Brazil’s data protection authority is commissioning the evidence base for its next round of guidance and enforcement. The ANPD and the UN Development Programme opened five research consultancies on 7 July, closing 26 July, covering dark patterns, child profiling, targeted advertising to minors and AI agents.
English-language coverage has been close to nil, largely because the news arrived as consultancy notices rather than a sanction or a formal consultation. That is exactly why it deserves attention now.
Five studies, one deadline
Each consultant works for up to 120 days for R$82,846.72, paid on delivery. The reports feed the ANPD’s 2025-2026 Regulatory Agenda directly and are framed as support for implementing the LGPD and the ECA Digital, Brazil’s digital child-protection statute.
Three of the five studies focus on children and adolescents. Per Convergência Digital, the calls cover manipulative design in sites and apps (Edital 3), family-supervision mechanisms and progressive autonomy (Edital 4), profiling and targeted advertising to children and adolescents (Edital 5), AI agents in personal-data protection (Edital 6), and data handling in delivery and transport platforms (Edital 7).
Email and martech teams should read Editais 3 and 5 first. The dark-patterns study requires analysis of 20 of the main sites and apps used by children in Brazil, a comparison of at least five regulatory models, and criteria to separate acceptable design from abusive design. The profiling study maps targeting practices across social networks, streaming, games, edtech and e-commerce, and will feed future ANPD guidance and inspection roadmaps.
The ECA Digital raises the stakes
The ECA Digital is Law 15.211/2025, in force since 17 March 2026. It applies to any digital product or service directed at, or likely to be accessed by, minors in Brazil, wherever it is operated. It bans behavioural profiling for advertising to minors, restricts monetisation of children’s behavioural data, and requires safety and privacy by design.
The ANPD is not a paper regulator. In 2024 it ordered Meta to suspend the use of personal data for AI training in Brazil, citing among other things the processing of minors’ data without proper safeguards. Systematic ECA Digital sanctions begin in January 2027, and the agency says it is already monitoring close to 40 companies. That leaves limited runway.
A live tracker for what comes next
On 17 July, Brazil’s first National Data Protection Day, the ANPD published a rebuilt Regulatory Agenda page. Instead of semiannual summaries, it now shows the status of each planned action, consultation records and key documents in near real time. Priority themes include data-subject rights, impact reports, biometric data, minimum security standards, AI, high-risk processing, anonymisation and personal-data aggregators, plus three ECA Digital topics added in December 2025, including age verification.
Colombia moves in parallel
Colombia issued Decreto 0769 of 2026 on 16 July, regulating Law 2489 of 2025 on healthy and safe digital environments for children. It requires privacy by design and by default, restricts profiling and directed advertising involving minors’ data, and obliges platform providers to manage risk and report progress to the ministry every six months. Two authorities, working in Spanish and Portuguese, converged on child-directed design and advertising within the same week. That is a regional direction of travel, not one country’s experiment.
Why email marketers should care
These studies map directly onto everyday martech surfaces. Consent UX and retention prompts are the interfaces the dark-patterns study will scrutinise. Preference centres and unsubscribe flows are the mechanisms regulators test against manipulative design. Gamified acquisition, audience modelling and lookalike targeting are the practices the profiling study will map. The AI-agents study will propose a model data protection impact report [INTERNAL LINK: EU AI Act Article 50 transparency guidelines piece].
The practical steps are simple. Assign someone to watch the Regulatory Agenda tracker and read the study outputs when they land, roughly four months after contracts sign. Audit consent, preference and unsubscribe flows against known dark-pattern criteria before the ANPD publishes its own. For any product likely to be accessed by minors in Brazil, stop behavioural profiling for advertising to minors now and document privacy by default. The evidence that guidance and enforcement will draw on is being written today, and it is almost entirely in Portuguese.
