Legal and regulatory guidance for U.S. technology companies and their legal counsel
By Willian Nunes | Brazilian Attorney — OAB/PR 80.473
November 13, 2026
U.S. technology companies offering digital services in Brazil are facing new questions about local legal representation, child online safety compliance, and reporting obligations to Brazilian authorities.
Under Brazil’s ECA Digital (Law No. 15,211/2025), certain foreign technology providers must maintain a legal representative in the country. Separately, a regulatory measure issued by Brazil’s Federal Police in October 2026 established a registration period extending into December 2026 for digital platforms subject to the NIDUS reporting system.
For U.S. general counsel, in-house legal teams, and outside counsel advising technology companies, understanding the distinction between these requirements is essential.
Article 40 legal representation and NIDUS registration are separate legal obligations. They may both apply to a particular company, but compliance with one does not automatically satisfy the other.
This article examines the relevant legal framework, the December registration period, and the considerations for U.S. companies maintaining digital operations accessible to Brazilian users.
1. What is Brazil’s ECA Digital?
Brazil’s Digital Statute for Children and Adolescents, commonly referred to as the ECA Digital, was established by Law No. 15,211 of September 17, 2025, and entered into force on March 17, 2026.
The law introduces requirements designed to protect children and adolescents in digital environments.
Its scope includes information technology products and services directed at minors in Brazil or likely to be accessed by them, regardless of where the provider is incorporated or operates.
Depending on the service, relevant compliance measures may include age-assurance mechanisms, privacy safeguards, parental supervision tools, content moderation, and reporting procedures.
The statute’s reach is not limited to companies headquartered in Brazil.
For U.S. businesses, this means that the absence of a Brazilian subsidiary does not necessarily remove a platform from the scope of Brazilian digital regulation.
However, whether an individual service is subject to the ECA Digital requires a review of the statutory criteria and the platform’s actual features.
2. Article 40: When must a foreign company appoint a legal representative in Brazil?
Article 40 of Law No. 15,211/2025 requires providers covered by Article 1 to maintain a legal representative in Brazil.
The representative must have authority to receive judicial and administrative communications, including service of process and official notices.
The provision also addresses representation before Brazilian executive agencies, courts, and the Public Prosecutor’s Office (Ministério Público), including the assumption of responsibilities on behalf of the foreign company before public administrative authorities.
This is broader than simply maintaining a mailing address in Brazil.
For U.S. legal departments, the appointment raises several questions:
- Does the company’s product fall within the scope of Article 1?
- What authority must the Brazilian representative receive?
- Can the appointment be made through an independent third-party provider?
- What responsibilities and potential financial exposures accompany the appointment?
- What supporting corporate documents and powers of attorney are required?
- How should the Brazilian representative communicate with the U.S. legal and compliance teams?
These questions should be resolved before the appointment is formalized.
Article 40 does not establish a separate December 2026 compliance deadline. Its legal requirements must be considered in light of the statute’s effective date and the company’s applicable obligations.
3. December 2026: Understanding the Federal Police’s NIDUS registration deadline
On October 20, 2026, Brazil’s Federal Police published Ordinance DG/PF No. 19,107/2026, establishing registration procedures for the NIDUS system.
NIDUS is part of Brazil’s framework for receiving and managing reports concerning serious online offenses against children and adolescents, including sexual exploitation and abuse, kidnapping, and grooming.
The ordinance requires suppliers falling within its mandatory-registration categories to submit their registration within 60 days of publication, creating a registration period that extends into December 2026.
The applicable registration requirement concerns providers identified under the Federal Police’s regulation. It should not be interpreted as a universal December deadline for every foreign technology company operating in Brazil.
The official guidance also clarifies that the deadline is considered satisfied when the supplier submits the complete required registration form, even if the Federal Police’s review remains pending.
Registration remains available after the initial period, and providers that subsequently become subject to mandatory registration must register as required.
Which digital platforms may be required to register?
According to the Brazilian Ministry of Justice, mandatory registration includes qualifying products and services directed at children and adolescents, or likely to be accessed by them, where the service presents risks of online sexual violence.
The rules also specifically address providers of pornographic content, escort services, and services used to arrange sexual encounters or relationships, even when their intended audience is exclusively adult.
The obligation is not limited to Brazilian companies.
