BR LGPD ECA Digital Art. 9 - restricted offers and conditional sector access safeguards

Where this comes from

Who it applies to

What engineering work it implies

Evidence an auditor expects

• Assessment documentDocument review

  ECA Digital source-scoped sector safeguards and conditional age-access assessment

  Record the actual Brazilian offer and access paths. Article 9 states the reliable-verification baseline at each access to restricted offers; self-declaration is not sufficient where verification is required. Assess the following Decree 12.880/2026 sector rules and their relationship to that statutory baseline before selecting a mechanism or relying on relief; do not infer a universal identity-document check or a blanket exemption. The statute commenced on 17 March 2026; the Decree commenced on publication on 18 March 2026 under Article 54. Article 14 distinguishes improper or inadequate offers: cumulatively assess applicable age classification, technical and organizational safety defaults from conception proportionate to age-specific risks, and effective parental supervision with configurable blocking and other protective methods. Preserve any additional risk-based ANPD protection requirement; this is not permission for harmful child access. Article 15 requires effective verification and prevention of under-18 access, enjoyment or consumption for legally prohibited offers: arms/ammunition/explosives; alcohol; smoking products including electronic smoking devices; products capable of causing physical or psychological dependence; fireworks subject to the low-harm statutory exception; gambling/betting/lotteries; loot boxes; pornography; escort services; primarily sexual dating/relationship services; and other legally prohibited offers. Its section 1(VI-X) categories also require preventing child/adolescent accounts/profiles and identifying/removing existing child-operated accounts. Classification must use the actual statutory/decree categories and qualifications; retain separately applicable arms restrictions under section 3. Article 16 requires assessed pornography classification by purpose, functionality or business model; own or third-party content includes previews, images, titles and captions. Preserve the contextual exclusions for educational/artistic/informative/journalistic audiovisual works with all applicable classification duties, age restrictions and parental supervision where subject to classification; health or violence-prevention education; educational/artistic/informative books or audiobooks without images/videos; and music/audio. Explicitly assess artificial sexual dialogue or generated/exchanged imagery under section 4 and ANPD's power to reclassify; a general education, news, music or AI label is insufficient. Article 17 requires providers displaying pornographic images/videos, for unregistered, unverified or child/adolescent-operated accounts, to hide, blur or not display that content by default, or require age verification to unlock it without mere self-declaration. Reconcile this display rule with Article 16's access duties; blurring does not itself verify age. Article 18 covers selling or intermediating prohibited products/services in Article 15 section 1(I-VII). Verify either at registration with default purchase blocking for children/adolescents and no self-declared unlock, or at purchase to prevent under-18 completion. For unregistered or unauthenticated purchasers, block completion by default. Article 19 requires social services offering prohibited content/products/services either to provide a version without those offers and related advertising, for which verification is dispensed, or to use effective verification without self-declaration. The version without prohibited offers and related advertising also applies to unregistered or unauthenticated users. Preserve ANPD service reclassification; a partially filtered feed or an adult-only label does not establish the alternative. Article 21 requires app stores and operating systems to prevent availability of lottery/betting offers that lack competent authorization or age-verification solutions. Assess the actual distribution role separately; a content supplier cannot substitute its own gate for every app-store/operating-system duty. Article 22's age-assurance dispensation for the eligible editorial-control, previously licensed copyright-content (from a responsible economic agent distinct from an end user), and musical/literary provider classes requires both age-appropriate child accounts/profiles and parental supervision with blocking/restricted access, respecting progressive autonomy and applicable classification. The separate journalistic/sports route requires editorial control and content not subject to classification. Verify every relevant condition and residual duty; do not equate this dispensation with Article 39's different list of statutory provisions or infer it from a generic service label. Article 23 requires loot-box game age verification to prevent child/adolescent access to that functionality, but permits a version without loot boxes or access fully blocked by default, for which verification is dispensed. Partial, optional or self-declared child blocking does not establish this alternative. Preserve other applicable game and child-protection duties. When a document-based age check is used under Decreto 12.880/2026 Art. 24 §3, extract only necessary age/age-range information and immediately and irreversibly delete the document image/copy and excess source information; do not retain them for audit evidence. Prohibit identity/access-history traceability under Art. 24(VIII). Choose effective, proportionate and accessible methods; under-18 verification data is purpose-limited by statutory Article 13. Keep raw documents, biometrics and child identifiers out of general logs. Use synthetic cases to verify the assessed sector path, unregistered/unverified access, repeated access, purchase completion, account creation, bypass/replay, failed checks, each claimed dispensation condition and residual safeguards. Keep minimized configuration/test evidence and unresolved questions. Current ANPD method criteria and implementation stages need source verification and qualified Portuguese review; this assessment does not approve every historical date or certify full-law compliance.

Questions people ask

Does BR LGPD ECA Digital Art. 9 - restricted offers and conditional sector access… apply to my service?

It applies when Brazil ECA Digital assessed fact Q_BR_ECA_ART9_RESTRICTED_OFFER: YES.

From when does this apply?

BR LGPD ECA Digital Art. 9 - restricted offers and conditional sector access… applies from 17 March 2026. Its current status is: in force.

What evidence does an auditor expect?

ECA Digital source-scoped sector safeguards and conditional age-access assessment.