The study Age Verification Practices in 25 Digital Services Used by Children in Brazil, from 2025, reveals that 84% of the digital services most used by children in Brazil did not verify age at the moment of account creation, corresponding to 21 of the 25 platforms analyzed.
The reality highlighted in the study precedes the Child and Adolescent Digital Statute Law (Digital ECA), which came into effect in Brazil this Tuesday (17).
Study
The unprecedented study was conducted by the Brazilian Internet Steering Committee (CGI.br) and the .br Information and Coordination Center (NIC.br). The preliminary version was released during the Digital ECA Seminar – Protection of Children and Adolescents: Global and Multilateral Perspectives for Implementing the Law, this Wednesday (18), in Brasília.
The evaluated services include those specific to children, such as YouTube Kids, and others accessible to this audience, such as social networks, messaging (WhatsApp and others), generative artificial intelligence, and online games.
Services aimed at adults, betting sites, dating sites, and virtual app stores were also investigated.
In most cases analyzed, age verification occurs later, to unlock specific features, such as live streams or monetization.
Digital ECA
The Digital ECA or Felca Law aims to protect children and adolescents in the digital environment, such as social networks, electronic games, video services, and virtual stores of products and services targeted at this audience.
Among the rules established by the new law is the prohibition of simple self-declaration of age, usually through date of birth or checking a selection box.
In practice, the platform cannot rely solely on the word of the person creating the new account.
Starting this week, the new legislation requires parental supervision and that information technology services adopt age verification mechanisms for access to content and use of their products and services.
Verification
The study reveals that nearly half of the platforms, that is, 11 out of 25, including social networks and generative AIs (Gemini and ChatGPT), use third-party companies to perform this check at some point in the user’s navigation: when opening the account, later verification to access certain features, or if suspicious activity is detected.
Sending an official document is the most common verification method, used by 13 of the 25 services analyzed.
To estimate age without documents, the use of selfies (photo or video) is the practice of 12 of the studied platforms.
Other methods, such as credit card, email address, and parental consent, are also used for age verification.
Minimum Age
The study concludes that the protection of children and adolescents is still reactive and fragmented. Age verification varies according to the business model.
The experts’ analysis found discrepancies between the minimum ages declared or recommended by the services themselves and the ages required by app stores.
In online games, although the minimum age required varies from 13 years (Minecraft and Fortnite, for example) to 18 years (such as Roblox and PlayStation), protection is based on parental supervision tools and age range settings.
App stores (Apple Store and Google Play) report minimum ages of 13 to 16 years. However, they do not block access during registration, limiting themselves to offering control resources so that parents and guardians can monitor downloads.
To access any social network (Facebook, Instagram, X, YouTube, and Discord), the user must be at least 13 years old.
However, social networks do not verify age at registration, rely on self-declaration, and allow parental authorization for features and content until users below the minimum indicated age reach 18 years.
Officially, the WhatsApp messaging service requires 13 years for use. In practice, access is allowed only by linking to a cell phone number, without any request for information about the user’s age.
Marketplace networks (such as Mercado Livre and Amazon) aimed at adults set a minimum age of 18 years. However, the age barrier is easily circumvented because the system considers self-declaration valid at registration and does not require age verification.
In cases of financial fraud prevention, identity verification is done later.
Services related to pornography consider only self-declaration for spectator users. But if the user wants to upload content to their local device (computer, cell phone), age proof will be required.
Currently, the reality is one of open doors in dating services, because most do not require age proof at registration, relying only on the user’s self-declaration.
Blocking or requiring documents occurs only proactively when the system detects suspicious behavior or complaints that the profile belongs to someone under 18.
Betting sites are the only ones that demonstrate initial rigor and already require verification that the internet user is 18 years old right at registration. The so-called bets use third-party services for bettor age verification.
In the context of digital services specifically targeted at children, the study reveals a more flexible access model. Only a simple age estimation mechanism is used, usually a basic math challenge of adding numbers.
In this logic, if the user can solve the sum, they have sufficient cognitive maturity to be the responsible party.
Actions
The mapping concluded that only eight of the 25 digital services declare proactive action in identifying users below the minimum age.
In case of non-compliance with the minimum age policy, account suspension is reported by the platforms as the main sanction, which occurred in 17 of the services researched in total.
However, deletion of data after account suspension for users who did not comply with the rule is not general practice. Only three companies do it.
Supervision
Regarding family supervision of children and adolescents, the research data reveal that, although most of the analyzed services (60%, or 15 out of 25) already provide control mechanisms for parents and guardians, the functioning of these tools is still passive.
In 14 of the 15 services that offer the feature, protection is not activated by default.
In practice, this means that security requires parents or guardians to take the initiative to search for, configure, and actively activate the tools within the platforms to ensure monitoring of minors.
Transparency
Only six of the 25 available services have published transparency reports with specific detailing for Brazil.
The study points out that only one transparency report has data on the application of the minimum age policy in Brazil.
In addition to technical barriers, the study highlights the difficulty in understanding usage rules due to incomplete information scattered across dozens of pages and fragmented, redirects to broken links, as well as usage policies without translation to Portuguese.
The Brazilian Internet Steering Committee (CGI.br) reported that it will soon make available the full version of the study Age Verification Practices in 25 Digital Services Used by Children in Brazil.
Source: Agência Brasil