Brazil's data watchdog adds child protection to enforcement agenda

Brazil's National Data Protection Authority approved its enforcement priorities for 2026-2027 on December 22, 2025, significantly expanding its focus to include child protection in digital environments following the September passage of sweeping new legislation. The regulatory agenda reshapes the agency's two-year planning document amid institutional changes that transformed the ANPD into a full regulatory agency.

The December 22 directive from the Conselho Diretor establishes four priority enforcement themes for the next 24 months. Director Lorena Giuberti Coutinho's vote outlined the agency's rationale in process document 00261.002292/2025-19, which was approved unanimously after deliberation spanning from October through late December.

Protecting children online becomes enforcement focus

The most significant change centers on protecting children and adolescents in digital spaces, according to the approved resolution. The ANPD will conduct 15 inspection activities to verify that technology providers implement privacy-protective configurations by default for products and services "directed at children and adolescents, or of probable access by them."

Another 15 enforcement actions will examine whether providers adopt measures preventing children and adolescents from accessing inappropriate or prohibited content, including age verification mechanisms. This represents a substantial commitment of resources to the newly designated regulatory area.

The shift follows Law 15.211/2025, which President Luiz Inácio Lula da Silva signed September 17, 2025. That statute, known as the Digital Child and Adolescent Statute, grants the ANPD authority over protecting minors' rights online. Decree 12.622, also from September 17, formally designated the ANPD as the autonomous administrative authority for child digital protection.

Director Coutinho's vote emphasized that the law's passage and the decree constitute "new and urgent facts" justifying agenda revisions under the agency's procedural rules. The statute's six-month implementation period creates pressure for rapid regulatory action, with full enforcement beginning March 2026.

The enforcement priorities reflect what the ANPD terms "safety by design" principles. This approach emphasizes incorporating protective measures during product development rather than applying fixes after deployment. The concept draws from international frameworks, including OECD guidance and practices adopted in Australia and the European Union.

Secondary use enforcement narrows to advertising

The ANPD will conduct five enforcement activities examining secondary use of personal data for targeted advertising, according to the approved map. This narrows from the original proposal, which would have addressed incompatible secondary uses more broadly, including profiling.

The refinement aligns with provisions in Law 15.211/2025 prohibiting profiling techniques for directing commercial advertising to minors. Article 22 of that law specifically bans "the use of profiling techniques for directing commercial advertising to children and adolescents, as well as the use of emotional analysis, augmented reality, extended reality and virtual reality for this purpose."

Director Coutinho modified terminology in her vote, replacing "perfilização" with "perfilamento"—the term actually used in Law 15.211/2025. This technical correction reflects the statute's adoption of specific language for data processing practices.

The targeting of advertising practices for enforcement reflects the ANPD's assessment that such uses represent particularly relevant business models for internet applications and digital services. Previous agency analysis identified secondary data use for advertising as meriting prioritization during the enforcement planning cycle.

Data subject rights and sensitive information

The agency will perform enforcement activities protecting data subject rights, particularly regarding biometric, health, and financial data treatment. The priority theme maintains focus on individual rights while incorporating sensitivity to specific data categories carrying heightened privacy risks.

Director Coutinho's vote specified that enforcement will address rights of data subjects "especially regarding the treatment of biometric, health and financial data." This language preserves the breadth of potential enforcement while signaling particular attention to sensitive categories.

Government data sharing oversight deferred

Monitoring government compliance with personal data sharing regulations shifted to the agenda's fourth phase. The original plan placed this item in phase two, scheduled for the second half of 2026.

The postponement allows the ANPD to await finalization of regulations governing data sharing among public sector entities. A draft regulation on Shared Use of Personal Data by Public Authorities underwent public consultation, with the formal rulemaking process still underway.

Director Coutinho's vote explained that monitoring activities should occur in the second half of 2027, providing time for the regulation's completion and publication. This sequencing ensures enforcement actions reference established regulatory standards rather than preliminary frameworks.

Artificial intelligence scope expands

The fourth enforcement priority addresses artificial intelligence and emerging technologies, with the ANPD planning 20 inspection activities. Director Coutinho expanded the original scope beyond generative AI to encompass AI systems generally, including recommendation systems and facial recognition.

The broadening reflects the agency's actual enforcement experience during 2024-2025. The monitoring cycle report documented activities addressing facial recognition systems and recommendation algorithms affecting children and adolescents, not just generative AI applications.

The vote modified the objective from "intensify ANPD action regarding personal data treatment by emerging technologies, especially generative artificial intelligence" to "intensify ANPD action regarding supervision of emerging technologies, especially artificial intelligence systems."

This change acknowledges that multiple AI system types present data protection concerns. Recommendation algorithms, facial recognition technology, and other automated decision-making tools beyond generative models warrant regulatory attention.

Consent rules postponed until 2027

The ANPD delayed work on consent as a legal basis for data processing from phase three to phase four. This moves the initiative from the first half of 2027 to the second half of that year.

