On August 12, 2026, the duty of care of the Digital ECA ceased to be a doctrinal thesis: Discord was given three business days to shut down an entire functionality in Brazil.
The order came from the ANPD (National Data Protection Authority), as a preventive measure, and covered Go Live and all equivalent resources for transmission, retransmission, mirroring, synchronized playback, and screen sharing, including via APIs and integrations.
The company complied and then appealed. The appeal discusses the agency's competence and the scope of the measure, not the quality of the moderation. Those who follow regulation notice the shift: the discussion moved from the published content to the product design.
The duty of care under the Digital ECA (Brazilian Statute for Children and Adolescents) is the platform's obligation to prevent and mitigate foreseeable risks to children and adolescents within the service's architecture itself, and not merely to react to illicit content after being notified. Article 6 of Law 15.211/2025, the Digital ECA, mandates prevention, security from the design stage, and continuous risk management, with Article 8, I, requiring prior assessment of the risks generated by the service itself. Compliance is then measured by engineering and governance choices, not by the average response time to complaints.
What did the ANPD decide, and on what basis?
The investigation was launched on August 7, 2026, following findings regarding the use of the platform in serious violations against children and adolescents, including violence, harassment, and encouragement of self-harm and suicide.
The incident that triggered the case involved a 13-year-old girl who died on June 22, 2026, after being manipulated during a live stream watched by over two hundred users. According to information provided by the company itself to the agency, the broadcast took place on a private server with end-to-end encryption.
The quantitative context came from SaferNet Brasil: 406 notifications involving the platform between January and July 2026, compared to 264 in the same period of 2025, an increase of 54%.
On August 12, the ANPD (National Data Protection Authority) ordered the suspension within three business days, with a ten-business-day appeal period. The suspension has no fixed end date: it remains in effect until the company proves reasonable measures, from the conception and throughout the operation, to prevent and mitigate the identified risks.
Article 35 of the Digital ECA (Statute of Children and Adolescents) provides for a fine of up to R$ 50 million per infraction, which gives an idea of the sanctioning risk that was only hinted at in this phase.
The duty of care of the Digital ECA is architecture, not a complaint flow.
The agency's technical report did not simply point out a poor result. It attacked three mechanisms that the platform presented as safeguards and explained why each one fails in the specific scenario of live streaming in an enclosed environment.
The behavioral detection system produced a false negative precisely in the episode that triggered the inspection. A system that fails to trigger in the most serious case does not support the claim of due diligence.
User reporting depends on someone within the broadcast recognizing the violation and reporting it. On closed servers, often controlled by those committing the illegal act, the premise that there will be a willing whistleblower simply does not hold true.
Parental supervision operates through configuration and subsequent reporting. Neither function addresses a risk that materializes in real time, during the transmission itself.
Adding to this picture is a conduct element that weighs heavily in the due diligence assessment: the investigation examined changes to the platform's safeguards close to the time the new law came into effect. Moves to reduce protection on the eve of a regulatory milestone tend to be interpreted as an aggravating factor, not as a neutral product decision.
The reasoning is relevant far beyond Discord. It establishes that the adequacy of a control is measured against the concrete risk vector of the product, not against the list of features available in the security panel.
Cryptography and the need for surrogate controls
The most difficult part of the case is here, and it's important to state it precisely so as not to caricature the decision.
The ANPD (Brazilian National Data Protection Authority) did not prohibit end-to-end encryption nor did it declare the technology incompatible with the ECA Digital (Brazilian Statute for Children and Adolescents). The argument was different: the architecture chosen by the company made centralized mechanisms for analyzing audiovisual content and detecting violations in real time unfeasible.
The conclusion the agency drew from this is the thesis that will be cited in the coming years. When a legitimate technical choice eliminates a line of protection, the supplier needs to demonstrate equivalent effective substitute controls.
The agency acknowledged that the Digital ECA adopts a technologically neutral regulatory model. Technological neutrality, in the interpretation adopted, means freedom of means combined with the burden of demonstrating results, and not exemption from results.
