Understanding the Brazilian Censorship of Discord and the Digital ECA Law

If you didn’t know: Brazil censored Discord’s livestreams this week. One heads-up before we start: this story runs on Brazilian law and Brazilian reporting, so most of the sources linked below are in Portuguese. I’ll translate everything that matters.

In six days, Brazil went from a tragedy to a regulatory precedent that should worry anyone who understands technology. On July 22, a 13-year-old girl died in Naviraí, Mato Grosso do Sul, during a live broadcast on Discord, coerced by a group the police are investigating as a criminal organization. On August 12, the ANPD, Brazil’s data protection authority, ordered Discord to suspend live broadcasting nationwide.

In between: the First Lady demanding the platform be blocked at an official ceremony, the Attorney General announcing a public civil action, and the first major enforcement action in the history of the Digital ECA Law — Brazil’s new online child-protection statute, named after the Estatuto da Criança e do Adolescente, the Child and Adolescent Statute. Let’s go piece by piece, because the devil lives exactly in the pieces.

The Naviraí case

The facts, per the Mato Grosso do Sul Civil Police and G1: Lívia, 13, was found dead in her backyard on the morning of July 22. She took her own life during a broadcast on Go Live, Discord’s live video feature, under pressure, humiliation, and explicit encouragement from other users. More than 200 people were watching.

Operação Lívia, launched on August 4 with warrants across five states, revealed what was behind it: a group made up mostly of teenagers, the alleged leader just 14, that recruited minors via Discord and Telegram, spread neo-Nazi and misogynistic content, and is being investigated for qualified homicide and criminal organization. A second girl was induced to self-harm during the same livestream but left the broadcast.

Hold on to two details for later: the group operated on more than one platform, and the Ministry of Justice asked the ANPD to investigate Discord and Telegram. Only one of the two was sanctioned.

From the First Lady to the ANPD in six days

On August 6, at the signing ceremony of the bill PL 3066/2025 (which stiffens penalties for digital crimes against children — keep that bill in mind, it comes back shortly), First Lady Janja da Silva left no room for doubt: “we need to block Discord in Brazil by any means necessary… we need to work with the Judiciary to take this horrendous network offline.” The Attorney General, Jorge Messias, announced right there a public civil action to take the platform down.

On the 7th, the ANPD opened an enforcement proceeding against Discord, giving the company five business days to explain itself. On the 12th, out came the preventive measure: Discord must suspend Go Live and equivalent video-sharing features in Brazil within three business days, and can only turn them back on after proving effective child-protection measures and obtaining express ANPD authorization. The legal basis: articles 6, 10, 17, 28, and 29 of the Digital ECA Law, with fines up to R$ 50 million per infraction (art. 35).

Discord called the measure “premature”: it received the case file on Friday, was still within its response window, and says it removed the private server where the crime happened. And it dropped the most interesting sentence in the whole response: its internal investigation found evidence that “the criminal activity was coordinated on other platforms before the server was created on Discord and continued on them afterward.”

A necessary clarification here. A version has circulated claiming the case originated on Instagram. I went looking and found no source confirming it: the platform named by police, besides Discord, is Telegram. Discord doesn’t name the “other platforms.” What matters still stands, just with a different name in the slot: the case was not exclusive to Discord, the Ministry of Justice asked for two platforms to be investigated, and only Discord got the sanction. Telegram, which barely has legal representation in Brazil, remains untouched.

And that’s where the first uncomfortable question shows up: if the problem is systemic, why is the sanction surgical?

What the Digital ECA Law is, a.k.a. the “Felca Law”

The sanction was only possible because of a brand-new law. In August 2025, the YouTuber Felca published the video “Adultização” (“Adultification”), exposing profiles that monetized sexualized content involving minors — the most shocking case being influencer Hytalo Santos, arrested that same month and convicted in February 2026 to over 11 years in prison. The video passed 30 million views, the Senate opened a parliamentary inquiry, and Congress rushed the bill PL 2628/2022 through under urgency, authored by Senator Alessandro Vieira.

