Minors’ Data in Online Games and Apps

This page is a translation of the original Portuguese text, provided for convenience. It deals with Brazilian law. If there is any discrepancy, the Portuguese version prevails. Read the original in Portuguese

Online games and children’s apps collect data on children and teenagers on a massive scale, which requires companies to exercise rigorous diligence to comply with Brazilian data protection law.

The Current Landscape of Collecting Minors’ Data in the Digital Environment

We live in an era in which children and teenagers are increasingly immersed in the digital world. Online games, educational apps, social networks aimed at young audiences, and entertainment platforms collect a significant amount of personal information from minors every day. Names, dates of birth, geographic location, in-game behavior patterns, virtual purchase history, and even biometric data (such as facial recognition in augmented reality filters) make up a true mosaic of sensitive information.

When we look at the Brazilian regulatory landscape, we find that the General Data Protection Law (Law 13.709/2018, known as the LGPD) pays special attention to the processing of children’s and teenagers’ data in Article 14. That provision establishes that this processing must be carried out in the minor’s best interest, and it requires specific, prominent consent from at least one parent or legal guardian. This requirement adds to the protective framework already found in the Statute of the Child and Adolescent (Law 8.069/1990), which enshrines the doctrine of full protection.

In online games, data collection goes far beyond a simple sign-up. Tracking mechanisms built into apps monitor time spent playing, social interactions within the platforms, items purchased with virtual currency, and browsing patterns. When aggregated, this data makes it possible to build detailed behavioral profiles of minors, which raises serious concerns from both a legal and an ethical standpoint. Many companies, especially smaller ones, still lack adequate mechanisms to identify underage users and apply the corresponding legal safeguards.

Data Due Diligence: Legal Obligations and Best Practices

Data due diligence for apps and games aimed at children and teenagers involves a structured set of checks that companies must carry out to ensure compliance with current law. The process runs from the product design stage (privacy by design) through ongoing monitoring of data processing practices after launch.

The first pillar of this diligence is age verification. Companies need to implement reliable mechanisms to identify users’ ages, so that minors cannot access features or services unsuitable for their age group without proper parental consent. Solutions such as simple self-reported age (so-called “age gates”) are considered insufficient by the National Data Protection Authority (ANPD), which has been guiding the market toward more robust verification methods.

The second pillar is the transparency and adequacy of privacy policies. When the target audience includes children, information about data processing must be presented in a simple, clear, and accessible way, taking into account the user’s physical-motor, perceptual, sensory, intellectual, and mental characteristics, as required by paragraph 6 of Article 14 of the LGPD. In practice, this means that privacy policies written in overly technical or legal language do not meet the required legal standard.

The third pillar concerns data minimization. Many games and apps collect information far beyond what is needed to provide the service. Precise geolocation data, access to contact lists, audio recording, and device identifiers are often requested without legitimate justification. Due diligence calls for a careful review of every point of collection, eliminating those that do not meet the necessity principle set out in the LGPD.

Protecting children’s and teenagers’ data in digital environments is not only a legal obligation but an ethical commitment that should guide the entire game and app development chain.

The fourth pillar focuses on information security. Companies must implement technical and administrative measures capable of protecting minors’ personal data from unauthorized access and from accidental or unlawful destruction, loss, alteration, and improper disclosure. This includes encryption of data at rest and in transit, role-based access control, incident monitoring, and data breach response plans.

Legal Risks and Applicable Penalties

The consequences of failing to comply with rules on the protection of minors’ data are significant and span multiple spheres. On the administrative side, the ANPD may impose penalties ranging from warnings to fines of up to 2% of the revenue of the private-law legal entity, group, or conglomerate in Brazil, capped at R$ 50 million per violation, under Article 52 of the LGPD. In addition to fines, the authority may order the blocking or deletion of personal data processed unlawfully, which can make it impossible for the app or game to keep operating.

