The framework introduces strict notice-and-takedown protocols, expanded duty-of-care obligations, and contentious user-reporting rules that spark fierce debate over platform over-censorship and freedom of expression.
The Collapse of Article 19 and the New Legal Reality
For over a decade, digital operations in the country relied on Article 19 of the Brazilian Civil Rights Framework for the Internet, widely known as the Marco Civil da Internet. That legacy statute shielded internet application providers from third-party liability unless they defied a direct judicial order to remove content. The system intentionally prioritized expressive freedom, guarding platforms against the chilling effects of speculative legal threats.
That protective buffer has now collapsed. Following a 2025 finding that partial elements of the Marco Civil were unconstitutional, the Brazilian Supreme Court issued a clarifying ruling that firmly dismantled the old judicial-order prerequisite for everyday content moderation. Platforms curating or interfering with user posts can now face direct civil liability if they fail to remove unlawful content after receiving extrajudicial notifications from users, provided there is no reasonable doubt regarding the infraction.
Yet, the old standard hasn’t vanished entirely. According to legal analyses of the updated framework, crimes against honor—such as defamation—still demand an explicit judicial order before liability triggers. Private messaging architectures and real-time videoconference systems retain similar protections, ensuring that encrypted networks are not immediately exposed to automated takedown demands without judicial oversight.
Decoding the Presidential Decrees: Safeguards and Surveillance Risks
To flesh out the court’s directives, the executive branch published two critical presidential measures in late May: Decree 12.975, which updates Decree 8.771/2016 regarding platform duties, and Decree 12.976, targeting online violence against women. These texts attempt to implement a European-style “notice-and-action” approach while introducing intricate compliance layers.
On paper, the new rules establish robust due process requirements. Platforms must issue transparent notifications to both the notifier and the content author whenever material is yanked down or kept online, complete with an explicit appeals path. Furthermore, Decree 12.975 instructs applications to maintain content when a genuine, reasonable doubt exists regarding its illegality, specifically protecting satire, religious expression, and educational discourse.
However, beneath the compliance mechanics lies a deeply controversial mandate. Applications must now proactively report criminal conduct directly to government authorities, transmitting user identification packets alongside the offending post without requiring a prior court order.
- Notice and Takedown: Extrajudicial user notices trigger removal obligations unless reasonable doubt protects the speech.
- Duty of Care: Strict liability applies to systematic failures in curbing severe crimes like human trafficking and violence against women.
- Presumed Fault: Paid ads, boosted content, and automated bots carry rebuttable presumptions of fault rather than strict strict liability.
- Enforcement Reach: The Brazilian Data Protection Agency (ANPD) gains oversight powers, though administrative sanction authority lacks explicit legislative backing.
The Transition Clock and Ecosystem Friction
The Supreme Court established a strict 60-day transition window starting from the publication of the judgment session minutes on June 19, 2026. During this compressed timeline, platforms must re-engineer their moderation queues, establish physical legal representation within Brazil, and configure specialized channels for vulnerable user groups.
The rules governing violence against women under Decree 12.976 complicate this technical rollout. The decree defines online gendered violence broadly to include any act causing psychological, political, or economic suffering facilitated by digital networks.
Compounding the regulatory pressure, the Brazilian Data Protection Agency (ANPD) has been handed expansive supervisory authority. While the agency has maintained open dialogue with civil society stakeholders, legal experts note that deploying administrative penalties for content breaches pushes the ANPD far beyond its original statutory data-privacy remit under the LGPD.
Transparency Deficits and the Path Forward
Addressing online toxicity remains an urgent priority, particularly given Big Tech’s historic friction with local regulators and the stalled legislative progress of dedicated digital market bills like Bill 4675/2025 in Congress. Yet, building a safer digital public square cannot rely solely on offloading police powers onto private infrastructure.
True accountability requires reciprocity. While the Supreme Court mandates that tech platforms publish granular transparency reports detailing removal notices, state institutions must match that rigor. Under legacy provisions of the Marco Civil, federal bodies were already required to publish annual statistical reports on their own subscriber data demands—a mandate that state actors routinely ignored. Ensuring that the ANPD enforces strict transparency upon government data requests as well as private platforms is the only way to safeguard fundamental rights on the intricate road ahead.
