Monitoring another person's conversation can be a perfectly legal act or a crime punishable by imprisonment, and the difference between the two is narrower than most people imagine. This guide details the legal framework: what the criminal offense is, what the penalties are, what aggravates the offense, what the law authorizes, and what happens in practice to those who cross the line.
The criminal offense: Article 154-A of the Penal Code
Invading someone else's computer device, whether connected to a network or not, with the aim of obtaining, altering, or destroying data without the express or tacit authorization of the owner, is a crime. (The current wording, given by...) Law 14.155/2021, provides for a penalty of Imprisonment from 1 to 4 years and a fine..
The rule originated with Law 12.737/2012 and was toughened in 2021 — previously, the penalty was imprisonment for three months to one year. The increase in penalties followed the growth of digital crimes in the country.
Which makes it worse
- If the invasion results in obtaining content of private communications, For violations of trade secrets or confidential information, the penalty increases to imprisonment from 2 to 5 years and a fine.
- If there is dissemination, marketing or transmission of the material obtained, it increases by one to two thirds.
- If the victim is a government official, there is an additional increase provided for by law.
In practice, those who install a program to read messages and then show the screenshots to third parties usually fall under the aggravated form of the crime, not the simple one.
The other devices that affect
Constitution, Article 5, XII
It protects the confidentiality of correspondence and telegraphic, data, and telephone communications. Breaching this protection is the exception and depends on a court order.
Law 9.296/96
It regulates the interception of communications. It is only permitted by court order, for criminal investigation or criminal procedural instruction. Intercepting outside of these conditions is a separate crime, punishable by imprisonment from 2 to 4 years and a fine.
General Data Protection Law
Processing personal data without a legal basis generates administrative and civil liability, in addition to criminal liability.
Civil Code
Violation of privacy justifies a claim for compensation for moral damages, regardless of the outcome of the criminal proceedings.
What the law authorizes
- Minor child. Parental authority underpins supervision. The practical recommendation is to do so explicitly and using official tools.
- Consenting adult. Consent must be freely given, informed, specific about what will be collected, and revocable at any time. Consent obtained under duress is invalid.
- Corporate device. With a written policy, communicated to the employee and limited to professional use. Personal devices are not allowed.
- A conversation in which you participated. Recording one's own conversation and using it as evidence is permitted, except in cases of specific confidentiality requirements.
- Your own device and your own records. Without restriction.
What happens in practice to those who invade?
The evidence is discarded.
Evidence obtained through illegal means is inadmissible and must be removed from the case file, also contaminating anything derived from it. In family law cases, it is common for such material to simply not be considered.
The play becomes a documented confession.
By including screenshots obtained through hacking, the party is essentially recording their own conduct in the case file. The material that should be used for accusations then becomes evidence against the party that produced it.
The exposure multiplies.
This includes criminal charges, compensation for moral damages, and, when there is disclosure to third parties, the aggravated penalties stipulated by law. It is common for the final result to be worse than the original problem.
The legitimate path when information is truly necessary.
- Lawyer first. It's up to them to know what evidence is admissible in their type of case.
- Notarial deed. For what's on your device, the notary public certifies the screen content. It withstands allegations of manipulation much better than a screenshot.
- Breach of confidentiality by court order. The judge evaluates and grants the request when the case warrants it; the data arrives from the operator or platform with a chain of custody.
- Early production of evidence. An appropriate procedural tool when there is a risk of information disappearing.
There's a clock ticking: the Brazilian Internet Bill of Rights establishes a minimum retention period of one year for connection logs and six months for application access logs. After that, the data may no longer exist.
Child supervision: the official tool
For legal and legitimate uses, there is a free solution. Google Family Link It controls screen time per app, requires approval for installations, filters content, and displays the location, remaining visible on the child's device. On the iPhone, the Usage Time It does the equivalent.
Frequently Asked Questions
What is the penalty for hacking into someone's cell phone?
Imprisonment from 1 to 4 years and a fine. The sentence increases to 2 to 5 years if the content of private communications is obtained, and increases by one to two-thirds in case of disclosure.
Does it apply to both husband and wife?
Yes. The criminal offense does not make exceptions based on marital ties, and the property regime does not affect the confidentiality of communications.
What if the cell phone doesn't have a password?
The absence of a password does not equate to authorization. What the law requires is the consent of the data subject, whether express or implied.
Can a printout serve as proof of infidelity in a divorce?
Besides tending to be dismissed when obtained through encroachment, divorce in Brazil does not require proof of fault. In most cases, the effort is legally futile.
Does the person selling the program also have to answer for it?
Responsibility falls on whoever installs and uses the device. Buying from a known supplier does not absolve the perpetrator of criminal liability.
In summary
The line is clear: minor children, valid adult consent, informed corporate devices, and their own conversations are within the law. Everything else is an invasion of computer systems, punishable by imprisonment, inadmissible evidence, and civil exposure. When information is truly necessary, there is a legal route—slower, and the only one that produces usable evidence.
What to do, in order.
- Set a limit per application, not just a total limit. Allowing free study time and restricting short video time works better than a single limit.
- Review the agreement every few months. Limits that don't match age become a source of conflict and challenges.
- Use the official tool. Google Family Link on Android and Screen Time on iPhone: free, visible on the device, and without requiring you to disable any protection.
- Enable installation approval. It prevents new apps from appearing without your knowledge, which is half the problem.
Where most people slip
- Installing hidden software on an adult's cell phone is a crime under article 154-A, punishable by 1 to 4 years imprisonment.
- Disabling Play Protect to install files from outside sources is the most common vector for banking trojans.
- Relying on evidence obtained through unauthorized access in a legal proceeding—it is discarded and exposes whoever produced it.
- Don't believe promises of monitoring based solely on a phone number; it doesn't exist.
The alternative that is already included in the system
To find a lost device, Find My Device and Find My iPhone are free and come standard: they sound an alarm even when the device is on silent, show it on a map, and remotely lock and erase it. It's worth checking today if they are activated — once lost, you can't configure them anymore.
