*By Luiz Felipe Vieira de Siqueira
I. The Phenomenon of Reactive Legislation and its Media Impact on Brazilian Digital Law
Brazilian legislative history demonstrates a striking trend: high-profile media events frequently act as catalysts for the approval of digital laws that might otherwise remain stalled in Congress. This phenomenon, known as reactive legislation, has established a pattern in national digital law.
Notable examples include the leak of photos of actress Carolina Dieckmann, which led to the amendment of the Penal Code to classify digital crimes (Carolina Dieckmann Law), and the Edward Snowden case (described in the film). Snowden), which culminated in the enactment of the Brazilian Internet Bill of Rights (Law No. 12.965/2014). Similarly, the Brazilian General Data Protection Law (LGPD), Law No. 13.709/2018, was driven by the international controversy surrounding the case. Cambridge Analytica, exposing the misuse of data which is reported in the documentary. Privacy Hacked.
In 2025, Brazil witnessed a repetition of this cycle with the Felca Case. The complaints made by YouTuber They exposed systemic flaws in the protection of children and adolescents in the digital environment, especially regarding the adultification and commercial exploitation of children and adolescents.
Although the topic was already recognized as relevant and lacked regulation, it was only after the Felca case that..., in less than a month, In 2025, the Digital Child and Adolescent Statute (ECA Digital) — Law No. 15.211/2025 — was enacted. The new legislation highlights that international experience had already demonstrated the inadequacy of self-regulation by digital platforms, and that the absence of specific legal provisions resulted in serious consequences. Thus, the package of measures approved in 2025 represents a direct response from the Brazilian State, aimed at promoting greater digital security and strengthening independent regulation.
II. The Felca Case: The Systemic Exposure of Child Exploitation and the “P Algorithm”
Felca's revelations brought to light the growing and shocking practice of parents exposing and producing content about their underage children for monetization, which often resulted in the adultification or sexualization of these young people. This practice directly contradicts national and international child protection standards.
Recent cases involving children and adolescents on the internet have laid bare an alarming reality about the risks of early exposure and digital exploitation. The Bel Para Meninas case brought to light the devastating psychological impact of overexposure of children on social media. The constant criticism and public pressure generated deep trauma, reinforcing the maxim that "children shouldn't be involved in adult things.".
The episode involving Camilynhha and Ítalo Santos revealed an even more disturbing scenario: the conditioning of a teenage girl to a sexualized environment, where her image was treated as a commodity for adult consumption. The recording of a cosmetic procedure—a silicone implant at age 17—for public display exemplifies the objectification and loss of autonomy over her own body.
Finally, the case of Caroline Dreher exposed the extreme of perversion and greed. The mother, responsible for managing her daughter's content between the ages of 11 and 14, was selling explicitly criminal and sexual material in private Telegram groups. The situation goes beyond mere negligence, constituting child exploitation in its cruelest form.
These episodes are not only shocking, but they demand urgent reflection on the limits of digital exposure, the role of the family, and the collective responsibility in protecting children.
Perhaps the most technical and alarming aspect of the complaint was the revelation of... “"Algorithm P" (Predator). Felca demonstrated, in practice, that social media algorithms can be quickly manipulated to deliver suggestive videos of children directly to pedophiles. Criminals use codes like "trade" or "link in bio" (Telegram profile) to share them. Child Pornography (CP), taking advantage of the negligence or bad intentions of the platforms.
It is important to highlight that the YouTuber He disabled monetization on his video, which gave credibility and an altruistic character to Felca, who continues to be persecuted for revealing the episode.
III. The Digital Child and Adolescent Statute and the Duty of Care
Law No. 15.211, of September 17, 2025 (Digital ECA), was created as a direct response to this reality, focusing on the comprehensive protection and prevalence of the interests of children and adolescents in the online environment. The law comes into effect six months after its publication.
The ECA Digital aligns with international frameworks, such as General Comment No. 25 (2021) of the UN Committee on the Rights of the Child, which requires that the “best interests of the child” be a primary consideration in relation to the digital environment. The duty of protection falls on families, the State and the whole of society, explicitly including technology companies.
The new legislation represents a significant step forward in protecting children in the digital environment, by imposing direct and bold obligations on providers of online products and services. Inspired by the principle of “children’s rights by design” (Children's rights by designIt establishes that the safety and well-being of minors must be considered from the design stage of the platforms.
Among the main requirements, age verification stands out, obliging companies to implement reliable mechanisms to prevent children and adolescents from accessing inappropriate content. This measure aims to create effective barriers against early exposure to unsuitable material.
Another key point is parental supervision. Platforms must offer accessible and intuitive tools so that parents and guardians can monitor, limit, and manage the use of services. This includes the ability to restrict communication with unauthorized users and control features that encourage excessive use, such as... autoplay and the constant notifications.
