines;
- the period from August to November was planned as a transition and follow-up;
- a single universal method for all applications was not imposed in the sources consulted.
Save the checklist and consult the official ECA Digital page before delivering documents, biometrics or other data to an application. Guidelines, priorities and procedures can still be updated by the ANPD.
