Brazil
◆Binding
Binds Processing agents (controllers and operators) under LGPD Art. 3 — processing carried out in Brazil, processing aimed at offering goods or services to, or processing data of, individuals located in Brazil, or data collected in Brazil, regardless of where the agent or the data is based. Impact tier: all entities.. Data subjects may request review of decisions taken solely on the basis of automated processing of personal data that affect their interests, expressly including decisions that define personal, professional, consumer or credit profiles or aspects of personality. On request the controller must give clear and adequate information about the criteria and procedures used for the automated decision, subject to trade and industrial secrecy; where secrecy is invoked the ANPD may audit the processing for discriminatory effects.
Art. 20 as amended by Lei 13.853/2019: the original "por pessoa natural" wording was removed, so this is a right to review, NOT a guaranteed human-review right. The proposed reinstatement (Art. 20 s.3) was vetoed. Commencement traced through Art. 65: Lei 13.853/2019 set Art. 65 II at 24 months after publication (LGPD published DOU 15.8.2018); MP 959/2020 (DOU 29.4.2020, in force on publication) art. 4 pushed Art. 65 II to 3 May 2021; Congress dropped that amendment on conversion, and the conversion law Lei 14.058/2020 (17 Sept 2020, DOU 18.9.2020, in force on publication) contains no amendment to Lei 13.709 — so the postponement fell away and the general articles, including Art. 20, took effect on 18 September 2020. The administrative sanctions regime (Arts. 52-54) commenced separately on 1 August 2021 under Art. 65 I-A, inserted by Lei 14.010/2020. Coverage-symmetry check 2026-08-14: no ANPD normative act specifically regulating AI or automated decision-making — a DOU sweep of "RESOLUÇÃO CD/ANPD" and of ANPD acts mentioning inteligência artificial / decisões automatizadas returned only internal-organisation and international-transfer resolutions (e.g. Res. 32/2026 EU adequacy, Res. 33/2026 staffing). Brazil's AI-specific bill remains proposed — see br-pl2338.
Stated maximum penalty — LGPD Art. 52: warning; simple fine up to 2% of the private-law entity's, group's or conglomerate's Brazilian turnover in its last financial year, excluding taxes, capped in total at R$50,000,000 per infraction; daily fine; publicisation; blocking, deletion, partial or total suspension of processing or of the database (up to 6 months, renewable); partial or total prohibition of processing activities. ANPD enforcement; sanctions applicable since 1 August 2021 (Art. 65 I-A).
Brazil
◆Binding
Binds Suppliers of information-technology products or services (including internet application providers, social networks, app stores, electronic games and child-monitoring products) that are directed at children and adolescents or likely to be accessed by them, offered in Brazilian territory, including foreign companies, which must keep a legal representative in Brazil (Art. 40). Art. 39 modulates the duties in Arts. 6, 17, 18, 19, 20, 27, 28, 29, 31, 32 and 40 by the product's characteristics and functionalities, the provider's degree of interference over content, user numbers and size, and exempts editorially-controlled services and licensed-content providers that meet the four conditions in Art. 39 s.1. Impact tier: all entities, modulated by size and degree of content control.. Providers of information-technology products or services directed at, or likely accessed by, children and adolescents must give parents control over personalised recommendation systems, including the option to switch them off, and must regularly review the artificial-intelligence tools in the service with the participation of specialists and competent bodies against technical criteria that ensure their safety and suitability for use by minors, with non-essential functionalities capable of being disabled. Behavioural profiling of child and adolescent users for advertising is prohibited, as is profiling-based ad targeting and the use of emotional analysis, augmented, extended or virtual reality for that purpose. Where content is removed, the provider must tell the user whether the content was identified by human or automated analysis.
Lei 15.211/2025 ("ECA Digital"), sanctioned 17 September 2025 and published DOU 17.9.2025 extra edition. Art. 41-A originally set entry into force at six months after publication (inserted by MP 1.319/2025); the version now in force, inserted by Lei 15.352/2026, fixes the date expressly: "Esta Lei entra em vigor em 17 de março de 2026." Scope call 2026-08-14: kept in the tracker because the statute imposes express algorithmic-system duties rather than only platform-safety duties — Art. 17 s.4 V (control over personalised recommender systems with an off switch as a default parental-supervision setting), Art. 17 s.4 VIII (regular expert review of AI tools in the service), Art. 30 II (disclosure of whether a removal decision came from human or automated analysis), Art. 22 (ban on profiling for ad targeting and on emotional analysis / AR / XR / VR for that purpose) and Art. 26 (ban on building behavioural profiles of minors from personal, group or collective data, including data obtained in age verification, for advertising). Art. 24 s.3 age-assurance and Art. 27 automated illicit-content detection duties feed the separate transparency-report obligation tracked as br-lei15211-art31-report. Enforcement: Art. 34 gives the autonomous administrative authority for the protection of children's and adolescents' rights in the digital environment supervisory and complementary-rulemaking power; Decreto 12.622/2025 designates the ANPD as that authority and Decreto 12.880/2026 (DOU 18.3.2026 extra edition) is the implementing regulation. Distinct from br-lgpd-art20, which is a data-subject right under the LGPD.
