Brazil's Social Media Ban Is Live, and Brazilians Are Already Circumventing It

In Article 37 of Brazil's new age verification law, there’s an explicit prohibition on "massive, generic, or indiscriminate surveillance." Yet, two articles later, comes a ban on self-reported age, which now mandates auditable verification. The legislators wrote the contradiction right into the text, and apparently nobody blinked.

Lei 15.211/2025, better known as the Digital ECA, took effect on March 17, requiring nearly every tech product accessible to children to clear a long list of compliance obligations. Apps, operating systems, app stores, video games, and social networks are all potentially covered, all facing fines of up to 50 million Brazilian reais (roughly $9.44 million USD) or 10% of their Brazilian revenue for non-compliance.

The scope is deliberately broad, broad enough to land Ubuntu Linux on the regulatory watchlist, which is a developer-focused operating system that doesn't target children but apparently qualifies under Brazil's definition. And to no one’s surprise, Brazilians are already retaliating.

A Law That Contradicts Itself Out of the Gate

Auditable, non-self-declared age verification requires collecting something real about you. The approved methods include government ID uploads, biometric face scans, behavioral pattern analysis, age inference from activity data, and educational history.

Every single one of those creates a record, and every single one builds exactly the kind of identity infrastructure Article 37 says the law may not impose. Every one of those methods also creates a record, and the only explanation for why the law mandates them anyway is that the drafters either didn't read their own text or decided it didn't matter.

The platforms have already started showing what compliance costs. Discord began rolling out facial age estimation in Brazil via a third-party vendor starting March 9. Rockstar Games took a different approach and simply pulled its own storefront from Brazilian customers entirely, rather than absorb the compliance burden, redirecting them to PlayStation Store, Xbox, Steam, and Epic.

When a major game publisher finds it easier to exit a market than comply with a child safety law, it becomes clear that the law has a design problem.

The VPN Spike Nobody Was Surprised By

VPN search interest in Brazil started rising on Monday, the day the law took effect, and sign-ups at major providers jumped by 250% overnight between Monday and Tuesday. These surges typically reflect adult users turning to VPNs due to growing concerns about their privacy and online security, which is the polite way of saying that people don't want to hand their government IDs to a third-party vendor they've never heard of just to post on social media.

This is the identical pattern that played out in Australia when mandatory age verification for social media kicked in, and the one before that. The same age verification playbook gets recycled, the same VPN spike follows within 24 hours, and then regulators act surprised.

The law's deeper failure is structural. The kids it's designed to protect will route around it the same way Australian minors did within days of that country's social media ban, using a parent's account, borrowing a credential, or downloading the same VPN the adults are already using. 

Meanwhile, adults who comply are handing sensitive identity data to third-party vendors whose track record isn't reassuring. Discord's previous age-verification vendor suffered a breach exposing approximately 70,000 government ID photos, and Brazil's law is now scaling that exact pipeline to an entire country's user base.

Built to Collect, Not to Protect

No serious evidence exists that any age verification regime has meaningfully reduced minors' access to restricted content, while breaches and consent violations from identity verification vendors are thoroughly documented.

Brazil's version won't be different, and I'd challenge anyone pushing this law to explain why it would be, given that it can't even make it through its own text without contradicting itself and that its first major compliance story involves a global game publisher deciding it's simpler to leave than comply. Because building durable surveillance infrastructure on top of a child safety rationale that doesn't survive scrutiny is not child protection, and it's past time governments were held to that standard.

The issues we face with social media, AI, and similar platforms and apps are real. The solutions governments are going for aren’t. Such blanket bans are yet to solve anything (spoiler: they won’t). So why are they still pretending like that’s about to change any moment now?