On May 20, 2026, Decree No. 12,975/2026 (“Decree”) was enacted, updating the regulation of the Brazilian Civil Rights Framework for the Internet (Law No. 12,965/2014). The Decree aligns with the understandings established by the Brazilian Supreme Federal Court (“STF”) in 2025 regarding the liability of internet connection and application providers and expands obligations related to content moderation, prevention of online unlawful activities, and online advertising.
The measure comes amid increasing regulatory pressure on internet application providers, driven by the rise of digital scams, artificial networks for content dissemination, and fraud schemes carried out through online platforms.
Key Changes
The Decree creates a new chapter addressing the liability of internet application providers and establishes general obligations for platforms that intermediate third-party generated content.
Among the main obligations are: (i) maintaining headquarters and a legal representative in Brazil; (ii) providing a permanent reporting channel expressly allowing the notification of criminal or unlawful content; (iii) adopting measures to prevent artificial networks from distributing unlawful content; and (iv) implementing mechanisms aimed at ensuring service security and transparency.
The regulation also establishes obligations related to governance and content moderation, as well as the need for clear rules regarding notices, content boosting, and digital advertising.
The Decree regulates the obligation to maintain headquarters and a legal representative in Brazil, detailing the powers that such representative must hold. The representative must necessarily be incorporated as a legal entity and must have authority to: (i) respond before administrative and judicial authorities; (ii) provide authorities with information regarding (a) the operation of the provider; (b) rules applied in content moderation; (c) transparency reports; and (d) rules for user profiling, advertising, and content boosting; (iii) comply with court orders; and (iv) respond for fines and penalties imposed on the provider.
Platform Liability
One of the Decree’s central aspects is the codification of the so-called “duty of care” applicable to digital platforms. The regulation establishes liability for providers that intermediate third-party generated content in cases of systemic failure to remove or disable content related to serious crimes — including terrorism, sexual exploitation of children and adolescents, human trafficking, discrimination, incitement to self-harm, and violence against women.
The liability of digital platforms does not arise merely from the existence of unlawful content on their services, but rather from the omission in adopting appropriate preventive and removal measures. The assessment of liability must take into account the platform’s diligent, proportionate, and prompt conduct, rather than isolated content moderation decisions.
Additionally, the Decree establishes obligations related to the monitoring and management of systemic risks associated with the circulation of unlawful content.
Notice and Takedown Procedures
The Decree also regulates procedures for extrajudicial notices related to unlawful content.
Platforms must maintain specific channels for receiving and processing such notices, as well as provide reasoned decisions both to the notifying party and to the user responsible for the publication. The regulation also establishes the possibility of challenging takedown decisions.
However, the requirement for a specific court order remains applicable for holding platforms liable in cases involving defamation and other offenses against honor, pursuant to Article 19 of the Brazilian Civil Rights Framework for the Internet.
At the same time, the Decree seeks to preserve freedom of expression by safeguarding content of an informative, educational, critical, satirical, or religious nature.
The matter is part of broader regulatory discussions concerning the limits of private content moderation. In comments regarding Bill No. 4/2025, aimed at reforming the Brazilian Civil Code, the Brazilian Data Protection Authority (“ANPD”) had already expressed concerns about models based on generic “potential unlawfulness” criteria, due to the risk of excessive removals and impacts on freedom of expression.
Digital Advertising and Sponsored Content
The regulation dedicates a specific section to the regulation of advertisements, paid content boosting, and the fight against misleading, abusive, or fraudulent advertising.
The Decree establishes a presumption of platform liability when unlawful content is disseminated through paid advertising or artificial distribution networks, unless the platform demonstrates that diligent measures were adopted to disable the content.
The regulation also imposes on platforms that commercialize advertisements the obligation to maintain records related to advertisers and sponsored content for at least one year, in order to enable the investigation of potential fraud and the protection of consumer rights.
In practice, these new requirements are likely to directly impact advertiser verification mechanisms, content traceability, and advertising compliance structures adopted by marketplaces, social media platforms, and other platforms operating paid media models in Brazil.
Logical Port
The Decree establishes the mandatory storage of the logical source port by connection and application providers for purposes of traceability and record preservation. The logical port allows the identification of users sharing the same IP address, enabling greater accountability for acts performed online. This obligation applies independently to each provider.
ANPD’s Authority
The regulation grants the ANPD authority to regulate, supervise, and investigate violations related to compliance with the obligations imposed on internet application providers.
The ANPD’s role must be systemic in nature, and the authority is prohibited from ordering individualized content removals, except in situations expressly provided by law. The authority may also regulate operational aspects related to notices, challenges, deadlines, and transparency mechanisms.
The expansion of these powers is likely to directly impact the governance, audit, and risk management structures of digital platforms.
Scope and Effectiveness
The new obligations concerning the circulation of unlawful content do not apply to email services, instant messaging services – exclusively regarding interpersonal communications – and videoconferencing services operated in restricted environments, in light of the constitutional protection afforded to the confidentiality of communications.
The Decree will enter into force within 60 (sixty) days from the date of its publication.
Practical Impacts
The Decree consolidates the trend toward expanding the duties of diligence imposed on digital platforms in Brazil, with emphasis on content moderation, online advertising, and the prevention of unlawful activities in digital environments.
Particular attention should be given to Article 20-A, Paragraph 2, which expressly recognizes self-regulation as evidence of good faith for purposes of investigating violations, when aimed at creating technical and governance standards designed to protect users’ rights. Platforms that document and implement robust self-regulatory programs will be in a more favorable position in administrative proceedings before the ANPD and other competent authorities regarding the provisions of the Decree.
In this context, technology companies, social media platforms, marketplaces, and other internet application providers should review their internal policies and terms of use, content moderation procedures, notice-handling workflows, and transparency mechanisms in order to ensure compliance with the new regulatory requirements.
The Technology and Innovation team remains available to answer questions and assist in assessing the impacts arising from the new regulation of the Brazilian Civil Rights Framework for the Internet.