DIGITAL ECALAW IN FORCETRENDING IN BRAZILMarch 24, 2026

Brazil's Digital ECA Is Now Law — What Platforms Must Do About Age Verification

As of March 17, 2026, every digital platform serving Brazilian users must verify age through official government data. Self-declaration is banned. Fines reach R$50 million (~$8.5M USD) per infraction. Here's what changed, who's affected, and how to comply in hours — not months.

Key Facts

Law

Lei 15.211/2025 (FELCA / Digital ECA)

Effective Date

March 17, 2026 — No grace period

Maximum Fine

R$50 million (~$8.5M USD) per infraction

Enforcement

ANPD (Brazilian Data Protection Authority)

Who Is Affected?

Any platform reachable by users in Brazil that offers content or services restricted by age. This includes:

🎮

Gaming

With chat, voice, purchases, or 18+ content

🎰

Betting & Gambling

Sports betting, casinos, lotteries

📺

Streaming

Netflix, Spotify, YouTube — age-restricted content

💬

Social Media

Platforms with messaging or user-generated content

❤️

Dating Apps

Tinder, Bumble, Badoo and all equivalents

🔞

Adult Content

Any platform with explicit material

🤖

AI Companions

Character.AI, Candy.AI, NSFW chatbots

🛒

E-Commerce

Age-restricted products (alcohol, tobacco, weapons)

What Changed on March 17?

Self-declaration is banned

Clicking “I am 18+” or entering a birth date is no longer sufficient. Platforms must use “reliable mechanisms” backed by official government data.

CPF-based verification is the standard

The CPF (Brazil's taxpayer ID) is the de facto method. A single API call returns the holder's date of birth from Federal Revenue records.

Major platforms already complied

Riot Games (League of Legends, Valorant) implemented age verification on March 18. Rockstar Games suspended its Brazilian store. Roblox already had age verification in place.

“ECA Digital” is trending

The law has been a top trending topic in Brazil since its enforcement. Public awareness is high — users expect platforms to comply.

How to Comply — In Hours, Not Months

1
Detect Brazilian users — Use IP geolocation or locale settings to identify users who need CPF verification.
2
Prompt for CPF — At registration or first access, ask the user for their CPF number (11 digits).
3
Call the FlagCheck API — Send the CPF to our endpoint. Receive the date of birth in ~500ms. Check if age >= 18.
4
Grant or block access — Adults proceed normally. Minors see an age-restriction message. Log the verification result.

Integration Example

curl -X POST https://api.flagcheck.com.br/api/felca/age-check \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"cpf": "12345678900"}'

# Response (200 OK):
{
  "status": "success",
  "result": "adult",      // or "minor"
  "age": 25,
  "dob": "2001-03-15"
}

Full documentation: api.flagcheck.com.br/docs

Comply with Brazil's Digital ECA Today

FlagCheck's Age Verification API is the fastest way to comply. One endpoint, ~500ms response, official government data. Already trusted by gaming platforms with millions of players.

~500ms

Response time

1 call

CPF in, age out

Free

Test credits to start

Try the Live Demo Read the API Docs

No contracts. No credit card. Volume pricing available — contact api@flagcheck.com.br

Who Is Already Complying?

✓

Riot Games — Implemented age verification for LoL, Valorant, and Wild Rift on March 18

✓

Roblox — Already had CPF-based age verification in place before the law

✓

TruckersMP — Integrated FlagCheck's API for CPF maturity checks within hours

⚠

Rockstar Games — Suspended its Brazilian store pending compliance

Need Help with Integration?

Our team can walk you through the integration in a 15-minute call. We support REST, Python, Node.js, PHP, and any HTTP client.

api@flagcheck.com.br

Frequently Asked Questions

What is Brazil's Digital ECA?

The Digital ECA (Law 15.211/2025), also known as the FELCA Law, amends Brazil's Child and Adolescent Statute (ECA) to require digital platforms to verify the age of Brazilian users through official government data. Self-declaration ("I am 18+") is no longer sufficient. The law took effect on March 17, 2026.

Which platforms are affected?

Any platform accessible by users in Brazil that offers content or features restricted to adults: gaming (with chat, voice, or in-app purchases), betting and gambling, streaming services, social media, dating apps, adult content, AI companions, and e-commerce with age-restricted products.

What are the penalties for non-compliance?

Fines of up to R$50 million (approximately $8.5M USD) per infraction. ANPD (Brazil's data protection authority) can also order platforms to block access to Brazilian users until compliance is demonstrated.

How does CPF-based age verification work?

The CPF (Cadastro de Pessoas Físicas) is Brazil's individual taxpayer ID — every Brazilian citizen has one. A single API call with the CPF number returns the holder's date of birth from official Federal Revenue records. Your backend checks if age >= 18. Response time is under 500ms.

Is there a grace period?

No. The Digital ECA took effect on March 17, 2026, with no grace period. ANPD can begin enforcement immediately. In practice, the largest platforms are prioritized, but all platforms are legally exposed from day one.

What about users without a Brazilian CPF?

The law applies to Brazilian users. For foreign users accessing your platform from Brazil, equivalent age verification methods (passport, national ID from their country) are accepted. Many platforms detect Brazilian IPs and trigger CPF verification for those users specifically.

How does this interact with LGPD (Brazil's GDPR)?

Both laws apply simultaneously. The Digital ECA mandates age verification; LGPD governs how you collect, process, and store the verification data. Best practice: store a SHA-256 hash of the CPF (never the raw number), log verification timestamps, and retain records for 5 years.

Can I use self-declaration or date-of-birth fields?

No. The Digital ECA explicitly bans self-declaration as a sole verification method. Platforms must use "reliable mechanisms" backed by official data. A date-of-birth field alone does not comply.