The legislation also categorically prohibits monetization and targeted advertising aimed at minors. The use of profiling for commercial purposes is forbidden, as is any form of boosting content that portrays children or adolescents in an eroticized or suggestive manner.
Finally, it establishes the duty to remove illicit content, obligating suppliers to immediately delete and report to the authorities any material related to the exploitation, sexual abuse, kidnapping, or enticement of minors.
This new legislative approach signals a firm commitment to building a more ethical, safe, and respectful digital environment for children.
UN General Comment No. 25, brilliantly commented on by Alana Institute, It had already been determined that profiling or targeted advertising to children, based on digital records of their characteristics, should be prohibited by law.
The new Brazilian law complies with this international recommendation, which aims to protect children from commercial exploitation and practices based on neuromarketing, Emotional analysis and immersive advertising in virtual and augmented reality environments.
IV. Companies Under Pressure: The Challenges of Compliance
The enactment of the Digital ECA (Brazilian Statute for Children and Adolescents) imposes a new and rigorous set of obligations on companies that offer digital products or services with the potential for access by children and adolescents. Compliance with Law No. 15.211/2025 requires significant structural transformations, ranging from technological architecture to commercial practices and data governance.
One of the main points of attention is age verification. Legislation mandates that companies adopt technically secure, auditable, and proportionate mechanisms to verify users' ages, prohibiting the exclusive use of self-declaration. Furthermore, data collection must be strictly limited to the purpose of verification, in accordance with the principles of the General Data Protection Law, which imposes an additional challenge of reconciling security and data minimization.
Another critical axis is the design Ethical principles and protection against commercial exploitation are paramount. Privacy and security must be incorporated from the design of products and services. Legislation prohibits the use of children's profiles for advertising purposes, as well as the monetization of content that portrays minors in an eroticized or suggestive manner. It also forbids the use of persuasive techniques that induce children and adolescents to excessively expose their data or disable safeguards.
Companies are also required to provide accessible and effective parental supervision tools. These resources should allow parents and guardians to limit communication with third parties, control potentially addictive features—such as autoplay and excessive notifications—and link the accounts of children under 16 to their own.
With regard to the removal of illegal content, the law imposes a duty to immediately remove and report to the competent authorities any material involving abuse, sexual exploitation, kidnapping, or enticement of minors. This responsibility also extends to the removal of content that violates the rights of children and adolescents, upon notification from victims, legal representatives, or advocacy organizations.
Finally, the deadline of vacatio legis A timeframe of just six months represents an additional challenge, especially for small and medium-sized enterprises, which will have to implement profound changes in a short period of time. The requirement of accountability In other words, actively demonstrating compliance reinforces the need for strategic planning and investment in digital governance.
V. Parents in a New Role: Between Supervision and Autonomy
The Digital ECA (Brazilian Statute for Children and Adolescents) inaugurates a new era in the protection of children and adolescents in the virtual environment, redefining the role of families within a model of co-responsibility that involves the State, civil society, and the private sector. The figure of parents, previously seen as solely responsible for the digital safety of their children, now occupies a position of active partnership, with specific responsibilities and institutional support.
In this new scenario, parents must effectively use the parental control tools provided by digital platforms. These resources allow them to limit unwanted interactions, control potentially addictive features, and link children's accounts to those of their legal guardians, promoting a safer and more supervised environment.
At the same time, it is necessary to balance protection with respect for the progressive autonomy of children. Legislation recognizes that children and adolescents have the right to develop their privacy and freedom of expression, which requires parents to adopt an empathetic, guiding, and non-authoritarian stance. The challenge lies in protecting without stifling, guiding without excessively controlling.
Parental consent, required by the LGPD (Brazilian General Data Protection Law) for the processing of children's personal data, remains a legal requirement, but it is not sufficient on its own. In certain situations, this consent may even contradict the law. best interests of the child, This is especially true when parents lack adequate technical knowledge or are influenced by deceptive business practices. The information asymmetry between parents and companies reinforces the need for caution and regulatory oversight.
Digital literacy among parents is becoming a strategic priority. For them to effectively fulfill their role, it is essential that they receive support through public training policies, awareness campaigns, and access to clear information about risks, rights, and responsibilities in the digital environment. Without this support, shared responsibility becomes weak and the protection of minors incomplete. This is a challenge in a country with low average education levels.
VI. Institutional Strengthening: ANPD as a Regulatory Agency
Recognizing that regulation is ineffective without robust oversight, the Federal Government has implemented measures to strengthen the National Data Protection Authority (ANPD). The absence of legal provisions has already caused serious damage, proving that self-regulation is insufficient.
Provisional Measure No. 1,317/2025 and Decree No. 12,622/2025 marked a turning point in the Brazilian regulatory structure by strengthening the oversight of the new legal framework aimed at protecting children and adolescents in the digital environment.
