A Lei nº 15.211/2025 como instrumento de proteção de crianças e adolescentes no ambiente digital : avanços, lacunas e perspectivas à luz do ordenamento jurídico brasileiro

Abstract

This paper analyzes whether Law No. 15,211/2025 fills the gaps that the Brazilian legal system left open in the protection of children and adolescents in the digital environment, or whether, despite the structural advancement it represents, normative and effectiveness shortcomings persist. It starts from the diagnosis that internet access by children and adolescents in Brazil has become early, routine, and predominantly mediated by mobile devices that are difficult for parents to supervise, a scenario compounded by legal risks classifiable under the international "4Cs" model — content, contact, conduct, and contract. Next, the regulatory framework prior to the law is reconstructed — the 1988 Federal Constitution, the Child and Adolescent Statute, the Brazilian Internet Civil Rights Framework (Marco Civil da Internet), and the General Personal Data Protection Law —, demonstrating that each statute covered only a fraction of the problem, none having been conceived, from the outset, for the digital environment as a space of child and adolescent socialization. The legislative process, structure, and core mechanisms of Law No. 15,211/2025 are then examined — age verification, privacy by default, parental supervision, and the sanctioning regime —, as well as the role of the National Data Protection Authority in its implementation and the new law's dialogue with the general repercussion thesis set by the Brazilian Supreme Federal Court in Theme 987. Finally, the law's structural advances are weighed against the normative and effectiveness gaps that persist, situating the Brazilian case alongside the experiences of the UK's Children's Code and the European Union's General Data Protection Regulation. This bibliographical and documentary research, following a deductive method, concludes that Law No. 15,211/2025 represents a real structural advance, yet insufficient on its own: a legal-basis gap remains regarding the controller's legitimate interest, uncertainty persists over the enforcement authority's budgetary capacity, and a structural mismatch endures between the pace of technological innovation and that of legislative production — such that the effective protection of children and adolescents in the digital environment ultimately depends on shared responsibility among the State, digital platforms, and the family.