The survey Age Verification Practices in 25 Digital Services Used by Children in Brazil, from 2025, reveals that 84% of the digital services most used by children in Brazil did not verify age at the moment of account creation, corresponding to 21 of the 25 platforms analyzed.
The reality highlighted in the research predates the Child and Adolescent Digital Statute Law (Digital ECA), which came into effect in Brazil this Tuesday (17).
Study
The unprecedented study was conducted by the Brazilian Internet Steering Committee (CGI.br) and the .BR Information and Coordination Center (NIC.br). The preliminary version was released during the Digital ECA Seminar – Protection of Children and Adolescents: Global and Multistakeholder Perspectives for Implementing the Law, this Wednesday (18), in Brasília.
The services evaluated include those specific to children, such as YouTube Kids, and others accessible to this audience, such as social networks, messaging (WhatsApp and others), generative artificial intelligence, and online games.
Adult-oriented services, betting sites, dating services, and virtual app stores were also investigated.
In most cases analyzed, age verification occurred later, to unlock specific features such as live streams or monetization.
Digital ECA
The Digital ECA or Felca Law is aimed at protecting children and adolescents in the digital environment, including social networks, electronic games, video services, and virtual stores for products and services targeted at this audience.
Among the rules set by the new law is the prohibition of simple self-declaration of age, typically by entering a birth date or checking a selection box.
In practice, platforms cannot rely solely on the word of the person creating the new account.
Starting this week, the new legislation mandates parental supervision and requires information technology services to adopt age verification mechanisms for content access and use of their products and services.
Verification
The study reveals that nearly half of the platforms, or 11 out of 25, including social networks and generative AIs (Gemini and ChatGPT), use third-party companies to perform this check at some point during user navigation: at account signup, later for accessing certain features, or if suspicious activity is detected.
Sending an official document is the most common verification method, used by 13 of the 25 services analyzed.
To estimate age without documents, selfies (photo or video) are used by 12 of the studied platforms.
Other methods, such as credit cards, email addresses, and parental consent, are also employed for age verification.
Minimum Age
The study concludes that protection for children and adolescents remains reactive and fragmented. Age verification varies by business model.
The experts’ analysis found discrepancies between the minimum ages stated or recommended by the services themselves and those required by app stores.
In online games, minimum ages range from 13 (Minecraft and Fortnite, for example) to 18 (Roblox and PlayStation), with protection relying on parental supervision tools and age-based settings.
App stores (Apple Store and Google Play) list minimum ages of 13 to 16. However, they do not block signup, instead offering parental controls for monitoring downloads.
Social networks (Facebook, Instagram, X, YouTube, and Discord) require users to be at least 13.
However, they do not verify age at signup, rely on self-declaration, and permit parental authorization for features and content until underage users reach 18.
Officially, WhatsApp requires 13 for messaging service use. In practice, access requires only linking a cell phone number, with no age information requested.
Adult marketplace networks (Mercado Livre and Amazon) set a minimum age of 18. Yet, the age barrier is easily bypassed via self-declaration at signup, without verification.
Identity checks occur later for financial fraud prevention.
Pornography services rely on self-declaration for viewers. Uploading content requires age proof.
Dating services currently have open entry, trusting self-declaration without proof at signup.
Blocks or document requests happen only if suspicious behavior or reports indicate a profile belongs to someone under 18.
Betting sites are the only ones with upfront rigor, requiring 18+ verification at signup via third-party services.
For child-specific digital services, the study shows flexible access using simple age estimation, like basic math addition challenges.
If the user solves it, they are deemed cognitively mature enough to be the account holder.
Actions
The mapping found that only eight of the 25 digital services proactively identify underage users.
Account suspension is the main sanction for minimum age violations, reported by 17 services.
However, data deletion post-suspension is not standard; only three companies do it.
Supervision
On family supervision of children and adolescents, the survey shows that most services (60%, or 15 of 25) offer parental controls, but they are passive.
In 14 of those 15, protections are not enabled by default.
Parents must actively seek, configure, and activate them for monitoring.
Transparency
Only six of 25 services publish Brazil-specific transparency reports.
Just one includes data on minimum age policy enforcement in Brazil.
Beyond technical barriers, usage rules are hard to grasp due to scattered, incomplete info across pages, broken links, and policies untranslated to Portuguese.
The Brazilian Internet Steering Committee (CGI.br) said it will soon release the full study Age Verification Practices in 25 Digital Services Used by Children in Brazil.
Source: Agência Brasil