Digital platforms may now be held liable for systemic failures in removing unlawful content and will face new governance, moderation, and transparency obligations in Brazil.
The changes arise from Decrees No. 12,975/2026 and No. 12,976/2026, published by the Brazilian Federal Government on May 21, 2026, which significantly expand the obligations applicable to internet application providers under the Brazilian Internet Bill of Rights (Marco Civil da Internet).
For technology companies, social media platforms, marketplaces, digital platforms, and artificial intelligence providers, the measures require an immediate review of internal policies, moderation systems, and compliance structures, considering that the decrees will enter into force within 60 days.
Below are 5 relevant impacts of the new regulation:
1. Expansion of platforms’ “duty of care”: Decree No. 12,975/2026 strengthens the so-called duty of care applicable to internet application providers. Platforms may be held liable in cases of “systemic failure” in preventing or removing unlawful content related, for example, to terrorism, child sexual exploitation, human trafficking, violence against women, and artificial dissemination networks of illegal content. Although the mere existence of unlawful content does not automatically trigger liability, providers will be required to demonstrate that they have adopted effective prevention, monitoring, and risk mitigation measures.
2. New obligations for foreign companies operating in Brazil: The new rules require platforms to maintain headquarters and a legal representative in Brazil with powers to respond before administrative and judicial authorities, comply with orders, and provide information regarding platform operation, moderation, and governance. Permanent reporting channels, transparency reports, and structured complaint-handling mechanisms will also become mandatory.
3. Relevant changes to content moderation and transparency: The decrees establish detailed rules for extrajudicial notifications and content removal procedures. Platforms must confirm receipt of complaints, justify decisions regarding removal or maintenance of content, and provide users with mechanisms to challenge moderation decisions. The rules also reinforce documentation and transparency obligations while introducing safeguards to protect freedom of expression and prevent arbitrary removals.
4. New protection regime for women in digital environments: Decree No. 12,976/2026 establishes specific rules aimed at combating digital violence against women. Among the measures, platforms must remove intimate content disclosed without authorization within two hours after notification by the victim or legal representative. Platforms must also create dedicated reporting channels, reduce the reach of coordinated harassment attacks, and adopt measures related to intimate content manipulated through artificial intelligence, including deepfakes.
5. Greater role of the ANPD and increased regulatory exposure: The decrees grant the Brazilian Data Protection Authority (ANPD) regulatory, supervisory, and enforcement powers related to compliance with the new obligations. The ANPD will play a central role in defining relevant aspects of the new regulation, including concepts such as “systemic failure”. In practice, companies operating digital services in Brazil will face greater regulatory, administrative, and litigation exposure.
The new regulation represents one of the most significant developments in Brazilian digital regulation since the enactment of the Marco Civil da Internet. For companies operating digital platforms, AI systems, and online intermediation services, the measures require immediate attention to moderation policies, data retention practices, governance, and transparency mechanisms, as well as adaptation to a scenario of stricter oversight and increased platform accountability.
