Children's Data and AI Under Brazil's LGPD: What Article 14 Requires

Children's Data and AI Under Brazil's LGPD: What Article 14 Requires

Children's data and AI are not off limits under Brazil's LGPD, but Article 14 requires that any processing be done in the best interest of the minor. For children, that includes specific, prominent consent from at least one parent or legal guardian, information in accessible language, and collection limited to what is strictly necessary. In practice, anyone who serves minors through a chatbot or WhatsApp needs to know who they are talking to, collect little, explain clearly, and keep a person responsible for sensitive cases.

Key takeaways

• Article 14 applies to any processing of minors' data, including when an AI agent does it during customer service.
• The central test is the best interest of the child or adolescent, not the convenience of the company's flow.
• For children, consent from a parent or guardian must be specific and prominent, and the company must make reasonable efforts to verify it.
• Information about the processing must be public and simple, suited to the reader's understanding, and you cannot require more data than the activity needs.
• For AI, the practical safeguards are: limit collection, avoid reusing minors' conversations for other purposes, keep records of what happens, and provide a handoff to a person.

What Article 14 says, in operational terms

The text of the law is short, and it is worth reading in full from the official source. Here is what it asks for, translated for someone running a customer service operation.

First, the main provision: processing of children's and adolescents' data must happen in their best interest. This works as a general yardstick. If a flow collects data only because it would be useful for marketing, and not because the minor needs to provide it for the activity, it probably fails the test.

The paragraphs that follow add more concrete obligations:

• Specific and prominent consent from at least one parent or legal guardian to process a child's data.
• Public information about which data is collected, how it is used, and how to exercise data subject rights.
• An exception to collect data without consent only when necessary to contact the parents or to protect the child, with a single use, no storage and no sharing with third parties.
• A ban on conditioning participation in games, applications or activities on providing more data than is strictly necessary.
• Reasonable efforts to verify that consent really came from the guardian, considering the available technology.
• Information given in a simple, clear and accessible way, suited to the child's understanding and useful to the parents, with audiovisual resources when they make sense.

For the purposes of the law, Brazil's Child and Adolescent Statute treats a child as someone under twelve years old and an adolescent as someone between twelve and eighteen. The split matters because the Article 14 text on specific parental consent speaks expressly about children.

Adolescents too: what about consent?

This is a point of debate. The consent paragraph mentions children, but the main provision protects both children and adolescents. ANPD, Brazil's national data protection authority, has indicated that processing minors' data can rely on other LGPD legal bases, as long as the best interest is observed and documented. Check the current position directly on the ANPD website, because guidance of this kind is updated.

There is also more recent legislation aimed at the digital environment and minors. It may add duties for products and services that children and adolescents can access. Confirm this with legal counsel before designing the flow. This article does not settle it.

A useful separation for your team:

• Official documentation: the text of Article 14 and ANPD guidance.
• Implementation experience: how the flow behaves in production, what the logs reveal, where minors show up unexpectedly.
• Hypothesis: any legal interpretation that your legal counsel or data protection officer has not yet validated.

Mixing these three layers is the most common mistake in internal policies.

Does your company serve minors without realizing it?

Many companies say they do not serve children because their audience is adult. But an open channel such as WhatsApp does not filter by age. A few examples of how minors enter a flow uninvited:

• A teenager writes to a school, course, clinic or clothing store and shares their name, school, address and personal questions.
• A child uses a parent's phone and talks to the company's AI agent as if they were the customer.
• An education, sports, health or leisure business registers minors as students or patients, and the chatbot answers parents and children on the same number.

So the first question is not whether your policy covers minors, but whether your flow can notice when a minor is in the conversation. For schools, it is worth reading about AI for schools: admissions and parent communication, where the relationship with guardians is part of the design.

Practical checklist for chatbots and AI agents

This checklist turns Article 14 into design decisions. It does not replace legal advice, but it helps organize the conversation with your data protection officer.

• Define the audience: is the service built for minors, does it accept minors, or might it only receive them by accident? Each case calls for a different level of control.
• Collect the minimum: list every field the agent asks for and justify why it is needed. If the justification is only that it is useful, remove it.
• Separate the guardian's contact from the minor's data: whenever possible, the relationship is with the adult, and the minor appears only as necessary information.
• Request and record the guardian's consent prominently, not buried in a block of terms.
• Verify with reasonable effort: the method should be proportional to the risk of the flow. A simple sign-up and a health consultation do not call for the same rigor.
• Write the privacy notice in plain language, and if the audience includes children, add a version they can understand.
• Do not condition service on extra data: if the minor only wants to ask a question, the agent should not ask for a tax ID, address or photo.
• Do not reuse minors' conversations to train models, personalize ads or feed other flows without a legal basis and a specific assessment.
• Define what the agent never does with a minor: collect sensitive data, make decisions that affect rights, keep pushing when the minor asks to stop.
• Keep retention short and deletion clear: minors' data should not be stored by default.

