Brazil’s New Internet Intermediary Liability Regime: Risks and Realities
- Brazil is rolling out a sweeping internet intermediary liability regime following a June Supreme Court decision that partially struck down Article 19 of the country's Marco Civil da...
- Under the previous legal framework established by Article 19 of the Brazilian Civil Rights Framework for the Internet, social media platforms and internet application providers could only be...
- Under the updated rules, internet applications that curate or interfere with posts face liability if they ignore user takedown requests, unless they can establish reasonable doubt that the...
Brazil is rolling out a sweeping internet intermediary liability regime following a June Supreme Court decision that partially struck down Article 19 of the country’s Marco Civil da Internet framework, according to regulatory filings and legal analyses. The implementation introduces mandatory notice and takedown mechanisms alongside strict duty of care obligations for digital platforms. While the rules aim to curb online harms, legal scholars and digital rights advocates warn that the framework creates severe incentives for over-censorship and enforcement overreach by placing the burden of policing user-generated content directly onto tech companies.
Understanding the Shift from Marco Civil to the New Regime
Under the previous legal framework established by Article 19 of the Brazilian Civil Rights Framework for the Internet, social media platforms and internet application providers could only be held liable for third-party content if they failed to comply with a specific judicial order to remove it. This design intended to protect online freedom of expression by preventing companies from aggressively purging user posts out of fear of civil lawsuits. However, according to the Supreme Court’s June ruling, that legacy provision failed to adequately protect fundamental rights and democracy against mounting digital harms. The federal government cemented the new system in late May by publishing two presidential decrees detailing how platforms must operate. Decree 12.975 amends previous regulations under Decree 8.771/2016 to establish platform duties and procedural safeguards, while Decree 12.976 outlines specific measures to combat online violence against women.
Notice, Takedown, and the Duty of Care Obligations
Under the updated rules, internet applications that curate or interfere with posts face liability if they ignore user takedown requests, unless they can establish reasonable doubt that the contested content is lawful. For specific infractions such as defamation and other crimes against honor, liability still requires non-compliance with an explicit judicial order. For severe offenses including human trafficking and crimes against women, platforms carry a direct duty of care to remove related material immediately. Systemic failures to do so expose companies to legal liability, though the government has not yet clearly defined the legal threshold for what constitutes a systemic failure. The regime also introduces stricter oversight for bots, boosted content, and paid advertisements.
Due Process Safeguards and the Risk of Over-Censorship
Because the Supreme Court’s ruling omitted formal guidelines to protect user due process rights during takedown demands, the new decrees attempt to fill the void by relying heavily on platform self-regulation. Decree 12.975 mandates that providers notify both authors and notifiers regarding removal decisions, explain the reasoning, and provide formal appeal channels. Platforms are permitted to reinstate content if an appeal succeeds. To mitigate the weaponization of reporting systems, the decrees require applications to implement preventative measures against abusive takedown requests. Decree 12.975 also instructs platforms to consider publication context, satirical or educational intent, and religious freedoms when evaluating whether reasonable doubt protects a post. For intimate or sexual content, platforms must provide dedicated channels where victims can monitor case progress. Despite these safeguards, analysts point to alarming provisions. Decree 12.975 requires applications to proactively report suspected criminal conduct directly to government authorities, handing over user identification data without a prior court order. Furthermore, Decree 12.976 adopts an expansive definition of online violence against women—encompassing any act or omission causing psychological, economic, or political suffering facilitated by digital technologies—which critics warn could easily capture and silence legitimate public criticism and protected speech.
Regulatory Oversight and Enforcement Powers
The implementation grants the Brazilian Data Protection Agency (ANPD) extensive powers to oversee the regime and issue administrative penalties for breaches of content obligations. These powers stretch beyond the agency’s traditional mandate under the Data Protection Law and Law 15.211/2025 regarding child protection online. While civil society groups note that the ANPD has maintained open communication channels, legal experts emphasize that sanction powers of this magnitude must be explicitly prescribed by primary legislation rather than executive decrees. As Brazil navigates this intricate transition, digital rights advocates argue that genuine accountability requires checking the structural power of dominant tech platforms rather than transforming companies into state-backed policing agents. Ensuring transparency from both private operators and government institutions will determine whether the new regime ultimately safeguards fundamental rights or diminishes free expression.