The result: Law 15,211 of September 17, 2025, the Digital Statute for Children and Adolescents, in force since March 17, 2026. The points that matter for this discussion:

• Duty of care (art. 6): platforms must take “reasonable measures from the design phase” to prevent minors’ exposure to sexual exploitation, violence, and inducement to self-harm and suicide.
• Age verification (art. 9, §1): “reliable age-verification mechanisms at every access”, with a devastating punchline: “self-declaration is forbidden.”
• Notice and takedown (art. 29): a duty to remove content violating children’s rights as soon as notified, no court order required.
• Enforcer: the ANPD, which stacked the job on top of the LGPD (Lei Geral de Proteção de Dados, Brazil’s General Data Protection Law) and, since May 2026, duties under the Marco Civil da Internet (Brazil’s internet bill of rights). It became the country’s de facto digital regulator.
• Fines up to 10% of Brazilian revenue, capped at R$ 50 million per infraction. Suspension of activities, on paper, only through the Judiciary (art. 35, §5).

That last point is already contested: experts interviewed by Folha point out that the ANPD’s “preventive measure” may in practice be a temporary suspension of activities — a sanction the law reserves for the Judiciary. Barely born, the regulation is already flirting with its own illegality.

Worth remembering the bigger context: in June 2025 the Supreme Court partially struck down art. 19 of the Marco Civil, ending the requirement of a specific court order to hold platforms liable. In June 2026 the same court consolidated a “duty of care” with categories for immediate removal, including suicide inducement and grave crimes against children. The Digital ECA Law legislates in that direction. In one year, platform liability in Brazil went from reactive to proactive.

The oxymoron: “you may encrypt, as long as we can read it”

Now the core of it, which is what made me write this. The ANPD’s official justification for suspending Go Live deserves a careful read: Discord’s architecture uses end-to-end encryption, the platform has no access to livestream content, and therefore real-time moderation is impossible. In the ANPD’s assessment, if moderation depends on flawed automated systems and on reports from people inside the very room where the crime is happening, the feature is incompatible with the law.

Read that again, slowly. The ANPD didn’t ban encryption — a direct ban would be indefensible in public. It said something else, far more ingenious: you may have end-to-end encryption, as long as you can monitor the content to comply with your legal duties.

Except that’s an oxymoron. The entire point of end-to-end encryption is that the server carries ciphertext and cannot read it. To “monitor the content,” that content has to arrive at the servers in the clear — and then it’s not end-to-end anymore. There is no third option: either it’s illegible to the platform, or it’s legible. The ANPD didn’t criminalize encryption; it merely made it impossible to offer real encryption and operate in Brazil at the same time. Saying “they banned cryptography” is technically wrong. Functionally, it’s exactly what happened.

And I’m not the one saying it. Carlos Affonso Souza, director of ITS Rio, told CNN Brasil this is the first time the ANPD has treated end-to-end encryption as a regulatory obstacle, a dangerous precedent comparable to the WhatsApp blocks — and that criminals will simply migrate to less cooperative platforms with no legal presence in the country (did someone say Telegram?).

To be fair to the debate: the law’s text never mentions encryption once, and art. 34, §1 expressly forbids “massive, generic or indiscriminate surveillance mechanisms.” Fact-checkers debunked the rumors that the Digital ECA Law would read your WhatsApp. All of that is true — and all of that is about paper. In practice, the first major enforcement in the law’s history treated the technical impossibility of surveillance as grounds to kill a feature. Paper accepts anything; the enforcer’s pen is what writes the real law.

And there are hooks in the letter of the law waiting to be used: art. 18, III requires parental-control tools to “identify the profiles of adults with whom the child or adolescent communicates” — explain to me how an end-to-end encrypted messenger complies with that. Art. 27 orders providers to “remove and report” abuse content “detected” directly or indirectly — and detection presupposes seeing. Neither has been used yet. The Go Live precedent shows how they’ll be read when they are.

Remember this: the ANPD didn’t ban encryption. It banned a feature whose encryption prevents content surveillance. The practical effect is identical: in Brazil, end-to-end encryption is now a regulatory risk.

Digital ECA Law vs. the LGPD

The bigger irony is institutional. In 2018 we passed the LGPD to protect Brazilians’ personal data, built on principles like minimization (collect only what’s necessary) and purpose limitation (use it only for what it was collected for). The Digital ECA Law, enforced by the same agency, pushes the other way.

