Internet use is already part of the school routine. Educational platforms, Wi-Fi networks, mobile devices, and online tools are present in the daily lives of students, teachers, and administrative staff. As this presence grows, digital security in schools ceases to be merely a technical concern and becomes an institutional responsibility.
With the enactment of the Digital ECA (Law 15.211/2025) , this responsibility gained legal backing. The legislation expands the protection of children and adolescents in the online environment and increases the level of requirements regarding how schools use technology and manage data. In practice, schools and IT teams need to go beyond the basics: it is necessary to guarantee control, visibility, and protection in internet use and understand exactly what this law stipulates.
What is the Digital ECA?
The Digital ECA is Law No. 15.211, enacted on September 17, 2025, and in effect since March 17, 2026. It updates the Statute of Children and Adolescents for the online environment , creating specific rules to protect children and adolescents on the internet in social networks, applications, games, app stores, streaming platforms, and other digital services accessible to this audience.
In the school context, the concept of a digital platform is broader than it seems. Any digital environment capable of mediating interactions between children and adolescents, storing content, facilitating communication, or allowing the creation and circulation of educational or non-educational information that may influence behavior or decision-making, falls under this definition. This includes everything from LMSs and video lesson platforms to WhatsApp groups used for communication with families.
The central idea of the law is that platforms can no longer treat children and adolescents as "ordinary users." They now have special duties of protection, recognizing that this group is in a more vulnerable position in the digital environment. The Ministry of Justice summarizes this as a shared responsibility between family, society, the state, and platforms, and it is precisely in this division of responsibilities that schools come into play.
In practice, the main changes brought about by the law are:
- Control over inappropriate content: platforms need to adopt measures to reduce minors' exposure to inappropriate content and act with priority in cases of rights violations.
- Age verification: the law provides for more reliable mechanisms to identify whether the user is a child, adolescent, or adult. The ANPD (National ) has already published preliminary guidelines, seeking a balance between technical accuracy and privacy protection.
- Parental supervision tools: digital services should offer effective resources for caregivers to configure blocks and limits, supporting more active mediation by families.
- Safety by default: products and services should be designed with technical and organizational measures proportionate to the risk for each age group. Protection needs to be built into the design from the start, not added later as an optional feature.
- Restrictions on targeted advertising: regulations prohibit techniques such as profiling and emotional analysis for advertising aimed at children and adolescents.
- Rapid response in serious cases: In situations involving sexual abuse, enticement, or exploitation, companies are required to remove the content and notify the relevant authorities.
Oversight falls primarily to the ANPD , designated as the administrative authority for the protection of minors in the digital environment. Non-compliance can result in administrative fines of up to R$ 50 million , in addition to reputational damage that, in practice, is often even more difficult to reverse.
In summary: the Digital ECA is not limited to removing inappropriate content. It requires that digital services be redesigned to prevent risks from the outset.
The new scenario: digital responsibility also belongs to schools
The shared responsibility established by the ECA Digital (Brazilian Statute for Children and Adolescents) doesn't fall solely on the large platforms. Schools are also part of this equation, and for an objective reason: the educational institution acts as the main connecting node between platforms, families, and students. Legally, it is responsible for the entire digital environment it uses or tolerates for pedagogical or communicative purposes.
This responsibility applies to two very distinct types of environment. The first is the institutional ecosystem : tools contracted by the school, over which it has direct control regarding moderation and privacy. The second is third-party tools , such as WhatsApp, whose tolerated or encouraged use for school purposes transfers responsibility to the institution. The legal guideline is clear: prioritize official channels and, when this is not possible, establish strict moderation rules for non-institutional tools.
This distinction is important because it defines where IT can and should operate. Institutional tools can be configured, monitored, and audited. Third-party tools without governance are blind spots, and blind spots are risks. Recognizing which digital environments the school uses and what control it has over each of them is the starting point for any serious diagnosis.
In practice, the school's responsibility encompasses everyday situations, such as:
- Use of social media in school activities
- Sharing student images on institutional or teachers' personal channels
- Internet access on the school network
- Use of digital educational platforms
- Communicating with families via messaging apps
The risk is not just technical; it's also legal and reputational. And to accurately assess it, it's necessary to look at the types of risks that the digital school environment can generate, and where schools are still failing to mitigate them.
Digital security in schools: a challenge beyond theory
Once the environments for which the school is responsible are understood, the next step is to map the risks that these environments may generate. Digital protection has evolved from a logic of reacting to incidents to building preventive governance, but in practice, a large part of schools still operate in a reactive model: acting when something goes wrong, without processes or tools to anticipate problems. Five risk axes structure this challenge:
- Content: age-appropriate. The risk lies in accessing sensitive topics without the necessary maturity, such as a student in the early years accessing content about eating disorders or other sensitive topics that could generate anxiety and distress.