Illustrative scenario: a language school on WhatsApp

Illustrative scenario, not tied to any real company. A language school uses an AI agent on WhatsApp to answer questions about classes and schedules. Its audience includes children and teenagers, but the person who signs the contract is always the guardian.

In the first design, the agent asked for the student's full name, age, school and address in the very first message, and kept the entire history. When the team reviewed the flow against Article 14, they realized that age range and city were enough to answer questions about classes and schedules. The rest was only needed at enrollment, which is done with the guardian.

The revised flow works like this: the agent asks whether the person writing is the guardian. If it is a minor, the agent gives only general information, explains that enrollment and student data are handled with the guardian, and offers a human contact. The privacy notice was rewritten in plain language and conversation logs now have a defined retention period.

The minor's best interest is the test for the flow, not the company's convenience.

The expected result is not a chatbot made timid by fear, but one that knows when to stop, when to ask and when to call a person.

How to apply the method: map, limit, pilot and hand over

The working method we use for AI agents in companies fits this topic well, without promising any legal outcome.

• Map: describe the current process, who makes contact, through which channels, and where a minor might appear. List the data collected today and where it is stored.
• Limit: reduce the agent's data and actions. Define what it may answer for a minor, what it can only handle with the guardian, and what it never does. This is the moment to apply the data minimization principle.
• Pilot: run a real flow with logs and an agreed success metric, for example the share of conversations in which the agent correctly identified that it was talking to a minor and handed off. Review real conversations before expanding.
• Hand over: deliver the operation with named owners, a record of decisions, and a criterion to expand, adjust or stop.

For the technical protection layer, cross-check this topic with guardrails for AI agents, which cover validating the agent's inputs, outputs and actions. When the flow involves tools and external data, the OWASP Top 10 for LLM applications helps you review information leakage and misuse of tools. For broader risk management, the NIST AI Risk Management Framework offers a reference base.

Where AI needs extra care with minors

Some technical points deserve specific attention when minors are in the flow.

• Providers and countries: if the model or tool processes data outside Brazil, the international transfer rules add to Article 14. See international data transfer under LGPD when using AI providers.
• Automated decisions: if the agent classifies, denies or prioritizes something that affects the minor or their family, the right to review under Article 20 comes into play. The article on LGPD automated decision-making covers the point in detail.
• Media and audio: photos, voice and video of children are identifying data. Avoid requesting or processing this material unless it is indispensable.
• Agent memory: if the system keeps context between conversations, define what can be remembered about a minor and for how long.
• Connected tools: an agent with access to registration, scheduling or billing should have restricted permissions, so it does not expose the minor's data to people who should not see it.

What not to leave to AI alone

There are situations where the agent should only recognize the context and pass the conversation to a person:

• Reports of risk, violence, distress or health concerns involving the minor.
• A guardian's request to delete, access or correct data.
• Doubt about who the legal guardian is, or conflict between guardians.
• Any request involving the minor's sensitive data, image or location.

Keeping a record of these handoffs to a human is part of the evidence that the flow was designed with care.

Frequently asked questions

Does the LGPD prohibit an AI chatbot from talking to children?

There is no general prohibition. What the law requires is that data processing be done in the minor's best interest, with suitable information, minimal collection and, for children, specific consent from a parent or guardian, except for the exceptions in Article 14 itself. If the chatbot does not need the minor's data, the best design is not to collect it.

Do I always need parental consent to process teenagers' data?

The Article 14 text on specific consent speaks about children, and ANPD has indicated that other legal bases may be used for minors, as long as the best interest is respected. Because guidance can change and there is recent legislation on the digital environment, confirm the legal basis for your case with your data protection officer or legal counsel before defining the flow.

How do I know if I am talking to a minor on WhatsApp?

You cannot always know for certain, and the law asks for reasonable efforts, not guesswork. You can ask in simple terms whether the person writing is the guardian, limit what the agent does when there is doubt, and hand off to a human any case involving the minor's data. See also how to structure the connection in how to integrate AI into your company's WhatsApp.

Can I use conversations with minors to improve the AI agent?

Only with great caution and a specific assessment. The minor's best interest and data minimization make it risky to reuse those conversations for other purposes, such as training or profiling. The safest path is to set short retention, anonymize when possible, and have the data protection officer document the decision.

Sources

• ANPD: Autoridade Nacional de Proteção de Dados
• NIST AI Risk Management Framework
• OWASP Top 10 for LLM Applications