BR LGPD Arts. 10, 13-15

Where this comes from

Who it applies to

What engineering work it implies

Evidence an auditor expects

• Assessment documentDocument review

  Provide age-appropriate experiences and receive minimized age signals — scoped assessment evidence

  Assess the actual Brazil-available product/service directed to or likely accessed by children or adolescents. Statutory Article 10 requires age-appropriate experiences respecting progressive autonomy and Brazilian socioeconomic diversity; missing accounts, restricted offers or a current age-check feature does not decide that general duty. Under statutory Article 14, adopt technical and organizational measures to receive Article 12 age information, and retain the provider's own mechanisms against access to content inappropriate for the relevant age group. App-store/operating-system measures and Chapter IV compliance do not remove the other agents' responsibilities under Article 15. Reconcile Decree Article 26's receiving-signal scope for child-facing/likely-accessed suppliers of improper, inadequate or prohibited offers, its requirement to adapt the experience after receipt, and its browser-access age-assurance provision. Browser-access suppliers may use signals from operating systems, stores or other digital suppliers. Receipt does not relieve the supplier of effective age appropriateness and safeguards. Preserve the broader statute and qualified review of the statute/decree relationship. Apply Decree Article 25 §4 where a supplier's age-assurance information conflicts with a store/operating-system signal: use the more protective alternative for the child/adolescent. An unresolved or missing signal is not proof of adulthood, parental authorization or lawful access. Age signals contain only what is strictly necessary to confirm the required minimum age; do not transmit exact dates of birth, civil identity or profiling data. Article 22's age-assurance dispensation for the eligible editorial-control, previously licensed copyright-content (from a responsible economic agent distinct from an end user), and musical/literary provider classes requires both age-appropriate child accounts/profiles and parental supervision with blocking/restricted access, respecting progressive autonomy and applicable classification. The separate journalistic/sports route requires editorial control and content not subject to classification. Verify every relevant condition and residual duty; do not equate this dispensation with Article 39's different list of statutory provisions or infer it from a generic service label. Preserve age-appropriate experiences and residual duties; receipt of a signal or an existing gate does not establish every condition. Where age assurance is performed, apply Decree Article 24's risk proportionality, accuracy/robustness/reliability, data minimization, privacy/security, inclusion/non-discrimination, interoperability, transparency and auditability. Prohibit continuous, automated and unrestricted personal-data sharing and identity, access, request and verification-history traceability. For document-based checks, extract only necessary age or age-range information and immediately and irreversibly delete document images/copies and excess source information. Decree Article 24 also prohibits using age-assurance data for another purpose, including behavioral profiling. Under statutory Article 13, data collected to verify children's/adolescents' ages is limited to that purpose, including no behavioral profiling. Use synthetic users and sanitized signals to test the assessed scope, authorization failures, conflicting/absent signals, bypass and dispute paths. Keep necessary protocol/configuration/test/review records and unresolved gaps; exclude real child identities, exact birth dates, raw credentials/documents/biometrics, access histories and raw dispute evidence from ordinary task attachments, exports and general logs. These are engineering evidence-minimization safeguards, not a prescribed fixed log schema or retention period. Verify current ANPD criteria and qualified Portuguese review. Statutory Articles 10/13-15 commenced on 17 March 2026; the cited decree provisions commenced on 18 March 2026. This record does not approve a historical outcome, implement a universal age-verification method, or claim complete ECA Digital coverage.

Questions people ask

Does BR LGPD Arts. 10, 13-15 apply to my service?

It applies when Brazil ECA Digital assessed fact Q_BR_ECA_CHILD_ACCESS: YES.

From when does this apply?

BR LGPD Arts. 10, 13-15 applies from 17 March 2026. Its current status is: in force.

What evidence does an auditor expect?

Provide age-appropriate experiences and receive minimized age signals — scoped assessment evidence.