Provisional Measure No. 1,317/2025 brought about a significant transformation by elevating the National Data Protection Authority (ANPD) to the status of a Regulatory Agency. With this, the ANPD gained functional, technical, decisional, administrative, and financial autonomy, consolidating itself as an independent and strategic entity in the regulation of data protection in the country.
Complementing this change, Decree No. 12,622/2025 granted the ANPD (National Data Protection Authority) exclusive competence to act as an autonomous administrative authority in the protection of children and adolescents in digital environments. The ANPD thus became the central body responsible for interpreting and establishing rules and guidelines aimed at the security and privacy of minors' personal data, coordinating cooperation among the various actors in the sector.
To enable this new structure, the Ministry of Management and Innovation in Public Services (MGI) supported a robust organizational restructuring process. Without increasing expenses, 797 vacant permanent positions were transformed, resulting in the creation of 200 Data Protection Regulation Specialist positions, in addition to 26 commissioned positions and positions of trust. This initiative gave the ANPD unprecedented technical capacity and institutional stability, essential for the effective implementation of the new legal provisions.
Prior to the restructuring, the ANPD had only four employees dedicated to data oversight throughout Brazil (out of a total of 152, including employees and outsourced staff), making it clear that there was a need to strengthen the agency to deal with the complexity and scale of the digital environment.
The ANPD (National Data Protection Authority) does an excellent job in regulatory and educational aspects. However, its enforcement is weak, and to date only one small telemarketing company has been fined R$14,400.00 (fourteen thousand four hundred reais), and public entities have learned little from the sanctions they have received, as seen with INSS (National Institute of Social Security) and Dataprev (Brazilian Data Processing Company). The challenge is to put the legislation into practice and enforce it so that the regulations are effective.
VII. The Power to Sanction and the Transfer of Responsibility
Strengthening the ANPD (National Data Protection Authority) ensures the agency has the appropriate tools to effectively regulate, oversee, and sanction violations of the ECA Digital (Brazilian Statute for Children and Adolescents) and LGPD (Brazilian General Data Protection Law) regulations.
In accordance with the sanctions provided for in the General Data Protection Law, non-compliance with the new rules may lead to the application of a simple fine of up to 10% of the legal entity's (group or conglomerate in Brazil) revenue in the last fiscal year, limited to R$ 50,000,000.00 (fifty million reais) per infraction. There is also the provision for partial or total suspension of the operation of the database or the partial or total prohibition of the exercise of activities related to data processing in the country.
By enacting the Digital ECA (Statute of Children and Adolescents) and structuring the ANPD (National Data Protection Authority) as an independent regulatory agency, Brazil reaffirms the State's commitment to protecting children and adolescents in the digital environment.
Furthermore, if the provisional measure is converted into law, Brazil will finally have an Independent Supervisory Agency, which will position it as a country with a high level of privacy and protection of personal data, which is of paramount importance, especially for international data transfers.
It remains to be seen whether the ANPD, now an independent Regulatory Agency, will adopt a more proactive stance regarding oversight. Meanwhile, companies have very little time to make the adaptations imposed by the Digital ECA (Brazilian Statute of Children and Adolescents). The media frenzy that led to the enactment of the law in less than a month, with little parliamentary debate, puts companies and parents under immense pressure to adapt to the regulation.
References:
ALANA. General Comment No. 25 on children's rights in relation to the digital environment: annotated version. São Paulo: Alana, 2022. Available at: https://alana.org.br/wp-content/uploads/2022/11/Comentario-Geral-No-25-sobre-os-direitos-das-criancas-em-relacao-ao-ambiente-digital-Versao-Comentada.pdf. Accessed on: September 26, 2025.
FELCA. The adultification of children on social media.. [Video]. YouTube, September 25, 2025. Available at: https://youtu.be/FpsCzFGL1LE. Accessed on: September 26, 2025.
PRIVACY HACKED. Directed by: Karim Amer; Jehane Noujaim. United States: Netflix, 2019. Available on: https://www.netflix.com/br/title/80117542. Accessed on: September 26, 2025.
SNOWDEN. Directed by Oliver Stone. United States: Open Road Films, 2016. Available at: https://www.primevideo.com/-/pt/detail/Snowden/0NHF2PS2PDAZUNPQUPB5SCL3R6 . Accessed on: September 26, 2025.
*By Luiz Felipe Vieira de Siqueira, PhD candidate in Innovation & Technology – PPGIT UFMG and Researcher at the ABES Think Tank
Notice: The opinion presented in this article is the responsibility of its author and not of ABES - Brazilian Association of Software Companies
Article originally published on the TI Expertise website: https://tiexpertise.com.br/do-escandalo-midiatico-ao-eca-digital/
