Legally binding version: Portuguese (pt-BR), governed by Brazilian law. This translation is provided for convenience.
Is your platform
ready for the ECA Digital?
Law 15.211/2025, Brazil's digital child protection law, has been in force since March 2026. Self-declaration of age is expressly prohibited. The law requires age assurance. CPFHub.io returns birthDate in the CPF lookup (name, gender, date of birth), where CPF is Brazil's individual taxpayer ID, so your system can calculate age. Full compliance is the platform's responsibility.
10%
of revenue in fines
R$ 50M
per infraction (cap, BRL)
Jan/27
full enforcement
Law No. 15.211 / 2025
What is the
ECA Digital?
The ECA Digital extends the 1990 Child and Adolescent Statute (ECA) to the online environment. Signed in September 2025 and in force since March 17, 2026, it is considered the most comprehensive online child protection law in the Americas.
The law became known as the Felca Law after a viral video by an influencer denounced the adultification of children on digital platforms, which sped up its approval in Congress.
Self-declared age expressly prohibited (art. 9, §1)
Mandatory parental supervision for users under 16
Behavioral advertising targeted at minors prohibited
Infinite scroll and autoplay limited for minors' accounts
Eroticized content involving children banned and punishable
Applies to any company with Brazilian users
Broad scope
Who needs to comply?
Any digital service likely to be accessed by minors in Brazil, including companies based abroad.
Art. 9, §1
What changed with the law
Prohibited since Mar / 2026
- "I am 18" or "I am of legal age" checkbox
- Date of birth field without verification
- Age confirmation pop-up
- Any method based only on the user's word
What the ANPD (Brazil's data protection authority) recognizes as valid
- CPF lookup (name, gender, birthDate) for your system to calculate ageCPFHub.io
Other methods recognized by the ANPD
- Document verification with biometrics
- Age estimation by AI analysis
GET /cpf
The law requires age assurance.
CPFHub.io returns birthDate.
No camera. No selfie. No document upload. The CPF lookup returns name, gender and date of birth. Your system calculates age, and full compliance is the platform's responsibility.
const cpf = '12345678909'
const res = await fetch(
`https://api.cpfhub.io/cpf/${cpf}`,
{
method: 'GET',
headers: {
'x-api-key': 'YOUR_API_KEY',
'Accept': 'application/json',
},
}
)
const { data } = await res.json()
// birthDate: DD/MM/YYYY, age calculated in your backend
const [day, month, year] = data.birthDate.split('/').map(Number)
const today = new Date()
let age = today.getFullYear() - year
if (
today.getMonth() + 1 < month ||
(today.getMonth() + 1 === month && today.getDate() < day)
) {
age -= 1
}
if (age < 18) {
// platform rule
}Name, gender and date of birth
GET /cpf/{cpf} returns name, gender and birthDate. No score, email or biometrics.
Age calculated in your system
You set the cutoff (18+, 16+). CPFHub.io does not return a ready-made age range.
No selfie, OCR or biometrics
A registry lookup. It is not biometric KYC (know your customer): the match rule stays in your backend.
SDKs and HTTP API
Official SDKs for Node.js and Python. On any other stack, call the HTTP API directly.
Compliance is the platform's job
The law requires age assurance. CPFHub.io does not deliver full compliance: the rule stays in your system.
Do not leave it for later
The penalties are severe
The sanctions follow a progressive scale. And note: the Public Prosecutor's Office (Ministério Público) can already act on civil liability since the law took effect, even before full ANPD enforcement.
Warning
With a 30-day deadline to fix the issue
Fine per user
From R$ 10 to R$ 1,000 per affected user
Fine on revenue
Up to 10% of the group's revenue (cap of R$ 50M per infraction)
Temporary suspension
Of activities in the national territory
Ban
Permanent prohibition on operating in Brazil (by court decision)
Timeline
The clock is ticking
Sep / 2025
Law No. 15.211/2025 signed into law
Mar / 2026
Law takes effect and self-declaration becomes illegal
Aug / 2026
ANPD publishes final technical standards
Jan / 2027
Full enforcement with fines and sanctions
Fines of up to R$ 50M per infraction take effect
FAQ
Frequently asked questions
What is the Felca Law / ECA Digital?
Law No. 15.211/2025, known as ECA Digital or the Felca Law, extends the Child and Adolescent Statute (ECA) to the digital environment. Signed in September 2025 and in force since March 17, 2026, it is considered the most comprehensive online child protection law in the Americas.
Is self-declared age still valid?
No. Art. 9, §1 of the law expressly prohibits self-declaration as an age verification method. "I am 18" checkboxes, date of birth fields without verification and confirmation pop-ups have been illegal since March 2026.
Does the law apply to companies outside Brazil?
Yes. Any digital service accessible to Brazilian users, regardless of where the company is based, is subject to the law. The logic is the same as the LGPD (Brazil's data protection law): the criterion is that the end user is in Brazil.
Does a CPF lookup replace compliance with the ECA Digital?
No. The law requires age assurance. CPFHub.io returns birthDate (with name and gender) so your system can calculate age. Full compliance, with policies, flows, parental consent and other obligations, is the platform's responsibility.
Is CPF-based verification accepted by the ANPD?
The accepted methods are defined by the ANPD, and its guidance may change. The CPF lookup provides the date of birth so your system can calculate age, but the choice of assurance method and final compliance rest with the platform. Confirm the current guidance with the ANPD and with your legal team.
What about users who do not have a CPF?
For users without a CPF, the law allows other verification methods recognized by the ANPD. CPFHub.io covers the CPF lookup (name, gender, date of birth). Contact our team to understand how it fits your product's profile.
When does enforcement with fines begin?
Full ANPD enforcement, with the power to apply the fines provided for, begins in January 2027. The Public Prosecutor's Office (Ministério Público) and the Ministry of Justice, however, can already act on civil liability since the law took effect in March 2026.
Is CPFHub.io compatible with the LGPD?
The CPFHub.io API returns name, gender and date of birth. We do not store biometric data and we do not perform selfie, OCR or biometric KYC. Use must have a legal basis. Full compliance is the platform's responsibility.
What is the deadline to comply?
The law is already in force. Compliance work should start now. The ANPD will publish final technical standards in August 2026 and full enforcement begins in January 2027. Companies that start today have enough time to integrate, test and adjust.
Next steps
Industry solutions and free API
CPFHub.io returns birthDate. Your system calculates age. See the fit by industry or start on the Free plan.
Age verification
How to check age from the date of birth in the CPF lookup, with a code example, limits and pricing.
Streaming
Per-profile age control based on the date of birth from the CPF lookup.
Adult content
A CPF lookup so your system can calculate legal age, with no selfie or OCR.
Social media
Age assurance with birthDate in your backend. Compliance is the platform's responsibility.
Free CPF API
50 credits/month, no card. GET /cpf returns name, gender and date of birth.
Look up a CPF and calculate
age in your system.
50 free credits to test. No credit card. No selfie or OCR.
The law requires age assurance. CPFHub.io returns birthDate, and full compliance is the platform's responsibility.