Stated maximum penalty — Art. 35: warning with up to 30 days to take corrective measures; simple fine of up to 10% of the economic group's Brazilian turnover in its last financial year or, absent turnover, R$10 to R$1,000 per registered user, capped in total at R$50,000,000 per infraction; temporary suspension of activities; prohibition of activities. Fines and warnings are applied by the ANPD; suspension and prohibition by the Judiciary (Art. 35 s.5) and enforced if needed by blocking orders to connectivity providers, IXPs and DNS resolvers (Art. 35 s.6). A foreign company's Brazilian branch or establishment is jointly liable for the fine (Art. 35 s.2); fine amounts are indexed annually to the IPCA (Art. 35 s.4).
Brazil
◆Binding
Binds Internet application providers directed at or likely accessed by children and adolescents with more than 1,000,000 registered users in that age band with an internet connection in Brazilian territory. Exempt: providers below that threshold, and editorially-controlled services and licensed-content providers meeting the four conditions in Art. 39 s.1 (Despacho Decisório CD/ANPD 122/2026 item VII). Impact tier: enterprise.. Internet application providers directed at, or likely accessed by, children and adolescents with more than 1,000,000 registered users in that age band connecting from Brazil must publish semi-annual reports in Portuguese on their own website. The report must cover the complaint channels and investigation systems, the number of complaints received, the volume of content and account moderation by type, the measures used to identify child accounts on social networks under Art. 24 s.3 and to identify illicit acts under Art. 27, technical improvements for personal-data protection and privacy and for ascertaining parental consent under LGPD Art. 14 s.1, and the methods used and results of impact assessments and of the identification and management of risks to the safety and health of children and adolescents. Providers must also give academic, scientific, technological, innovation and journalistic institutions free access to the data needed to research the service's impact on minors.
Art. 31 of Lei 15.211/2025 has been in force since 17 March 2026 (Art. 41-A as amended by Lei 15.352/2026), but the statute only says the reports are semi-annual and sets no publication date. Despacho Decisório CD/ANPD 122/2026 (DOU 11.8.2026, Section 1, p. 59) fixes the calendar until specific regulation supervenes: the time runs from entry into force on 17 March 2026; the first report covers 1 January to 30 June 2026, and providers without data for January and February may limit it to 17 March to 30 June 2026; the first report must be published by 17 September 2026 (item III); from the second report the periods follow the civil semesters, published by 1 August for the first semester and by 1 February for the second (item IV). Art. 45 of Decreto 12.880/2026 adds, under Art. 31 II, the number of notifications received by category and proportional data on how they were followed up. Art. 47 of the decree requires the child-safety-and-health impact assessment behind Art. 31 VII, with a plain-language summary made public, and lets an ANPD act set its minimum content and periodicity. The ANPD recommends emailing a copy of each report to monitoramento@anpd.gov.br at publication (item VIII). Tracked separately from br-lei15211-eca-digital because 17 September 2026 is a distinct near-term deadline.
Stated maximum penalty — Art. 35: warning with up to 30 days to correct; simple fine up to 10% of the economic group's Brazilian turnover in its last financial year or, absent turnover, R$10 to R$1,000 per registered user, capped at R$50,000,000 per infraction; temporary suspension of activities; prohibition of activities. ANPD applies the warning and fine (Art. 35 s.5).
Brazil
▲Proposed
Binds Would bind AI providers / deployers once enacted. Risk-based, EU-style framework; Senate-approved Dec 2024, now before the Chamber of Deputies.
Senate-approved Dec 2024; before the Chamber of Deputies Special Committee. Rapporteur Dep. Aguinaldo Ribeiro (PP-PB) has not yet presented opinion ("parecer"); no plenary vote scheduled as of Jul 28, 2026. 35 related bills consolidated. Plenary vote not expected before late 2026.
Stated maximum penalty — Bill: up to R$50M / 2% revenue