There is a real tension here, and it remains unresolved. The equivalence standard still lacks a regulated metric, and the discussion about the extent to which the duty to detect coexists with guarantees of confidentiality of communications does not end with a technical note.
The measure came ahead of the agency's own schedule.
This is the point that most of the coverage has dealt with in a rushed manner.
The Digital ECA (Statute of Children and Adolescents) came into effect on March 17, 2026, a deadline set by Law 15.352/2026, the same law that transformed the ANPD (National Data Protection Authority) into a regulatory agency. The agency's competencies on the matter stemmed from Decree 12.622/2025.
The schedule released by the ANPD itself foresees three stages. Stage I, starting in March 2026, focused on preliminary guidance regarding age verification and monitoring of app stores. Stage II, which began in August 2026, opened a window for adaptation between August and November, with updates to the inspection and sentencing regulations scheduled for November 2026. Stage III, starting in January 2027, is the sanctioning phase.
The measure against Discord was issued within the appropriate timeframe. There is no contradiction, and the distinction is technical: a preventive measure is a precautionary step in the face of imminent risk, not an administrative sanction.
The basis invoked was Article 45 of Law 9.784/1999, combined with Article 32 of Resolution CD/ANPD No. 1/2021, which allows for preventive measures not expressly listed in the regulatory framework. The note itself recorded that the oversight regulations, originally designed for the competencies of the LGPD (Brazilian General Data Protection Law), are under review to incorporate the attributions of the ECA Digital (Brazilian Statute of Children and Adolescents).
The question of proportionality remains open. Suspending an entire functionality and ordering the implementation of specific safeguards are responses of very different intensity, and the choice of the former, in a preliminary assessment phase, raises the discussion about what standard of proof the agency needs to gather before restricting an operational service.
It is precisely on this issue that the company's appeal targets. Discord argues that blocking the service is reserved for the Judiciary and that a decision of national scope would not fall within the purview of the Superintendency of Inspection without deliberation by the Board of Directors, in addition to contesting factual elements of the investigation.
The answer to these two arguments is more important than the outcome for the company. It defines whether the agency can act cautiously before closing its own regulatory cycle, and at what decision-making level.
What the Supreme Federal Court had already moved
The case does not originate on neutral ground. On June 26, 2025, the Brazilian Supreme Court (STF) declared the partial unconstitutionality of Article 19 of Law 12.965/2014 in Themes 987 and 533, judged in RE 1.037.396 and RE 1.057.258.
The ruling mandated the immediate removal, regardless of a court order, of a range of serious content that includes sexual crimes against children and adolescents and incitement to self-harm and suicide. It also added structural obligations: representation within the country, notification channels with due process, and annual transparency reports.
The motions for clarification were concluded on June 11 and 12, 2026. The final ruling established joint and several liability for illicit content by third parties, barring reasonable doubt about the illegality, and established presumed fault in cases of paid advertising and artificial boosting. It also established a sixty-day period, counted from the publication, for the implementation of structural duties related to the mass circulation of serious illegal content.
Two adjustments complement the design and often go unnoticed. Offenses against honor, in the civil sphere, continue to require a court order for removal, although extrajudicial notification is permitted. And the court has provided for urgent relief to restore content improperly removed when legality is plausible, which creates a counterweight to the incentive to remove content as a precaution.
Combine the two paths and the picture becomes clear. Civil liability has begun to examine systemic architectural failures, and administrative oversight has begun to examine exactly the same thing, with the power to suspend functionality before any judgment.
For professionals who advise on platforms, this means that the same product decision is subject to different standards of proof and incompatible deadlines on two fronts.
What changes in the work of those who advise platforms?
The most immediate consequence is documentary. Prior risk assessment by functionality, recording of the technical alternatives considered, and justification of the choices have ceased to be good practice and have become the material that supports the defense.
The second consequence is the creation of an equivalence dossier. Whenever an architectural choice reduces detection capabilities, there needs to be documented proof of the substitute control, the test that measured its effectiveness, and the result obtained.
The third is age verification. The Digital ECA prohibits self-declaration and requires reliable methods, and the ANPD conducted public consultations on the guide to verification mechanisms and on the guide to supplier obligations throughout 2026, with contributions closing on July 9 and June 15.