On the civil side, companies are exposed to individual and class actions for property damage and pain and suffering (moral damages) resulting from improper handling of minors’ data. The Public Prosecutor’s Office (Ministério Público), the Public Defender’s Office (Defensoria Pública), and consumer protection organizations have standing to file public civil actions to defend the diffuse and collective interests of children and teenagers, which considerably amplifies the reputational and financial risk for companies.

The international scene also poses additional challenges. Brazilian companies that offer games or apps accessible to minors in other countries may be subject to equally strict foreign laws, such as the Children’s Online Privacy Protection Act (COPPA) in the United States and the General Data Protection Regulation (GDPR) in the European Union, which provides enhanced protections for minors’ data. Complying with several jurisdictions at once calls for an even broader due diligence effort.

Another relevant risk involves international data transfers. Many online games use servers located in other countries, and data collected from Brazilian minors may be transferred to jurisdictions with different levels of protection. The LGPD sets specific conditions for these transfers in Article 33, and failing to meet those conditions is an additional violation.

Practical Aspects of Implementing a Compliance Program

Building an effective compliance program for protecting minors’ data in games and apps requires a multidisciplinary approach. Companies are advised to form teams that bring together professionals in information technology, legal, user experience (UX) design, and pedagogy, taking into account the particular characteristics of a young audience.

Data mapping is the indispensable first step. Every category of personal data collected must be identified, documented, and classified according to its necessity and legal basis. For each point of collection, the company should record the specific purpose, the retention period, any sharing that takes place, and the security measures applied. This mapping should be reviewed periodically, especially when new features are added to the game or app.

Preparing a Data Protection Impact Assessment (known in Brazil as the RIPD) is another essential measure. When the processing of minors’ data involves new technologies, large-scale processing, or automated decisions, carrying out the assessment makes it possible to identify and mitigate risks before they materialize. The report should describe the processing operations, assess the necessity and proportionality of the data collected, and present the safeguards adopted.

Parental Consent: Challenges and Solutions

One of the biggest practical challenges is obtaining and managing parental consent. The LGPD requires that at least one parent or legal guardian provide specific, prominent consent for the processing of children’s data (children under 12). The solutions available on the market include verification through a parent’s credit card, submission of an identification document, verification by video call, and verifiable email systems (known as “verifiable parental consent”).

Each method has advantages and limitations. Credit card verification may exclude families without access to that form of payment. Submitting documents raises questions about the proportionality of collecting additional data. The ideal solution often combines several methods, offering alternatives that suit different socioeconomic profiles without compromising the effectiveness of the verification.

Data Retention and Deletion

Retention policies for minors’ data should follow stricter criteria than those that apply to adults. Companies are advised to set shorter retention periods, anonymize data whenever possible, and put in place mechanisms that let parents or guardians request complete deletion of their children’s data simply and effectively. The right to deletion, provided for in Article 18 of the LGPD, takes on particular importance when it comes to information about children and teenagers.

Regulatory Trends and the Future of Children’s Data Protection

Brazil’s regulatory landscape is constantly evolving when it comes to protecting minors’ data in the digital environment. The ANPD has shown special attention to the subject and has included it on its regulatory agenda. Legislative discussions are also under way in the National Congress on strengthening safeguards for children and teenagers online, which may result in additional obligations for game and app developers.

Internationally, rules are tightening. The United Kingdom’s Age Appropriate Design Code, for example, set high protection standards that have been influencing regulation in other countries. The California Age-Appropriate Design Code Act in the United States took a similar path, imposing specific impact assessments for digital services accessible to minors.

For companies in the game and app industry, the message is clear: investing in data due diligence is not only a matter of regulatory compliance but also a sustainable business strategy. Organizations that show a genuine commitment to protecting minors’ data build trust with families, significantly reduce their exposure to legal risk, and position themselves competitively in a market that pays ever closer attention to privacy practices.

As informações deste artigo são de caráter informativo e não substituem consulta jurídica individualizada. Cada caso possui particularidades que exigem análise específica.