New Decrees on the Liability of Digital Platforms in Brazil

Decrees No. 12,975 and 12,976 | Published May 21, 2026 | Effective July 20, 2026

What you need to know

On May 21, 2026, Brazil published two decrees regulating internet service providers’ liability under the Brazilian Civil Rights Framework for the Internet (Law No. 12,965/2014). They follow the Supreme Court’s landmark 2025 ruling in Theme 987, which introduced a “systemic duty of care” standard for platforms with mass content dissemination.

Key obligations

Decree 12,975 — Broad platform responsibility framework

• Maintain a legal entity representative in Brazil with powers to respond to authorities and courts.
• Operate a permanent reporting channel for criminal/unlawful content.
• Proactively prevent mass circulation of serious criminal content (terrorism, child exploitation, hate speech, antidemocratic acts, crimes against women, trafficking): failure triggers “systemic failure” liability.
• Adopt measures to block illegal paid ads/boosting (presumed liability applies).
• Publish self-regulatory terms and annual transparency report.

Decree 12,976 — Protection Against Gender-Based Digital Violence

• Remove the content or notify the complainant of the grounds for maintaining it and the available means to challenge that decision, within the following timeframes from receipt of the victim’s notification:

* unauthorized intimate content within 2 hours of notification;
* manifestly illegal content against women within 6 hours;
* other cases related to violence against women in the digital environment within 24 hours.

• Proactively mitigate coordinated attacks against women, no prior notification from the victim required.
• AI platforms must block generation of intimate deepfakes.

Who is affected

• All internet application providers intermediating third-party content, such as social media, video platforms, search engines, app stores,  ad platforms, AI content services.
• Exempt: From the duty-of-care provisions only: email, private instant messaging, and closed video conferencing services.

Note: Differentiated criteria may apply based on provider’s size and risk level.

Who is the supervisory authority?

The Brazilian National Data Protection Authority (ANPD) is responsible for regulating, supervising, and investigating violations under the Decrees.

How we can help

We are supporting clients with:

1. Adequacy assessments.
2. Gap analyses of current content moderation policies.
3. Implementation of a systemic risk management and mitigation framework.
4. Notification system and transparency report design.
5. AI safeguard implementation strategies.
6. Assistance with preparing accountability documentation.
7. Local representation structuring.

We are closely monitoring these developments and their potential impact on businesses and remain available to discuss this topic and assist with compliance strategies.

Content also available as a PDF here.