BR · AI law tracker
2.628/2022 — BR
2.628/2022 is an AI governance legislation from BR, currently enacted. Brazil enacted the Digital Child and Adolescent Statute (ECA Digital) [1], designating ANPD as its autonomous regulatory authority. AIGI tracks 1 primary-source update on this bill; the most recent was published on 2025-09-18.
Status & timeline
- Regulatory stage
- enacted
- Bill status
- enacted
- Authority / governing body
- Autoridade Nacional de Proteção de Dados
- Document type
- legislation
Next deadline: Effective March 17, 2026 (six months from September 17, 2025).
Subscriber only
Full obligation matrix
| Actor | Obligation | Deadline | Source |
|---|---|---|---|
| agency | Assume the expanded competencies resulting from the Digital Child and Adolescent Statute (ECA Digital). | 2026-03-17 | — |
| agency | Be designated as the autonomous administrative authority for the protection of children and adolescents in digital environments. | 2025-09-17 | — |
| agency | Undergo transformation into a Regulatory Agency, linked to the Ministry of Justice, with functional, technical, decisory, administrative, and financial autonomy. | 2025-09-17 | — |
| agency | Create the career path of Specialist in Data Protection Regulation and new positions to strengthen its structure. | 2025-09-17 | — |
| agency | Institute an internal working group to analyze the dispositions of the ECA Digital. | — | — |
| agency | Plan the execution of the new legal competencies resulting from the ECA Digital. | — | — |
| agency | Promote a safer and more reliable digital environment for children and adolescents. | Ongoing | — |
| agency | Guarantee the effective protection of the fundamental rights of children and adolescents in digital contexts. | Ongoing | — |
| agency | Continue prioritizing fiscalization actions to protect personal data of children and adolescents in digital platforms, artificial intelligence systems, and facial recognition technologies. | Ongoing | — |
| deployer | Comply with the provisions of Law No. 15.211 (Digital Child and Adolescent Statute) concerning the protection of children and adolescents online. | 2026-03-17 | — |
Subscriber only
Enforcement risk score
75
/ 100
Enforcement actions have been filed against named organizations under this or analogous rules.
Subscriber only
Role-based compliance checklist
- general_counsel Review Law No. 15.211 (ECA Digital) for specific requirements regarding online services and data processing for minors in Brazil. (2026-03-17)
- compliance_officer Develop and implement internal policies and procedures to ensure compliance with the new ECA Digital, particularly concerning data of children and adolescents. (2026-03-17)
- product_manager Assess digital platforms, services, AI systems, and facial recognition technologies for their impact on children and adolescents and ensure they meet ECA Digital requirements. (2026-03-17)
- cto Ensure technical safeguards and data processing practices are in place to comply with data protection principles for minors under ECA Digital, especially for AI and biometric systems. (2026-03-17)
Intelligence briefs (1)
legislation enacted 9/18/2025
Brazil Transforms ANPD, Enacts Digital Child and Adolescent Statute (ECA Digital)
Brazil enacted the Digital Child and Adolescent Statute (ECA Digital) [1], designating ANPD as its autonomous regulatory authority.
This strengthens child data protection, expanding ANPD's regulatory scope and enforcement capacity for AI systems and facial recognition.
Deadline: Effective March 17, 2026 (six months from September 17, 2025).
Primary source →Frequently asked questions
- What is 2.628/2022?
- The Brazilian President sanctioned Bill 2.628/2022, establishing the Digital Child and Adolescent Statute (ECA Digital) [1]. Concurrently, Provisional Measure 1.317/2025 transforms the ANPD into an autonomous regulatory agency, significantly expanding its powers to protect children and adolescents in digital environments [2]. This includes specific focus on AI systems and facial recognition technologies, with an effective date set for six months from September 17, 2025. Primary source →
- Why does 2.628/2022 matter?
- This strengthens child data protection, expanding ANPD's regulatory scope and enforcement capacity for AI systems and facial recognition. Primary source →
- Who does 2.628/2022 affect?
- Organizations operating in Brazil that process personal data of children and adolescents are directly affected. This includes deployers of digital platforms, AI systems, and facial recognition technologies. Companies involved in online content, educational services, gaming, social media, and any other digital services targeting or involving minors must review their data processing practices and accountability frameworks. The ANPD's expanded enforcement powers, particularly concerning AI, necessitate a re-evaluation of current compliance programs. Primary source →
- What are the key dates for 2.628/2022?
- Effective March 17, 2026 (six months from September 17, 2025). Primary source →
- What is the current status of 2.628/2022?
- As of the last published update, 2.628/2022 is at the "enacted" stage, with bill status "enacted". Primary source →
- Where can I find the primary source for 2.628/2022?
- The primary source for the most recent update is at https://www.gov.br/anpd/pt-br/assuntos/noticias/governo-federal-estrutura-anpd-para-assumir-competencias-do-eca-digital. AIGI publishes the full citation chain plus every approved brief on this bill. Primary source →
Related
Stay informed