EFF to Brazil’s ANPD: Data Privacy and Free Expression Must Underpin Platform Regulations

The Brazilian National Data Protection Agency (ANPD) bears significant responsibility in overseeing the implementation of new platform regulations. This year, the Electronic Frontier Foundation (EFF) has collaborated with the agency, offering feedback, submissions, and discussions to ensure that crucial safeguards are embedded in these rules.

ANPD is tasked with implementing and enforcing provisions of Law n. 15.211/2025, which governs the protection of children and adolescents online. While the law includes essential privacy protections, such as restricting targeted advertising based on the profiling of minors, it also mandates age verification mechanisms for accessing digital products and services.

Concerns have been raised about the accuracy and privacy implications of these age-gating technologies. Age verification systems often prove unreliable and intrusive, potentially leading to the blocking of websites that do not meet stringent legal standards. Inaccurate age verification may inadvertently block adults who lack valid identification, facial variations, or physical disabilities.

EFF has emphasized the need for a more targeted approach to age verification obligations, specifying that restrictions should only apply to content deemed inappropriate for children and adolescents, guided by existing regulatory categories. The organization has cautioned against the blanket application of age assurance measures, advocating for robust safeguards to prevent subjective and indiscriminate interpretations.

EFF also highlighted that zero-knowledge proofs, while valuable, do not guarantee comprehensive user privacy. Additional requirements, such as unlinkability, selective disclosure, and on-device processing, are essential for enhancing privacy protection. The EFF also pressed for greater clarity on the law's scope, seeking specific definitions of which providers are subject to its obligations and the treatment of non-dominant players like federated networks and free software applications.

Without this clarity, the law could disproportionately impact smaller platforms and non-major players. In addition to the ANPD's role in regulating age verification, EFF has commented on Brazil's revised intermediary liability rules. Following a Supreme Court decision and presidential decrees, the country has moved to a notice-and-takedown system, introducing duty of care obligations for intermediaries.

EFF stressed the importance of preventing censorship of protected content and ensuring robust appeal mechanisms for restricted posts. The organization cautioned against overreliance on AI-driven content moderation, called for precise application of concepts such as duty of care and systemic failure, and resisted the normalization of platform blocking.

Lastly, the EFF urged ANPD to implement critical transparency and accountability measures, safeguarding public oversight over the new regulatory regime. The EFF is adamant that platform accountability under the new rules hinges on the accountability demonstrated by platforms and state institutions. Upholding fundamental rights, including freedom of expression, privacy, and data protection, is paramount to ensure that intended protections do not inadvertently result in harm.

ANPD must commit to these principles and ensure that the new regulations do not have unintended negative consequences.