For U.S. legal counsel, this is particularly relevant when reviewing dating applications, social platforms, interactive communities, and other services involving user-generated content or communication between users.
The correct approach is to assess the platform’s actual functionality and regulatory classification, rather than assume that all applications with Brazilian users fall into the same category.
4. Is NIDUS registration the same as appointing a legal representative under Article 40?
No. This distinction is particularly important for foreign legal departments.
Article 40 addresses the legal representation of covered suppliers before Brazilian authorities.
NIDUS registration concerns the identification and accreditation of suppliers and designated contacts within a specific reporting framework administered by the Federal Police.
The NIDUS registration procedure requests information such as:
- Corporate name and Brazilian CNPJ or foreign business registration number.
- Products, services, applications, and domains offered in Brazil.
- Contact details for the legal representative or attorney-in-fact.
- A technical point of contact for reports.
- An institutional contact for ordinary and emergency law-enforcement communications.
The Federal Police expressly states that identifying a person as a contact in the system does not, by itself, make that person personally responsible for the content of reports.
However, this clarification should not be interpreted as limiting every responsibility that may arise from a separate appointment under Article 40 or another applicable regulation.
Completing NIDUS registration does not automatically establish compliance with Article 40, and appointing an Article 40 representative does not automatically complete the NIDUS registration procedure.
5. Does reporting to NCMEC satisfy Brazil’s NIDUS requirements?
This is a relevant issue for U.S. companies already operating child-safety reporting programs.
In the United States, certain electronic service providers submit reports through the National Center for Missing & Exploited Children (NCMEC), including through its CyberTipline.
Brazil has developed its own reporting framework through the Federal Police and the National Center for the Protection of Children and Adolescents (Centro Nacional de Proteção à Criança e ao Adolescente, or CNCA).
According to the Brazilian Ministry of Justice, reporting to foreign reporting or triage centers does not replace mandatory NIDUS registration in Brazil.
Accordingly, U.S. legal and trust-and-safety teams should evaluate how their existing international reporting workflows interact with Brazilian requirements.
This does not necessarily mean that every technical reporting process must be duplicated immediately. The Brazilian framework distinguishes the current registration stage from the subsequent implementation of reporting procedures.
The requirements applicable to a particular provider should be reviewed against the current regulations and implementation schedule.
6. Does a U.S. company need to incorporate a Brazilian subsidiary?
Not necessarily for every regulatory purpose.
Foreign companies may be able to appoint representatives through appropriate legal instruments without automatically creating a Brazilian subsidiary.
However, the requirements for legal representation, local headquarters, corporate registration, and operational presence must be distinguished.
Brazil’s Decree No. 12,975/2026 introduced additional provisions concerning headquarters and legal representation for internet application providers.
These rules must be assessed alongside the ECA Digital, rather than assuming that the appointment of an attorney-in-fact, the use of a Brazilian mailing address, or registration through a third party satisfies every applicable obligation.
In particular, U.S. legal counsel should examine whether the intended arrangement meets the relevant requirements and whether any additional Brazilian corporate, regulatory, or tax obligations arise.
The scope of the representative’s authority should also be clearly defined.
7. Practical compliance considerations for U.S. general counsel
When reviewing the Brazilian requirements, legal departments may find it useful to organize their analysis into five stages.
Step 1 — Confirm the platform’s Brazilian activities
Identify which products and services are available in Brazil, how users access them, and whether the company maintains Brazilian customers, subscriptions, or other commercial relationships.
A complete assessment should consider more than the company’s place of incorporation.
Step 2 — Evaluate the applicability of ECA Digital
Review the criteria established by Article 1 of Law No. 15,211/2025 and the ANPD’s October 2026 guidance.
Relevant factors include the likelihood of access by minors, ease of access, and risks associated with the platform’s features.
An adults-only designation or age gate does not automatically resolve the statutory classification.
Step 3 — Determine whether Article 40 representation is required
If the ECA Digital applies, evaluate the legal-representation requirement and the powers needed for the contemplated appointment.
The corporate authority of the U.S. signatory, the appropriate power of attorney, and potential Brazilian formalities should also be considered.
Step 4 — Assess the NIDUS registration requirement separately
Determine whether the company falls within a mandatory-registration category.
