Experts emphasize that public authorities don’t impose or send ECA Digital-related fines to parents via WhatsApp, SMS, or email. Parents and guardians should remain alert.
The ECA Digital (Law No. 15,211/2025), which came into force in March 2026, protects children and adolescents online and holds companies offering digital products and services to this audience accountable, while also establishing guidelines for online content monetization. The new legislation and families’ legitimate concerns have created an opportunity for a new type of fraud: official-looking notices accusing parents and guardians of violations and demanding immediate payment via PIX, Brazil’s instant payment system.
The Digital Trust Map study by Certta, an intelligent verification hub, in partnership with Nexus – Research and Data Intelligence, analyzed posts published between January 1 and July 22, 2026. The dataset includes more than 60,000 mentions on X, Facebook, and Instagram, 44 million interactions, search-intent analyses on Google and Bing, and a qualitative study on Reddit. The topic “Minors and ECA Digital” generated approximately 1,000 organic mentions, divided into two main areas: how to verify young people’s ages to protect them, and accounts from people who fell victim to financial scams exploiting the law’s name.
How the ECA Digital fine scam works
According to Lilian Cintra, a lawyer and former National Secretary for Digital Rights at Brazil’s Ministry of Justice and Public Security, victims receive correspondence featuring symbols that imitate government branding, references to Law No. 15,211/2025, which established the ECA Digital, a protocol number, and technical language.
“Typically, the message accuses the family of exposing their child on social media, allowing them to use an inappropriate app, or permitting access to pornographic content. It then demands a ‘fine’ or ‘regularization fee’ within a matter of hours, threatening legal proceedings, a report to the Guardianship Council, or account blocking,” Lilian explains.
She also emphasizes that the most common channels are WhatsApp, SMS, email, and direct messages on social media, sometimes containing links to pages that imitate official websites.
How to verify whether a notice is legitimate
According to Roberto Ferlis, VP of Legal and Compliance at Certta, several practices are essential to verify whether a communication is official:
- Be suspicious of the method of contact. Public authorities do not collect fines through WhatsApp, SMS, or emails containing payment links, particularly when payment is requested via PIX and the message creates a sense of urgency.
- Do not click on the link you receive. Type the agency’s address directly into your browser and check whether the domain ends in gov.br.
- Check who will receive the money. A PIX key belonging to an individual or an unfamiliar company is a warning sign.
- Never send children’s documents, photos, or selfies to “regularize” the situation. This is precisely the kind of information scammers want to obtain.
- Report the number or profile directly through the platform.
What to do if you have already paid or shared personal information
Experts agree that the immediate response to such a message should be to make no payment, avoid clicking on links, and report the profile through the platform. However, if a parent or guardian has already made a payment, Lilian recommends taking the following steps:
- Contact your bank immediately and request a dispute through the MED (PIX Special Refund Mechanism). The sooner you act, the greater your chances of recovering the money.
- File a police report. In many Brazilian states, this can be done online through the relevant police department’s website.
- Change any passwords or credentials you disclosed and watch for further contact, as scammers often return with a second payment demand.
What penalties does the ECA Digital actually provide for?
Ferlis explains that the law was designed to hold companies offering digital products and services to children and adolescents accountable, not families. Penalties range from warnings accompanied by a deadline for corrective action to fines of up to 10% of the economic group’s revenue in Brazil, capped at R$50 million per violation. Companies may also face temporary suspension or even a ban on operating in the country.
Enforcement depends on administrative proceedings conducted by the ANPD (Brazil’s National Data Protection Authority).
“The company receives formal notice, has access to the matter under investigation, and can present its defense before any penalty is imposed. Citizens are not parties to these proceedings and do not receive fine notices,” the Certta executive explains.
Therefore, he stresses, any message demanding that a parent, guardian, or individual pay an ECA Digital fine is, by definition, a scam.