Age verification is the crystal-clear example. “Self-declaration is forbidden” means every user, adults included, will have to prove their age to access ordinary services. Prove it how? ID documents, facial biometrics, verifiable credentials. Gazeta do Povo heard experts warning about the obvious: we’re building a permanent identification infrastructure for everyone on the internet, with biometric data that, once leaked, can’t be changed — you can change a password, you can’t change your face.

And it’s not theory. An open letter signed by 438 scientists from 32 countries calls these systems “useless and dangerous”: trivially bypassed with VPNs and deepfakes, biased against minorities. And it cites the perfect example — Discord itself, which leaked ID photos of ~70,000 users precisely because of outsourced age verification. The platform the ANPD is punishing for not surveilling is the same one that proved, in practice, the cost of collecting.

The law has safeguards on paper — art. 13 limits the use of verification data “solely for that purpose,” art. 12 talks about minimization. But notice the structural conflict of interest: the ANPD holds three mandates: LGPD, Digital ECA Law, and Marco Civil. The agency that should defend the minimization of your data is the same one now demanding you hand it over. When those two roles collide inside the same body, which one do you think wins?

The other law of August 6: using a VPN now weighs on your sentence

Remember how the ceremony where the First Lady demanded the block was the signing of another law? It’s worth looking at what else was signed that day, because one article of PL 3066/2025 went almost unnoticed outside the tech bubble: art. 226-A, which raises sentences by one third to two thirds for crimes under the Child and Adolescent Statute committed using proxies, VPNs, or any IP-masking or anonymization technique.

Ayub, who has followed digital legislation for years, sounded the alarm back in May, when the Chamber of Deputies approved the text: “it provides prison for anyone who develops or provides VPN services. You can’t say I didn’t warn you.”

One clarification matters here, because checking sources is what separates analysis from panic. The original draft by congressman Osmar Terra did criminalize developing, distributing, or selling IP-masking software — in practice, it turned the VPN-developer profession into a crime. But the bill went through a technical working group that heard the Federal Police, prosecutors, the child-safety NGO Safernet, and the platforms themselves, and the final rapporteur, congresswoman Rogéria Santos, removed the development criminalization and kept only the sentence enhancer, with an express safeguard for lawful use. Ayub’s tweet describes the bill that went into the Chamber, not the law that came out. His warning, though, captured the direction — and the direction held.

Because what survived is already plenty. ISOC Brasil pointed out (ISOC is the Internet Society) that the enhancer puts VPN use on the same penal footing as armed robbery. And an open letter to the Senate, signed by the EFF (Electronic Frontier Foundation), the Tor Project, Artigo 19, Data Privacy Brasil, and half a dozen other organizations, explained the obvious to anyone in the field: proxies and VPNs are standard corporate security infrastructure, recommended by international standards like ISO/IEC 27001; identifier anonymization is a native feature of browsers like Firefox and Brave; and your employer probably requires you to use a VPN to work from home. The Senate didn’t listen. On August 6, the article became law — at that very ceremony.

The sentence from the letter that should haunt any legislator: “legal precedents rarely remain confined to the hypothesis that justified their creation.” In the letter’s formulation, it’s the first time Brazilian criminal law treats a neutral security technology as, by itself, grounds for a harsher sentence. Today the hypothesis is crimes against children — the one nobody dares question in public, and the bill’s authors knew it. Tomorrow it’s any crime. The next congressman who wants to enhance theft “committed through VPN use” already has the precedent ready, voted and signed.

And notice the ingenuity, identical to the encryption play: nobody banned VPNs — a direct ban would be indefensible. A mechanism was merely created to treat VPN users as qualified suspects. Think about the execution: to apply the “lawful use” safeguard, the State first needs to know you use a VPN and then determine whether your use was lawful. In other words, every user of a privacy tool becomes, by default, a potential object of verification. The safeguard doesn’t protect the user — it authorizes their inspection.

And there’s a fine irony to close: the 438-scientist letter I mentioned in the previous section warns that age verification is bypassed with VPNs. The Brazilian legislator’s answer wasn’t to rethink age verification. It was to half-criminalize VPNs. The siege closes from both sides, always with the same little plaque of good intentions nailed on top.

Remember this: nobody banned VPNs in Brazil. Something subtler was created: the first criminal-law precedent where using a neutral privacy tool weighs against you. Today it enhances crimes against children. The precedent itself has no owner.