- Contact: dynamics of interaction and risk of enticement, harassment, and offenses. The school needs to clearly define who speaks to whom within the platforms it uses.
- Conduct: ethical behavior among students themselves. This includes preventing and combating bullying and cyberbullying within the school's digital environments.
- Contract: transparency in data usage. Every platform used needs to be analyzed regarding how it collects and processes data from minors, in accordance with the LGPD (Brazilian General Data Protection Law) and the ECA Digital (Brazilian Statute for Children and Adolescents).
- Commerce: practices of addiction and consumption. This includes exposure to harmful gambling and gamification, platforms that use messages like "don't leave here, you'll lose everything" to induce digital addiction.
These risks do not affect all students in the same way. Children and adolescents in situations of greater socioeconomic vulnerability may be more exposed to digital risks, often with less access to guidance and support networks. When the school fails in digital protection, they are the ones who pay the highest price.
But to mitigate these risks, the school needs someone to manage them with technical competence and strategic vision. That's where the IT area comes in, playing a role that most institutions haven't yet properly defined.
The role of IT in protecting students and data
The five risk axes described above—content, contact, conduct, contract, and commerce— have one thing in common: they all, to some degree, pass through the school's IT infrastructure. It is in the network, systems, and digital tools that protection begins or fails. Therefore, the IT area can no longer act only reactively. The Digital ECA (Brazilian Statute of Children and Adolescents) demands a preventive and continuous approach, in which digital security is an integral part of the operation, not an appendage activated in crisis situations.
In practice, this new role involves:
- Define and enforce internet usage policies by user profile
- To control and monitor access to the school network continuously
- Preventing access to inappropriate content before harm occurs
- To ensure the secure storage of student data in compliance with the LGPD (Brazilian General Data Protection Law)
- Audit all platforms used by the school according to the criteria of the five risk axes
- To ensure explainability and human oversight in the use of artificial intelligence, including in tools for content personalization or automatic test correction
Beyond IT, compliance requires an adequate governance structure. This includes the appointment of a DPO (Data Protection Officer) to oversee data protection and the creation of specific committees to monitor compliance with the Digital Statute of Children and Adolescents (ECA Digital), distinct roles that need to function in a coordinated manner. Every technological choice made by the school must be preceded by a documented justification for risk mitigation, especially when it involves minors.
With this structure in place, IT ceases to be merely operational and begins to act directly in protecting students and ensuring institutional compliance. The most immediate aspect of this action, and where most schools need to act first, is controlling internet access.
Internet access control: the starting point
If IT needs to act preventively, internet access control is where that prevention begins. Without it, any user connected to the school network can access social media without restriction, inappropriate content , malicious websites, and unmoderated platforms, and the school has no way of knowing what is happening, nor of demonstrating that it tried to prevent it.
This scenario is especially critical considering that children and adolescents are often still developing and unable to recognize the risks to which they may be exposed. The absence of control is equivalent to leaving a door open, and the Digital ECA (Brazilian Statute for Children and Adolescents) is clear: keeping that door open can have legal consequences for the institution.
With proper control, the school can:
- Automatically block categories of inappropriate content by age rating
- Define navigation rules by profile (students, teachers, administrative staff)
- Having visibility into traffic and identifying risky behaviors in real time
- Reducing distractions and improving focus in the classroom
- Protecting students from digital threats before they cause harm
- Generate auditable records that prove the school's performance in case of questions
Access control, therefore, ceases to be a matter of productivity and becomes an essential measure of security, legal compliance, and documentary evidence. But it is only one side of the equation. The other, equally sensitive and often underestimated, is what the school does with the images and data of its students.
Image exposure and misuse of data
While access control protects students from what enters the network, image and data protection safeguards what leaves it. The ECA Digital (Brazilian Statute for Children and Adolescents) clearly reinforces that the use of images of children and adolescents requires authorization and that the absence of this control generates liability. This is an issue that many schools still address based on generic clauses in enrollment contracts, without the legal rigor that the law now demands.
Compliance begins with granular consent: authorization for the use of images must be specific and separated for three distinct purposes: educational, commercial, and social media. A generic authorization at the time of enrollment is no longer sufficient.
