Brazil's digital rights secretariat has forwarded a technical note mapping possible ECA Digital breaches by 13 AI companion apps to the ANPD and Senacon, without finding that any app broke the law

A referral, and the note says so itself

The document is Nota Técnica nº 47/2026/DSPRAD-SEDIGI/SEDIGI/MJ, signed electronically on 21 September 2026 by three officials of the Secretaria Nacional de Direitos Digitais and approved the same morning by the National Secretary for Digital Rights, Victor Oliveira Fernandes. It binds nobody and finds no violation.

Paragraph 8.3 recommends forwarding the note to two bodies. To the ANPD it goes "para conhecimento e avaliação, no âmbito de suas competências regulatórias e fiscalizatórias, dos riscos associados aos AI Companions à luz do ECA Digital". The PDF text layer sets the "fi" in "fiscalizatórias" as a single ligature character, which we keep as it appears there. Our translation: for awareness and assessment, within its regulatory and supervisory powers, of the risks associated with AI companions in light of the ECA Digital. To Senacon it goes for assessment from a consumer protection perspective, covering service defects and potentially deceptive or exploitative commercial, informational and design practices.

Paragraph 5.9 describes the note as preliminary and as a mapping exercise that does not anticipate a judgment on the merits. Paragraph 7.1, which opens the service-by-service section, adds that the citation of provisions is indicative and that any infringement depends on a concrete investigation with the right to reply and full defence.

One conflict between sources is worth stating. The ministry's release of 21 September says the MJSP asked the ANPD for "a abertura de investigação sobre 13 ferramentas de inteligência artificial", the opening of an investigation into 13 AI tools. The note's own operative paragraph uses the softer words awareness and assessment, and names Senacon as well. We report the note's wording as the operative text and the release's wording as the ministry's description of it.

The 13 services, as the note names them

Paragraph 3.4 says consultants found 16 services and that 13 were catalogued and analysed in the note: Character.AI, Replika, Nomi, Candy.ai, Kindroid, Chai, Paradot, Talkie, CrushOn.AI, EVA AI, Anima, Swipey and SpicyChat.AI.

The two lists do not reconcile by simple subtraction. Four services in the list of 16 are not among the 13: Soulmate, Xiaoice, Kuki and Snapchat My AI. Swipey is among the 13 but does not appear in the list of 16, and the note does not explain that. It says Soulmate was discontinued in 2023, and that Xiaoice stayed in the consultancy catalogue but was left out of the individual analysis because no consumer product and access flow could be identified. For Kuki and Snapchat My AI it gives no service-specific reason, only the general one that some services appeared only incidentally in the sources.

The note is not one-sided about the companies. On Character.AI it records the company's statement that open-ended chat was removed for users under 18 from 29 October 2025, and its statement that age assurance is being implemented, while saying the effectiveness of those measures in Brazil cannot yet be assessed.

Self-declared age, and the adults-only label

Paragraph 6.12 says most of the services analysed use self-declaration as their only age check, and reports the consultancy's finding that ten of the systems it assessed accept self-declared age, by date of birth or a simple confirmation of majority. The paragraph does not say how many systems that consultancy product assessed, so we do not supply a denominator. The note then sets out two tiers, on its own non-binding reading of the law.

On the note's own reading, which binds no one, the first tier applies where a service offers content improper, unsuitable or prohibited for under-18s. The note reads Article 9, paragraph 1 of the ECA Digital as requiring a reliable age check at each access and prohibiting self-declaration in that case, and reads Article 16, paragraph 4 of Decree 12.880/2026 as treating sexually explicit automated interaction as pornographic content. In the second tier, services aimed at or likely to be accessed by children, the note says self-declaration is not banned in itself but has to sit inside a system that actually adapts the experience to age.

The sentence with the most practical reach closes paragraph 6.18: "Esse enquadramento alcança também os serviços que se declarem destinados exclusivamente a adultos, sempre que caracterizado o acesso provável por crianças e adolescentes". Our translation: this framing also reaches services that declare themselves intended exclusively for adults, whenever probable access by children and adolescents is established. That is the secretariat's interpretation; no court or regulator has adopted it on the record we saw.

Emotional profiling as advertising

Paragraphs 6.39 to 6.43 argue, as a non-binding interpretation, that companion apps build individual behavioural and emotional profiles as a condition of working at all, and that using those inferences to decide which paid features to offer a teenager, when and how, amounts to advertising targeting.

The note ties that reading to Articles 22 and 26 of the ECA Digital and to Article 33 of Decree 12.880/2026, which it describes as requiring providers that advertise to children and adolescents to prevent profiling and emotional analysis for ad targeting. It presents the step from premium upsell to advertising targeting as an interpretation, introducing it with the word "Interpreta-se", it is interpreted.

We flag that step as the note's own. Whether an in-app offer of a paid plan counts as advertising under Article 33 is exactly the kind of question the ANPD or Senacon, not the secretariat, would have to settle.

Intimate data and impact reports

Paragraphs 6.34 to 6.38 turn to data protection, again as a preliminary assessment. The note says companion conversations can reveal mental health, family, sexual and other intimate information that may be sensitive personal data under the LGPD.

On that preliminary reading, it lists conduct that may indicate non-compliance: excessive collection of intimate information, long retention of chat history without demonstrated need, storing sensitive data for non-essential personalisation, default settings that favour more collection or memory, thin transparency, and no risk mapping or impact report where one is required. It cites Articles 6 and 14 of the LGPD and Articles 7, paragraph 2 and 16 of the ECA Digital.

What we did not verify

What we opened: the full 38 page note as a PDF from gov.br, read as extracted text, including the executive summary, the legal framework in section 5, the analysis in section 6, the opening of the service-by-service section 7 and the conclusion in section 8 with its signature block. We also opened both MJSP releases, of 21 and 22 September 2026. The PDF address first recorded by our sweep, which sat directly under the ministry news folder rather than under the 22 September release, returned HTTP 404 when we requested it on 24 September 2026 (UTC). The 22 September release links the note as an attachment, and that is the address we link.

What we did not open: the consultancy product the note relies on (SEI 36799145), the FGV Direito Rio study it cites, the text of Lei 15.211/2025, Decree 12.880/2026, the LGPD or the Consumer Defence Code. Statements about what those instruments require are therefore the note's readings, attributed as such. We read the individual analysis for Character.AI and SpicyChat.AI in section 7 but did not summarise the analysis for each of the other services. We found no statement from the ANPD or Senacon about the note.

What we refuse to claim: that any named service has violated Brazilian law, that an investigation has been opened, or that any sanction is coming. We do not repeat the 21 September release's description of an investigation request as the note's own wording. Quotations are reproduced from the PDF text layer as extracted; where that layer sets "fi" as a single ligature character, the quotation keeps it and says so beside the quote.

Informational analysis for working professionals, not legal advice. Confirm how any rule applies to your situation with qualified counsel.

Related briefings

• Brazil's MJSP and Sedigi on AI smart toys under the ECA Digital
• Brazil's ANPD monitoring of generative AI tools under the ECA Digital
• Italy's Garante fines Luka over the Replika chatbot
• Latin America AI regulation tracker
• AI Regulation News hub