Director Coutinho's vote noted that other ANPD initiatives address consent issues "in a cross-cutting manner," even when not their primary focus. The postponement also allows the agency to incorporate perspectives from Law 15.211/2025, preventing potential conceptual conflicts or overlapping interpretations.

Governance framework delayed

Best practices and governance rules shifted from phase two to phase four in the revised agenda. The ANPD cited dependencies on other foundational regulatory projects currently in development.

Specifically, work on governance frameworks depends on completing regulations about Data Protection Impact Assessments and data subject rights. The Coordenação-Geral de Fiscalização indicated these "baseline" projects must finish before addressing governance comprehensively.

The agency also emphasized the need for "quick and proactive actions on themes involving Law 15.211/2025," according to Technical Note 48/2025 from the normalization coordination office. Resource constraints and the urgency of child protection priorities influenced the sequencing decision.

Agency transformation context

The agenda revisions coincide with the ANPD's institutional evolution. Provisional Measure 1.317 from September 17, 2025, transformed the agency into a regulatory body with "functional, technical, decisional, administrative and financial autonomy."

The change grants the ANPD status as an independent regulatory agency under Law 13.848/2019, alongside authorities like ANATEL and ANVISA. This institutional upgrade expands the agency's enforcement powers, including authority to order establishment closures, seize goods, and request police assistance when inspection activities encounter obstruction.

The transformation also requires the ANPD to align its processes with the Law of Regulatory Agencies. A separate agenda item addresses revising the agency's internal regulatory procedures to ensure compliance with the new legal framework while potentially incorporating mechanisms for child and adolescent participation in rulemaking.

Methodology and public participation

The Coordenação-Geral de Fiscalização developed the enforcement map using criteria of risk, severity, timeliness, and relevance. The process began June 26, 2025, with consultation of ANPD technical units.

Technical Note 54/2025 documented the methodology and priorities before legal analysis by the Procuradoria Federal Especializada. That office issued favorable opinion 00060/2025 on October 6, 2025.

Resolution CD/ANPD 10 from December 5, 2023, established the timeline requirement. The regulation mandates submitting the Priority Themes Map for the 2026-2027 period and the Monitoring Cycle Report for 2024-2025 to the Directing Council by November 30, 2025, with approval by year-end.

The approved map addresses Articles 21-23 of Regulation CD/ANPD 1 from October 28, 2021. Those provisions establish requirements for enforcement planning documents, including decision-making records, objectives, performance indicators, execution schedules, and indications of necessary coordination with other public bodies.

Timeline

• June 26, 2025: Coordenação-Geral de Fiscalização requests input from ANPD technical units on enforcement priorities
• September 17, 2025: President signs Law 15.211/2025 establishing Digital Child and Adolescent Statute; Decree 12.622 designates ANPD as enforcement authority; Provisional Measure 1.317 transforms ANPD into regulatory agency
• October 6, 2025: Procuradoria Federal Especializada issues favorable legal opinion on priority map draft
• October 24, 2025: Process distributed to Director Lorena Coutinho after assignment lottery
• November 19, 2025: Coordenação-Geral de Normatização submits monitoring cycle report after director requests additional materials
• December 11, 2025: Director Coutinho signs vote approving revised enforcement priorities
• December 12, 2025: Director Miriam Wimmer votes approval
• December 22, 2025: Directors Iagê Miola and Waldemar Gonçalves Ortunho Junior complete votes, finalizing unanimous approval

For additional context, the European Data Protection Board evaluated Brazil's adequacy decision regarding LGPD framework compatibility with GDPR standards.

Summary

Who: Brazil's Agência Nacional de Proteção de Dados (ANPD) and its five-member Conselho Diretor, led by Director-President Waldemar Gonçalves Ortunho Junior, with the enforcement map drafted by the Coordenação-Geral de Fiscalização.

What: Approval of the Priority Themes Map for enforcement planning during 2026-2027, establishing four priority areas: data subject rights (especially biometric, health, financial data), child and adolescent protection in digital environments per Law 15.211/2025, government data sharing oversight, and artificial intelligence systems supervision. The map postponed work on consent legal basis and governance frameworks to late 2027.

When: The Conselho Diretor approved the map December 22, 2025, following process initiation June 26, 2025, and significant legislative changes September 17, 2025. The map governs enforcement activities through December 31, 2027.

Where: The enforcement priorities apply throughout Brazil's territory and to any provider offering products or services to Brazilian residents, regardless of the provider's physical location. The ANPD operates from Brasília in the Federal District.

Why: Law 15.211/2025 and Provisional Measure 1.317 fundamentally altered the ANPD's institutional status and regulatory scope. The Digital Child and Adolescent Statute created urgent new enforcement obligations regarding minor protection online, requiring rapid regulatory response before the March 2026 effective date. The transformation into a regulatory agency necessitated procedural updates and resource reallocation. Existing priorities like consent regulation and governance frameworks were postponed to accommodate the new child protection mandate while awaiting completion of foundational regulatory projects.