Schools need to pay extra attention to certain critical points:
- Publishing photos of students on social media or institutional websites without specific consent for that purpose
- Sharing images in WhatsApp groups or communication platforms without access control
- Allowing teachers to post images of students on personal profiles requires authorization from families, not from individual professionals
- Using platforms that collect or store student data without prior compliance analysis with the LGPD (Brazilian General Data Protection Law) and the ECA Digital (Brazilian Statute of Children and Adolescents)
There is still a risk of misuse by third parties. Once published without control, the images can be downloaded, edited, and used in ways the school never imagined, including deepfake situations or digital exploitation via AI. The recommendation is to prioritize group photos or photos taken at angles that preserve the physical and emotional safety of the minor, and to inform families about these risks in a clear and accessible way.
Knowing and mapping these risks is the first step. The second, and more demanding, step is to structure a concrete adaptation plan that transforms this knowledge into documented action.
From legislation to practice: what schools need to do
Having understood the risks in all their dimensions, the next step is to structure the adaptation. To comply with the Digital ECA (Brazilian Statute for Children and Adolescents), it is not enough to know the law: it is necessary to build an implementation journey with clear steps, involving different areas of the school and documenting each decision made. A useful reference for this is the CRIA (Child Rights Impact Assessment) methodology, which proposes that every technological choice of the school be preceded by a documented justification of risk mitigation.
In practice, the main actions are:
- Map all digital environments used by the school, evaluating each one under the five risk axes (content, contact, conduct, contract, and commerce)
- Create and document clear internet usage policies, adapted by age group
- Implement access control in the school network with auditable records
- Establish formal, granular consent processes for the use of student images
- Prioritize institutional communication channels over tools that lack privacy controls
- To empower teachers regarding the legal limits and responsibilities in the digital environment
- Communicate the compliance plan to families in a clear and accessible way, replacing dense legal documents with visual communications in simple language
Each of these actions needs to be documented. The school must be able to demonstrate that it adopts concrete protection measures, not just that it has good intentions. This documentation is essential in case of legal questions or audits by the ANPD (Brazilian National Data Protection Authority).
It is important to highlight the role of families in this process. The Digital ECA (Brazilian Statute for Children and Adolescents) recognizes parental supervision as part of protection, and schools can contribute by guiding parents on how to monitor their children's digital use. When school and family act in a coordinated manner, the protection ecosystem that the law seeks to build becomes more solid, and the institution's responsibility is better distributed. When this alignment does not exist, the school alone assumes a risk that should be shared.
Digital security as a strategic priority in schools
The actions described above are not merely responses to a legal obligation; they are the foundation of a more mature institutional stance regarding the digital environment. With the Digital ECA (Statute of the Child and Adolescent) in effect, digital security in schools ceases to be a differentiating factor and becomes a minimum operating requirement.
The pressure for compliance is likely to grow on multiple fronts. Regulatory bodies, with the ANPD (National Data Protection Authority) at the forefront, have already published guidelines and implementation schedules. Families, increasingly informed and mobilized, including by digital influencers dedicated to the topic, are beginning to act as direct monitors of the law. And the social environment surrounding online child protection is more vigilant than ever. Schools that fail to prepare will face this pressure without a solution.
The consequences of non-compliance are concrete:
- Administrative fines of up to R$ 50 million imposed by the ANPD
- Civil liability in cases of incidents involving students
- Damage to reputation with family and community is often irreversible
On the other hand, institutions that invest in control and protection are able to:
- To ensure a safer environment for all students, especially the most vulnerable
- To continuously reduce operational and legal risks
- Demonstrating digital responsibility to families, regulators, and the community
- Building a relationship of trust with families based on transparency and concrete action
The question, therefore, is no longer whether the school should act, but how to act efficiently, sustainably, and in a way that is proportionate to the reality of each institution. And the path begins with a decision that is both technical and strategic: to have control over one's own digital environment.
The path to a safer digital environment
The Digital ECA marks a new moment for education in Brazil. As shown throughout this article, the challenge of digital security in schools is multidimensional: it involves internet access, the use of images and data, platform governance, the strategic role of IT, engagement with families, and legal compliance. None of these points can be addressed in isolation; they are all part of the same protection ecosystem that the school needs to build and maintain.
To achieve this, administrators, IT teams, teachers, and families need to be aligned around a common goal: protecting children and adolescents in the online environment. The starting point is having visibility into what happens on the school network, because without visibility there is no policy, without policy there is no control, and without control there is no real protection.
DNS- based internet access control solutions help enforce these policies simply and efficiently: they allow you to block inappropriate content, manage network usage by user profile, and generate the auditable logs that compliance requires without operational complexity.
Protecting students in the digital environment begins within the school's own network and is directly influenced by the decisions of the IT team.