Nevertheless, Maria Mello, Digital Program Manager and head of the Criança e Consumo (Children and Consumption) program at Instituto Alana, points out that families do have child-protection duties under Brazil’s Federal Constitution and the Statute of the Child and Adolescent (ECA). Negligence may lead to accountability through other legal mechanisms, which is different from the ECA Digital guidelines directed at technology companies.
What the ECA Digital requires of companies
The law’s obligations apply to services likely to be accessed by children and adolescents. Ferlis summarizes the main requirements:
- Reliable age verification. Self-declaration, such as clicking an “I am over 18” button, is no longer sufficient.
- Parental supervision tools that technology companies must make available.
- More protective default privacy settings.
- Linking social media accounts belonging to minors under 16 to a legal guardian.
Ferlis also notes that when biometric data is used, safeguards must be even stronger because this is sensitive personal information.
“The idea is for age-verification technology to protect children without turning their data into a new source of risk,” he explains.
According to Ferlis, the debate is expected to advance through the end of 2026 as companies seek technical alternatives that meet security requirements without creating unnecessary barriers or compromising privacy. Options include document forensics, which assesses the authenticity of identification documents; age estimation; and biometric comparison between a user’s face and the photo on their identification document.
Mello also highlights additional obligations concerning minors’ data:
- Careful collection of children’s and adolescents’ personal information.
- Limits on exposing this information through recommendations and public profiles.
- Restrictions or prohibitions on using such data for commercial advertising.
- Tools to remove children’s content and personal data.
- Obtaining a judicial authorization when a child’s image is monetized as part of activities involving artistic child labor.
“At the heart of the debate surrounding the law, particularly regarding artistic child labor on the internet, is a resolution from Brazil’s National Council of Justice that guides juvenile court judges on the criteria to consider when issuing judicial authorization for this type of activity. It is also important to show that these are distinct but complementary developments. The CNJ resolution reinforces safeguards that are already well established for children participating in artistic work online, whether the parties involved are families, brands, or companies,” argues Mariana Mello.
How sharenting fuels scams
Sharenting - a term referring to parents’ excessive sharing of their children’s photos, routines, and personal information online - also poses a risk to children’s digital safety because it provides criminals with information they can exploit, according to Mariana Mello.
“This practice can encourage various forms of exploitation of children and adolescents in the digital environment. Information that initially appears harmless can be turned into actions that harm both children and their families,” she adds.
Names, nicknames, school photos, educational institutions, routines, and location data create vulnerabilities that can be exploited in digital scams and even threaten children’s physical safety. Information about relatives also allows criminals to map family relationships and impersonate someone close to the victim.
According to the Instituto Alana manager, parents and guardians should limit their children’s exposure online, while companies must effectively prevent shared information from becoming a treasure trove for criminals.
Prevention checklist
Frequently asked questions
What is the ECA Digital?
The ECA Digital is the common name for Law No. 15,211/2025, enacted in September 2025 and effective since March 17, 2026. The legislation aims to strengthen the protection of children and adolescents in the digital environment and establish guidelines for online content monetization. It applies directly to technology companies.
How can I tell whether an ECA Digital fine is a scam?
The penalties established by the law apply to companies, not families. A message demanding an “ECA Digital fine” from parents or guardians, requesting payment via PIX, and threatening immediate punishment is a warning sign of fraud that requires heightened caution.
How can I prove that a fine is illegitimate?
Experts recommend keeping messages, screenshots, sender information, and any payment receipts. Verify the alleged charge directly through the official channels of the agency mentioned, without using the links provided in the message. Keep these records to report the scam and file a police report.
What is the penalty for digital scams?
Online scams and fraud vary in form and severity, so there is no single law that establishes one penalty for every type of scam. Depending on the offense committed, sentences may range from four to ten years of imprisonment.
It is also worth noting that, in 2026, Law No. 15,397/2026 was approved, establishing harsher penalties for crimes such as theft, robbery, fraud, and electronic fraud, and criminalizing the use of so-called “money mule” accounts to move proceeds from fraudulent activities.
Want to follow how this issue evolves? Follow the Digital Trust section.
