The Brazilian Data Protection Authority (ANPD) has published an update to its 2025-2026 Regulatory Agenda and released the Priority Topics Map for 2026 and 2027. The documents establish the first steps in regulating the Digital Child and Adolescent Statute, including a schedule for the first monitoring and enforcement activities under the new law, and outline a path for updating the authority regulatory procedures and internal resolutions.
The ANPD will begin monitoring compliance with the Digital Statute requirements in the first half of 2026, but inspections concerning age assurance will take place from 2027 onward. The schedule does not prevent the authority from investigating specific cases as soon as the statute enters into force. It does, however, indicate that the agency is prioritizing the construction of the regulatory framework before moving into broader inspection activity.
In that regard, the new Regulatory Agenda provides for the creation of guidance on the scope of the main points of the Digital Statute, aimed at economic actors and civil society. In a parallel workstream, the authority will define which age-assurance mechanisms fall within the scope of the statute. Both measures began to be formulated this year.
The Priority Topics Map also sets the second half of 2026 as the starting point for inspections concerning design, parental supervision tools and other settings in services used by children and adolescents.
In 2027, the ANPD also intends to inspect broader practices involving secondary use of personal data, including profiling techniques for advertising delivery.
Review of regulatory procedures
Following Provisional Measure 1317/2025, which transformed the ANPD into a regulatory agency, the updated agenda includes initiatives to align the authority work more closely with the mechanisms provided for in Brazil general law on regulatory agencies. This includes reviewing Ordinance 16 of 8 July 2021. Children and adolescents may be heard during the regulation of the Digital Statute, an approach regarded internationally as good practice.
Regulatory outcome assessments and regulatory impact analyses are also within the scope of this review. Transparency procedures in public consultations may be adjusted as part of the discussion.
The ANPD also proposes to discuss whether rules for drafting inspection regulations and administrative sanctioning procedures should be revised. The authority considers that the Digital Statute requires administrative changes to improve the application of legal mechanisms such as warnings and fines.
A potential review of the ANPD administrative framework may lead to new measures, including procedural phases and deadlines, conduct adjustment agreements, deadlines for decisions in administrative appeals, limitation periods and the introduction of amicus curiae participation in proceedings conducted by the authority.
The ANPD openness to reformulating its administrative framework stems from the legislative processing of Provisional Measure 1317/2025. Senator Alessandro Vieira, rapporteur of the measure in the joint congressional committee, rejected 40 amendments proposing changes to the agency internal structure.
Although the new Regulatory Agenda addresses topics that appeared in the rejected amendments, lawmakers may still revive those ideas and present them again during the plenary stages in the Chamber of Deputies and the Senate.
Artificial intelligence
While Bill 2338/2023, which would create a legal framework for artificial intelligence, remains pending, the ANPD is using the mechanisms currently available to position itself as the authority responsible for AI governance.
The Regulatory Agenda refers to the need to establish interpretative parameters for reviewing automated decisions under the Brazilian General Data Protection Law (LGPD). Also based on the LGPD, the authority will examine aspects of the training and use of AI systems.
According to the Priority Topics Map, the ANPD will expand its efforts to supervise emerging technologies and inspect the use and processing of personal data by AI systems. The authority will include observations concerning children and adolescents in this context, but inspections will only begin in 2027.
Source: Jota