The fourth point is operational and is often underestimated. Taking three business days to shut down a feature nationwide requires a prior technical plan for selective shutdown by region and by resource.
It is important to consider what comes after non-compliance. The agency has indicated that the Board of Directors may escalate the response with daily fines and faster asset freezes, which transforms the deadline for proof into a milestone with immediate material effect, and not a mere procedural formality.
There is also the prospect of further changes. The agency reported monitoring 37 companies classified as high-risk and evaluating the inclusion of new platforms in the group, including video services and large social networks, which indicates that the Discord case serves as an administrative precedent and not as an isolated incident.
Where practice alone cannot reach
The case combines, in a single proceeding, administrative sanctioning law, data protection, civil liability of providers, systems architecture, and risk regulation theory.
None of these layers can be resolved by simply reading the law. Assessing whether a substitute control is equivalent requires understanding how the product works. Discussing the competence of a superintendency requires mastery of federal administrative procedure. Anticipating the Judiciary's behavior regarding Article 19 requires following the formation of the legal argument, not just its final statement.
Those who wish to work autonomously in this field will find this combination in the IDP's Postgraduate Program in Digital Law, Data and Artificial Intelligence , with 408 hours, a live online format, and a duration of 15 to 24 months. The program is coordinated by Laura Schertel and Victor Fernandes, and the faculty includes names such as Fabricio da Mota Alves, Filipe Medon, and Tainá Aguiar Junquilho. The program covers digital constitutionalism, internet governance, data protection, provider liability and platform regulation, as well as competition between platforms, behavioral advertising, and the legal impact of artificial intelligence.
Sources
- ANPD, “As a preventive measure, ANPD orders Discord to suspend live broadcasts in Brazil” (August 12, 2026, updated August 18, 2026). It argues: initiation on August 7, three business day deadline, ten business day appeal period, scope of the suspension, and fine under Article 35.
https://www.gov.br/anpd/pt-br/assuntos/noticias/em-medida-preventiva-anpd-determina-que-discord-suspenda-transmissoes-ao-vivo-no-brasil - ANPD, official page of the Digital ECA. Supports: schedule of Stages I, II and III, Decree 12.622/2025, Law 15.352/2026, effective from 03/17/2026 and the consultations closed on 06/15 and 07/09/2026.
https://www.gov.br/anpd/pt-br/assuntos/eca-digital - Data Privacy Brazil, “ANPD suspends live streams on Discord”. It argues: art. 6, II and III, and art. 8, I, of the ECA Digital, art. 45 of Law 9.784/1999, art. 32 of Resolution CD/ANPD nº 1/2021, the interpretation of cryptography and alternative controls, and the three safeguard failures.
https://www.dataprivacybr.org/anpd-suspende-lives-no-discord/ - Exame (18/08/2026). It argues: 37 high-risk companies, escalation by daily fine, statements by Waldemar Gonçalves and Fabrício Guimarães, and the date of the teenager's death on 22/06/2026.
https://exame.com/brasil/apos-suspender-lives-do-discord-anpd-amplia-fiscalizacao-sobre-plataformas-digitais/ - Tecnoblog. Sustenta: the arguments of Discord's appeal, reservation of jurisdiction and competence of the Board of Directors.
https://tecnoblog.net/noticias/discord-recorre-para-reverter-suspensao-de-lives-no-brasil/ - Conjur/STF (June 26, 2025). Argues: partial unconstitutionality of article 19, Themes 987 and 533, RE 1.037.396 and RE 1.057.258, list of contents requiring immediate removal and structural duties.
https://conjur.com.br/2025-jun-26/supremo-fixa-tese-sobre-responsabilizacao-de-plataformas-por-conteudo-de-usuarios/ - Migalhas, Camila Betanin, “Discord on trial: the case that could redefine the duty of platforms” (August 26, 2026). Original article.
https://www.migalhas.com.br/depeso/462985/discord-a-prova-o-caso-que-pode-redefinir-o-dever-das-plataformas
