EFF to Brazil’s ANPD: Data Privacy and Free Expression Must Underpin Platform Regulations

ANPD plays a pivotal role in detailing and applying obligations set in Law n. 15.211/2025, which established rules for protecting children and adolescents in the digital space.

While the law contains important privacy safeguards—such as prohibiting advertising based on profiling of underage users—it also created mandatory age assurance mechanisms for accessing digital products and services. EFF has raised alarms about the privacy and free expression issues surrounding age-gating the internet, noting that verification technology is often inaccurate and privacy-invasive.

Age Verification Concerns

The organization highlighted how current age assurance methods risk wrongly walling off adults with no valid IDs, facial differences, physical disabilities, and other vulnerable groups. In the UK, providers disproportionately restricted several counseling, support and mental health sites under the Online Safety Act, demonstrating potential overreach.

EFF urged ANPD to avoid a blanket approach to age assurance obligations, recommending that restrictions apply only to products and services inadequate or prohibited to children according to existing regulatory categories. The organization stressed the need for robust protections against subjective and overbroad interpretations.

Technical Safeguards

The EFF submission emphasized that zero knowledge proofs alone fail to ensure strong user privacy. The organization explained why additional requirements—such as unlinkability, selective disclosure, batch issuance and processing on device—are crucial for achieving greater protection levels.

Minimum information being shared to the verifier and no "phoning home" to the issuer of a user's accepted credentials are conditions that prevent actions like collusion and data sharing about the user, according to EFF's technical recommendations.

Regulatory Scope

The advocacy group also called for more clarity on which providers are covered by the law's obligations, emphasizing the importance of treating non-dominant players like federated networks and free software applications differently. Without such clarity, regulations could negatively impact beyond gaming and major platforms that are the main targets.

Regarding Brazil's new internet intermediary rules, EFF urged measures to prevent censorship of protected content, including ensuring solid means for appeals of restricted posts and avoiding overreliance on AI-based content moderation. The organization also warned against normalizing the blocking of platforms and websites.

As EFF stated, "platform accountability under the new rules ultimately hinges on how accountable its enforcement will be by platforms and state institutions." The organization urged ANPD to uphold rigorous commitment to fundamental rights, including freedom of expression, privacy and data protection, to ensure intended protections don't lead to harms.