If so, confirm the information and supporting documents needed for the filing, the applicable submission period, and the contacts who will perform the relevant functions.
Existing U.S. reporting practices should be reviewed for consistency with the Brazilian framework.
Step 5 — Establish communication and escalation procedures
The company should identify who will respond to Brazilian legal and regulatory communications.
For cross-border operations, this may involve coordination among U.S. legal counsel, Brazilian legal counsel, trust-and-safety personnel, and the company’s technical team.
The framework should address time-sensitive requests and the internal authorization process for substantive responses.
These steps do not replace a case-specific legal assessment, but provide an organized starting point for counsel responsible for Brazilian compliance.
8. Working with Brazilian local counsel
U.S. law firms and in-house legal departments frequently coordinate with local counsel when dealing with foreign regulatory requirements.
In the Brazilian context, local legal counsel can assist with the interpretation of domestic legislation, evaluation of regulatory applicability, preparation of representation documents, and communications with competent authorities within the scope of a professional engagement.
This assistance is distinct from assuming the operational role of a statutory representative.
Depending on the intended arrangement, formal representation may require additional documentation, contractual safeguards, and a separate assessment of the proposed representative’s legal status and responsibilities.
For international legal teams, clearly separating these functions helps define responsibilities and coordinate compliance activities across jurisdictions.
For questions concerning the application of Brazilian law to a foreign platform, see the contact information for Willian Nunes Advogados.
9. Frequently asked questions
Is Article 40 applicable to all U.S. technology companies with Brazilian users?
No. Article 40 applies to suppliers covered by Article 1 of the ECA Digital. A determination requires analysis of the service and the relevant statutory criteria.
Is December 2026 the deadline to appoint a Brazilian legal representative?
Not as a general rule under Article 40. The December 2026 registration period discussed here arises from the separate Federal Police ordinance establishing mandatory NIDUS registration for qualifying suppliers.
Does an 18+ age restriction exempt a U.S. platform from Brazilian child online safety requirements?
Not automatically. The ANPD assesses the characteristics of the service and the legal criteria relating to likely access by minors. Certain NIDUS categories also expressly cover adult-oriented services.
Can a U.S. company complete NIDUS registration without a Brazilian CNPJ?
The Federal Police’s published requirements allow identification using a foreign corporate registration number. Whether other Brazilian registration or establishment requirements apply is a separate legal question.
Can U.S. outside counsel serve as the company’s Brazilian statutory representative?
The proposed representative must satisfy the applicable Brazilian legal requirements. U.S. bar admission alone does not authorize the practice of Brazilian law or establish compliance with the country’s statutory-representation requirements.
Can Brazilian compliance matters be coordinated remotely?
Many preliminary legal reviews and document-preparation activities can be coordinated remotely. Formal execution, authentication, translation, registration, and representation requirements depend on the applicable procedure.
10. Brazilian legal guidance for U.S. companies and law firms
Willian Nunes Advogados is a Brazilian law firm based in Curitiba, Paraná, providing Brazilian legal assistance to domestic and international clients, with communication available in English.
For U.S. companies and foreign law firms addressing regulatory matters in Brazil, legal assistance may include analysis of applicable Brazilian legislation, evaluation of representation requirements, review of powers of attorney, and guidance on relevant administrative and compliance procedures.
The scope of any engagement depends on the company’s operations, the legal questions involved, and the documentation available.
Further information about the firm’s Brazilian legal practice is available through its international contact page.
Willian Nunes Advogados
Curitiba, Paraná, Brazil
Willian Nunes — OAB/PR 80.473
Email: w.nunes@wnadvogados.adv.br
Website: wnadvogados.adv.br
Official Brazilian legal sources
- Law No. 15,211/2025 — ECA Digital, including Articles 1 and 40
- Brazilian Data Protection Authority (ANPD) — October 28, 2026 guidance on applicability of the ECA Digital
- Brazilian Ministry of Justice — NIDUS registration and the 60-day filing period
- Federal Police — CNCA guidance for digital platforms
- Decree No. 12,975/2026 — Regulation of Brazil’s Internet Civil Framework
Legal information current as of November 13, 2026. This article is intended for general informational purposes and does not constitute legal advice concerning any specific company, platform, or regulatory filing. Brazilian requirements and implementation procedures should be confirmed against the official regulations in effect at the time of the relevant action.