And the actual criminals?

There’s a contradiction in this story that almost nobody commented on. The sanction against Discord came down in six days, with a potential R$ 50 million fine per infraction. And what happens to the perpetrators of the crime that motivated all of this?

The Naviraí group was made up of five teenagers aged 13 to 17 and one 18-year-old. The alleged leader is 14. Under Brazilian law, only the 18-year-old answers as an adult, for qualified homicide. The other five fall under the ECA regime — the classic one, not the digital one: socio-educational internment, with a three-year ceiling and compulsory release at 21. The case is sealed and we don’t know what measures were applied, but that’s the ceiling, no matter the cruelty. The intellectual mentor of the Suzano school massacre, with 10 dead, was 17 and was interned — three years, regardless of the body count.

And there’s a calendar irony: in February 2026 Brazil signed a law making online inducement to suicide and self-harm a heinous crime, with doubled penalties for group leaders. For adults. For the five Naviraí teenagers, investigated for exactly that, nothing changes: the ceiling is still the ECA’s three years.

It stays this way by choice, and not for lack of trying. In March 2026, the rapporteur of the Public Security constitutional amendment included a referendum on lowering the criminal age to 16; the government called the reduction “ineffective and unconstitutional” and the passage was stripped so the amendment could pass — approved 487 to 15 without a single line on the subject. In June, the Chamber’s Constitution and Justice Committee approved the admissibility of another reduction amendment, 44 to 18, but it still needs 308 votes in two plenary rounds — exactly the wall where the 2015 version died. Even the middle way stalls: the bill PL 1.473/2025, which would raise maximum internment from 3 to 5 years (10 for violent crimes), passed the Senate in October 2025 and has been sleeping in the Chamber ever since.

Meanwhile, organized crime does the math. Factions recruit teenagers on purpose, because they know the ECA shields the triggerman: in the faction attacks in Ceará, adults paid R$ 1,000 to R$ 5,000 per attack for teenagers to torch vehicles — the boss doesn’t expose himself, the executor doesn’t go to prison. The Naviraí group is the digital version of the same logic: a 14-year-old leader coordinating crimes that, committed by an adult, would mean decades in prison.

And Brazil has become an outlier even in its neighborhood. Argentina approved lowering the age from 16 to 14 in February. Sweden, of all countries, dropped to 13 for serious crimes starting in July — after gangs started recruiting children on Snapchat for attacks precisely because they couldn’t be prosecuted. England prosecutes from age 10 (though its own Bar Council wants to raise it to 14), most American states transfer 14-year-olds to criminal court for murder, Portugal at 16.

For the record, the other side exists: UNICEF came out against the reduction, and the recidivism data is uncomfortable for both sides — ~43% after internment, ~70% after regular prison. If we’re going to debate the model, let’s debate it. What doesn’t fly is the current result: a new law managed in six days to take offline a feature used by millions of innocent people, while the system that punishes the perpetrators hasn’t moved in thirty years. We punish the pipe because the pipe is what’s within reach.

Remember this: six days to sanction a platform used by millions of innocent people; thirty years without touching the ceiling for those who committed the crime.

Meanwhile, at the Supreme Court: source protection breached

If it were only Discord, you could call it a regulatory accident. But in the same week, another pillar fell.

Since November 2025, journalist Luís Pablo, from Maranhão, had been publishing reports about the use of an official car of the TJ-MA (Tribunal de Justiça do Maranhão, the Maranhão state court) by Supreme Court minister Flávio Dino and family members. In March, Alexandre de Moraes authorized a search and seizure against the journalist — in a decision that cited the fake news inquiry, which the Court’s press office later denied. Phones, a notebook, and a pen drive seized. In April, the equipment was returned, but the forensic analysis continued.

On August 11, the Federal Police served warrants against Raimundo Cutrim, Maranhão’s former security secretary — identified as the journalist’s source. How did they get to him? Through the analysis of the journalist’s seized devices.

See the mechanism? Article 5, XIV of the Constitution protects source secrecy, and the journalist can refuse to reveal it — as he did, staying silent in his deposition. So they didn’t ask. They seized his work material, read everything, and identified the source behind his back. Constitutional scholar Vera Chemin summed it up on CNN: “you cannot breach the secrecy first and then check whether a crime occurred.”

