ANPD sets deadlines and content requirements for transparency reports on the protection of children and adolescents

On August 11, 2026, the Brazilian National Data Protection Agency (ANPD) issued Decision CD/ANPD No. 122/2026, clarifying the deadlines, reporting periods, and minimum content requirements for the semiannual transparency reports provided for in Article 31 of Law No. 15,211/2025 (the so-called “Digital ECA”).

Who is subject to the requirement?

The requirement applies to internet application providers that, cumulatively:

• are directed at children and adolescents or are likely to be accessed by them; and
• have more than 1 million registered child or adolescent users who access the internet in Brazil.

In other words, merely qualifying as a service that is “likely to be accessed” by children and adolescents does not, by itself, trigger the reporting requirement. The service must also have more than 1 million registered underage users in Brazil.

Providers of services with editorial control and providers of copyright-protected content previously licensed by economic agents other than the end user are also exempt from publishing the semiannual reports, provided that the conditions set out in Article 39(1) of Law No. 15,211/2025 are met.

What is the deadline for the first report?

The first report must be published by September 17, 2026.

In principle, it must cover the period from January 1 through June 30, 2026. However, because Law No. 15,211/2025 did not take effect until March 17, 2026, providers that do not have information for January and February may limit their first report to the period from March 17 through June 30, 2026.

Providers are advised to expressly state in the report that they have elected to use the shorter reporting period and that data predating the law’s effective date is unavailable.

How will subsequent reporting cycles work?

Beginning with the second report, the reporting periods will coincide with the calendar half-years:

• January 1 through June 30: publication by August 1;
• July 1 through December 31: publication by February 1 of the following year.

Accordingly, the second report must cover the period from July 1 through December 31, 2026, and be published by February 1, 2027.

This schedule will apply until the ANPD issues specific regulations.

What information must the report contain?

The report must be published in Portuguese, as a single document, on the provider’s own website. At a minimum, it must contain the following information:

• channels for receiving reports and the corresponding review procedures;
• number of reports received;
• number of content- and account-moderation actions, by type;
• measures adopted to identify children’s accounts and unlawful conduct;
• technical enhancements relating to the privacy and data protection of children and adolescents;
• enhancements relating to verification of parental consent;
• methods and results of impact assessments and the management of risks to the safety and health of children and adolescents;
• number of notices received, broken down by category; and
• proportional data on the action taken in response to those notices.

The Decision also recommends sending a copy of the report to ANPD e-mail address monitoramento@anpd.gov.br when it is published. This is only a recommendation, as the legal requirement is limited to publishing the report on the provider’s website.

Outstanding issues

Although the Decision clarifies the reporting schedule, it does not define the methodology for determining whether the user threshold has been exceeded.

The following issues remain without specific criteria:

• the reference date for the user count;
• the treatment of inactive or duplicate accounts;
• the identification of users whose age is unknown;
• the criteria for determining whether an internet connection is located in Brazil;
• whether different services offered by the same economic group may be aggregated;
• the taxonomy applicable to reports and moderation actions.

Until these criteria are defined, each organization should establish and document a reasonable and consistent methodology for determining its number of users, so that it can demonstrate, if necessary, the criteria and assumptions used in the count.

Recommendations

Companies potentially subject to the requirement should:

1. assess whether their services are directed at minors or are likely to be accessed by them;
2. determine whether they exceed the threshold of more than 1 million registered child and adolescent users who access the internet in Brazil;
3. verify whether the service falls within any of the exemptions provided for in Article 39 of Law No. 15,211/2025;
4. document the methodology, criteria, and data used to count users;
5. if the requirement is found to apply, identify the teams responsible for providing the required information;
6. submit the report for legal review and validation by the teams responsible for the information presented in it; and
7. retain evidence of publication and, if applicable, of submission of a copy of the report to the ANPD.

Even companies that conclude they are not subject to the requirement should internally document their analysis and retain the data supporting that conclusion.

Conclusions

Decision No. 122/2026 provides greater predictability for the first publication cycle of the transparency reports required under the Digital ECA, but it does not resolve all questions concerning the identification of providers subject to the requirement.

At this stage, the key step is to determine, based on internal data and a documented methodology, whether the service has more than 1 million registered child and adolescent users in Brazil. This threshold is one of the conditions that triggers the requirement. Therefore, merely qualifying the service as likely to be accessed by this audience does not, by itself, make publication of the report mandatory.

Our team will continue to monitor the regulation of the Digital ECA and the ANPD’s forthcoming actions.