Brazil's Biometric Age Verification Law Has Its First Supreme Court Challenge

Key Takeaways

• Brazil's right-wing Partido Missão has filed a constitutional challenge (ADI 7999) with the Supreme Federal Court against the biometric verification requirement in ECA Digital, arguing it collects disproportionately sensitive data for its stated child protection goal.
• ECA Digital, signed into law in March 2026, requires platforms to implement "effective and reliable" age verification — accepting biometrics (facial recognition, fingerprints, iris scans, voice), government ID document uploads, or CPF database checks. Self-declaration alone is banned.
• The challenge arrived precisely as the law entered a second, broader enforcement phase, creating legal uncertainty for hundreds of platforms currently in compliance planning.
• A key open question — whether zero-knowledge proof cryptography can satisfy the "reliable" standard without collecting biometric data at all — is expected to be addressed in ANPD guidelines due this month.

Brazil's Supreme Federal Court (STF) has received its first constitutional challenge to the country's landmark child online safety law, according to reporting by TechTimes. Partido Missão, a right-wing party, filed Direct Action of Unconstitutionality 7999 on August 5, targeting the core verification mechanism of ECA Digital — specifically, whether requiring adults to submit biometric data (faces, fingerprints, voices, or iris scans) as a condition of accessing digital content is constitutionally proportionate, or whether less invasive alternatives could achieve the same child protection goal without harvesting irreplaceable biological identifiers.

The timing is significant. The challenge arrived as the law entered a second, broader enforcement phase, meaning hundreds of platforms are currently in active compliance planning — and now face legal uncertainty about whether the biometric requirements they're building toward will survive constitutional scrutiny.

ECA Digital — Law 15,211/2025, signed by President Lula in March 2026 — is described as the most comprehensive child online safety framework in the Americas. It applies to any digital product or service accessible to Brazilian minors, regardless of where the company is headquartered. Its central requirement: "effective and reliable" age verification. 

Self-declaration — a checkbox reading "I am 18+" — is explicitly banned as a standalone method. Platforms with more than one million minor users in Brazil must publish semi-annual transparency reports. Non-compliance carries fines up to BRL 50 million per violation or 10% of Brazilian annual revenue, with courts empowered to suspend services or ban platforms entirely for serious cases.

What Verification Actually Looks Like Under This Law

Brazil's National Data Protection Authority (ANPD) has identified three accepted compliance methods: biometric verification including facial recognition and facial age estimation; document verification requiring users to upload a government-issued ID; and CPF-based database checks using Brazil's national taxpayer identification number.

Reading that list, the privacy concerns are immediate. Every one of those methods requires an adult user to hand over either their most sensitive biometric data — a face scan, fingerprints, iris patterns — or their government identity documents, to access legal digital content. The data has to go somewhere: to the platform, to a third-party verification vendor, or to a government database check system. It has to be stored, secured, and protected from breach. And once biometric data is compromised, it can't be changed. Unlike a password or even a government ID number, a face or fingerprint is permanent. The exposure is irreversible.

This is the argument Partido Missão is making before the STF: that biometric collection goes beyond what child protection requires and that the law fails the proportionality test. The argument has merit independent of who is making it. We've raised the same proportionality concern across age verification laws in Iowa, France, the UK, the KIDS Act, and the SCREEN Act. Brazil's version goes further than most — it names biometrics as an explicitly accepted method, rather than simply pushing platforms toward them through compliance pressure.

Zero-Knowledge Proof Question That Could Change Everything

There is a detail in this story that deserves more attention than it's getting. ECA Digital doesn't yet explicitly address whether cryptographic zero-knowledge proofs — a method that can mathematically verify that a user meets an age threshold without revealing or storing any of their personal data — can satisfy the law's "reliable" standard. ANPD guidelines expected this month are supposed to resolve that question.

Zero-knowledge proofs are not science fiction. They're a mature cryptographic technique already deployed in financial and identity verification contexts. If ANPD's guidelines confirm they satisfy the reliability standard, Brazil's law could be complied with in a way that doesn't require harvesting biometric data from every adult user in the country. That would be a meaningfully different outcome — one that takes the child protection goal seriously while not building a national biometric database as a byproduct.

The STF challenge and the ANPD guidelines are now on a collision course with each other. If the guidelines land before the court rules, and they confirm that less invasive methods are acceptable, the constitutional challenge may become moot. If the court acts first, or if the guidelines require biometrics, the question of whether Brazil's law is proportionate gets answered in a much higher-stakes forum.

Why This Matters Beyond Brazil

Brazil has 200 million people and one of the world's largest digital user bases. ECA Digital applies to any platform accessible to Brazilian minors — meaning global companies must comply with its biometric requirements regardless of where they're headquartered. 

If the law survives constitutional challenge with biometric requirements intact, it sets a precedent that spreads: other countries looking to implement child online safety frameworks will point to Brazil as a model, just as countries have pointed to Australia's social media ban, regardless of the evidence on whether it works.

The STF challenge is the right venue to force a proportionality reckoning that democratic legislatures have consistently failed to hold. Whether it succeeds is another question. But the argument being tested — that biometric data collection cannot be justified simply by invoking child safety — is the argument that needs to be tested everywhere age verification is being mandated. Brazil got there first.