The Supreme Court itself has ruled this, more than once. In a 2019 constitutional case (ADPF 601), Gilmar Mendes protected Glenn Greenwald during Vaza Jato with a sentence that should be framed: source secrecy “prevents the State from using coercive measures to constrain professional activity and to rummage through the way in which what is brought to public knowledge is received and transmitted.” “Rummage through the way it is received” is literally what the forensic analysis of the devices did.

For the record, the Court’s defense exists and deserves to be presented: the investigation targets the illegal monitoring of a minister and his family, with license plates, security agents’ names, and clandestine images of children published; the Federal Police says Cutrim used his public office to access restricted systems; and there’s a R$ 100,000 transfer from a second suspect to the journalist, whose nature nobody has proven yet. The files are sealed, so neither version is verifiable from the outside. There may be a crime there. But that’s exactly why the order of operations matters: first you investigate by lawful means, then — maybe, in the most exceptional cases — you discuss exceptions. Reversing that order turns the exception into the method.

The reaction was the usual one, only louder: the press associations Abraji, ANJ and ABERT, the Inter American Press Association, and editorials from the country’s three biggest newspapers on the same day. Estadão wrote that the fake news inquiry “has been converted into an instrument of intimidation.” Miro Teixeira, the lawyer who struck down the dictatorship’s Press Law in 2009, said the Court is acting “momentarily as a tribunal of exception”.

Remember this: source secrecy wasn’t repealed, it was bypassed. Nobody coerced the journalist; they seized his devices and the source surfaced in the forensics. The guarantee still exists, but only on paper.

Conclusion: is Brazil becoming a censored country?

It’s the pattern that worries me, not the isolated episodes. In 2024, X spent a month offline in Brazil by monocratic order. In 2025, art. 19 of the Marco Civil fell and platform liability went proactive. In 2026, the Digital ECA Law handed the Executive a package of obligations so intrusive that, the first time it was used, it took down an encrypted feature nationwide — while the 14-year-old leader of the group that motivated the sanction faces, at most, three years of internment. And journalistic source secrecy was breached forensically, with the blessing of the same court that enshrined it.

Every rung of that ladder has a sympathetic justification, and that’s exactly why the ladder is dangerous. Nobody builds censorship infrastructure saying it’s for censorship. You build it to protect children, to protect ministers, to protect democracy.

The problem is that infrastructure has no moral owner. The ruler that measures Discord today measures any app tomorrow. The enforcement that demands plaintext streams today to protect Lívia will demand plaintext for whatever the government of the day wants to see. The source breach that catches the Dino case’s source today catches any source, in any case, against anyone.

And the week’s most revealing detail: of the two platforms the Ministry of Justice asked to investigate, the sanctioned one is the one with an office, a tax ID, and lawyers in Brazil — the one that cooperates. The message the regulator sent the market is inverted: cooperating exposes you; being opaque protects you. The teenagers from the Naviraí neo-Nazi group aren’t going anywhere — they’re going to Telegram, which nobody touched.

And there’s the most Brazilian trait of all in this arrangement: it became impossible to be on the right side of the law. If you truly protect your users with end-to-end encryption, you violate the Digital ECA Law. If you comply with the Digital ECA Law, you open up your users’ data and violate the LGPD. If you collect IDs for age verification, you become a leak target and a sanction target; if you don’t collect, you become an enforcement target. There is no safe configuration.

And that’s a tradition of ours: laws so broad, with so many stacked exceptions, that anyone becomes an offender by accident on any street corner. When everyone is always in violation, the law stops being a rule and becomes an option — real power migrates to whoever chooses whom to apply it against. That’s what happened this week: two platforms investigated, one punished. The one with a local address.

Protecting children is a non-negotiable civilizational duty. Investigating crimes against a minister is the State’s obligation. The question that remains isn’t whether those causes are legitimate — they are. It’s whether Brazil can still pursue legitimate causes without demolishing the guarantees that make the country a liberal democracy: real privacy, functional encryption, a press with protected sources. This week, the answer was no three times in a row.

It’s not regime censorship. In a way it’s worse: it’s censorship by accumulation, voted, signed, and applauded, every brick carrying a little plaque of good intentions. And you only notice the wall when it’s already around you.