BR LGPD Art. 12

Where this comes from

Who it applies to

What engineering work it implies

Evidence an auditor expects

• Assessment documentDocument review

  Provide privacy-preserving store and operating-system age assurance and parental authorization — scoped assessment evidence

  Assess whether the actual provider supplies an internet application store or terminal operating system available in Brazil. Statutory Article 12 attaches to these roles; operating an ordinary app, integrating an SDK, lacking child-directed branding or having no current parental-control feature does not decide the role. Take proportionate, auditable and technically secure steps to assess users' age or age range under LGPD principles. Decree Article 25 §2 requires an age/age-range declaration at account creation plus assurance using a reliable method under current ANPD criteria, preferably verifiable credentials. A declaration alone is not the complete process. Allow contests and correction through additional evidence with a reasoned decision within a reasonable period, and address multiple-account and other bypass tactics without imposing unnecessary identity collection. Enable parents/legal guardians to configure voluntary parental-supervision mechanisms and actively supervise child/adolescent app/content access. Distinguish configuring these tools from the separate authorization required for downloads and installations. Before a child's/adolescent's app download or installation, obtain the required free and informed parent/legal-guardian authorization, respect progressive autonomy and disclose the app's assigned age classification before authorization. Statutory Article 12 §2 forbids presuming authorization from a guardian's silence or absence. Do not substitute an age signal for that authorization. Provide age signals to service suppliers free of charge through a secure API designed for privacy by default, exclusively for the law's purposes with appropriate safeguards. Statutory Article 12 and Decree Article 25 limit signals to strictly necessary minimum-age confirmation and prohibit exact birth date, civil identity and profiling-data transmission, as well as continuous, automated and unrestricted personal-data sharing. Where age assurance is performed, apply Decree Article 24's risk proportionality, accuracy/robustness/reliability, data minimization, privacy/security, inclusion/non-discrimination, interoperability, transparency and auditability. Prohibit continuous, automated and unrestricted personal-data sharing and identity, access, request and verification-history traceability. For document-based checks, extract only necessary age or age-range information and immediately and irreversibly delete document images/copies and excess source information. Decree Article 24 also prohibits using age-assurance data for another purpose, including behavioral profiling. Under statutory Article 13, data collected to verify children's/adolescents' ages is limited to that purpose, including no behavioral profiling. Use synthetic users and sanitized signals to test the assessed scope, authorization failures, conflicting/absent signals, bypass and dispute paths. Keep necessary protocol/configuration/test/review records and unresolved gaps; exclude real child identities, exact birth dates, raw credentials/documents/biometrics, access histories and raw dispute evidence from ordinary task attachments, exports and general logs. These are engineering evidence-minimization safeguards, not a prescribed fixed log schema or retention period. Verify current ANPD method, security, transparency and interoperability criteria and qualified Portuguese review. Statutory Article 12 commenced on 17 March 2026; Decree Article 25's elaborations commenced on 18 March 2026. Keep ordinary service-supplier duties, parental supervision and any other legal basis separately assessed; this is not an operational integration or a full-law approval.

Questions people ask

Does BR LGPD Art. 12 apply to my service?

It applies when Brazil ECA Digital assessed fact Q_BR_ECA_APP_STORE_OS_ROLE: YES.

From when does this apply?

BR LGPD Art. 12 applies from 17 March 2026. Its current status is: in force.

What evidence does an auditor expect?

Provide privacy-preserving store and operating-system age assurance and parental authorization — scoped assessment evidence.