Brazil reshaped its children's data protection regime with the Digital ECA framework. For SaaS with Brazilian users (or with LATAM expansion plans), this is the most consequential 2026 update from the region. Three default settings change and the policy/product implications are significant.

What changed

1. Privacy-by-default for minors

Any account suspected of belonging to a minor must default to the most privacy-protective settings. No public profile by default, no targeted ads, no behavioral tracking. The user must actively opt in to lower the protection.

2. Mandatory DPIA for profiling

If your SaaS profiles minors for any reason (recommendations, ads, content ranking), a DPIA is mandatory and must be made available to the regulator on request.

3. Hard limit on profiling

Behavioral profiling for advertising purposes is now prohibited for users under 18, regardless of consent. This is stricter than GDPR (which allows it with parental consent under 16).

FeatureBeforeAfter Digital ECA
Profile visibilityPublic defaultPrivate default
Targeted adsWith consentProhibited under 18
Behavioral trackingWith consentLimited even with consent
DPIAOptionalMandatory for profiling

What to add to your policy and product

  • Age estimation at signup, with privacy-by-default if under 18
  • Updated privacy policy section for Brazilian users with the Digital ECA framework specifics
  • DPIA on file for any profiling feature touching minors
  • UI changes: ads disabled for under-18, profile private by default

The Digital ECA framework predicts where the rest of LATAM goes: Mexico, Colombia and Argentina have similar drafts in flight. SaaS that builds for Brazil now is well-positioned for the regional wave.

Conclusion

LATAM regulation is no longer a regional footnote. Brazil's Digital ECA is the new floor for any SaaS with users in the region. Adjusting privacy defaults for minors is the highest-leverage move for the next two quarters.

To generate a privacy policy that already includes the Brazilian Digital ECA section, try Termerly free.