本页法律文本以英文提供，仅供参考。具有法律约束力的是受巴西法律管辖的葡萄牙语（pt-BR）版本。
Full enforcement in Jan / 2027
Is your platform
ready for the ECA Digital?
In force since March 2026, Law 15.211/2025 bans self-declared age. With a CPF lookup (Brazil's individual taxpayer ID), your system receives the date of birth and calculates age.
10%
of revenue in fines
R$ 50M
per infraction (cap, BRL)
Jan/27
full enforcement
Law No. 15.211 / 2025
What is the ECA Digital?
Known as the Felca Law, Law 15.211/2025 extends the Child and Adolescent Statute (ECA) to the online environment. It was signed in September 2025 and has been in force since March 17, 2026.
Self-declared age expressly prohibited (art. 9, §1)
Mandatory parental supervision for users under 16
Behavioral advertising targeted at minors prohibited
Infinite scroll and autoplay limited for minors' accounts
Eroticized content involving children banned and punishable
Applies to any company with Brazilian users
Broad scope
Who needs to comply?
Any digital service likely to be accessed by minors in Brazil, including companies based abroad.
Art. 9, §1
What changed with the law
Prohibited since Mar / 2026
- "I am 18" or "I am of legal age" checkbox
- Date of birth field without verification
- Age confirmation pop-up
- Any method based only on the user's word
Where CPFHub.io fits in the flow
CPF lookup (name and date of birth) for your system to calculate age, combined with proof that the user is the holder of the CPF
Methods that prove CPF ownership
- Document verification with biometrics
- Age estimation by AI analysis
GET /cpf
The law requires age assurance. CPFHub.io returns birthDate.
No camera, selfie or document upload. The lookup returns name, gender and date of birth; the age rule and compliance stay with the platform.
const cpf = '12345678909'
const res = await fetch(`https://api.cpfhub.io/cpf/${cpf}`, {
headers: { 'x-api-key': 'YOUR_API_KEY' },
})
const { data } = await res.json()
// birthDate: DD/MM/YYYY, age calculated in your backend
const [day, month, year] = data.birthDate.split('/').map(Number)
const today = new Date()
let age = today.getFullYear() - year
if (
today.getMonth() + 1 < month ||
(today.getMonth() + 1 === month && today.getDate() < day)
) {
age -= 1
}
if (age < 18) {
// platform rule
}Name, gender and date of birth
GET /cpf/{cpf} returns name, gender and birthDate. No score, email or biometrics.
Age calculated in your system
You set the cutoff (18+, 16+). CPFHub.io does not return a ready-made age range.
CPF lookup: no selfie or biometrics
A registry lookup, with the match rule in your backend. For selfie, document and liveness checks, use Identity Verification (KYC).
Do not leave it for later
ECA Digital fines and sanctions
Sanctions are progressive. Public prosecutors can already act since the law took effect, before full ANPD enforcement.
- 01
Warning
With a 30-day deadline to fix the issue
- 02
Fine per user
From R$ 10 to R$ 1,000 per affected user
- 03
Fine on revenue
Up to 10% of the group's revenue (cap of R$ 50M per infraction)
- 04
Temporary suspension
Of activities in the national territory
- 05
Ban
Permanent prohibition on operating in Brazil (by court decision)
Timeline
ECA Digital deadlines
Sep / 2025
Law No. 15.211/2025 signed into law
Mar / 2026
Law takes effect and self-declaration becomes illegal
Jan / 2027
Full enforcement with fines and sanctions
Fines of up to R$ 50M per infraction take effect
常见问题
常见 问题
What is the Felca Law / ECA Digital?
Law No. 15.211/2025, known as ECA Digital or the Felca Law, extends the Child and Adolescent Statute (ECA) to the digital environment. Signed in September 2025 and in force since March 17, 2026, it is considered the most comprehensive online child protection law in the Americas.
Is self-declared age still valid?
No. Art. 9, §1 of the law expressly prohibits self-declaration as an age verification method. "I am 18" checkboxes, date of birth fields without verification and confirmation pop-ups have been illegal since March 2026.
Does the law apply to companies outside Brazil?
Yes. Any digital service accessible to Brazilian users, regardless of where the company is based, is subject to the law. The logic is the same as the LGPD (Brazil's data protection law): the criterion is that the end user is in Brazil.
Does a CPF lookup replace compliance with the ECA Digital?
No. The law requires age assurance. CPFHub.io returns birthDate (with name and gender) so your system can calculate age. Full compliance, with policies, flows, parental consent and other obligations, is the platform's responsibility.
Is CPF-based verification accepted by the ANPD?
The accepted methods are defined by the ANPD, and its guidance may change. The CPF lookup provides the date of birth so your system can calculate age, but the choice of assurance method and final compliance rest with the platform. Confirm the current guidance with the ANPD and with your legal team.
What about users who do not have a CPF?
For users without a CPF, the law allows other verification methods recognized by the ANPD. CPFHub.io covers the CPF lookup (name, gender, date of birth). Contact our team to understand how it fits your product's profile.
What is the deadline to comply?
The law has been in force since March 2026, so compliance work should start now. Full ANPD enforcement, with fines, begins in January 2027, but public prosecutors and the Ministry of Justice can already pursue civil liability since the law took effect.
Is CPFHub.io compatible with the LGPD?
The CPFHub.io API returns name, gender and date of birth. A CPF lookup involves no selfie, OCR or biometrics. If you need liveness and document checks, use Identity Verification (KYC). Use must have a legal basis. Full compliance is the platform's responsibility.
还有疑问？
联系我们