New Decrees on the Liability of Digital Platforms in Brazil

Decrees No. 12.975 and 12.976 | Published May 21, 2026 | Effective July 20, 2026

What you need to know

On May 21, 2026, Brazil published two decrees regulating internet service providers’ liability under the Brazilian Civil Rights Framework for the Internet (Law No. 12.965/2014). They follow the Supreme Court’s landmark 987 ruling in Theme 2025, which introduced a “systemic duty of care” standard for platforms with mass content dissemination.

Key obligations

Decree 12.975 — Broad platform responsibility framework

• Maintain a legal entity representative in Brazil with powers to respond to authorities and courts.
• Operate a permanent reporting channel for criminal/unlawful content.
• Proactively prevent mass circulation of serious criminal content (terrorism, child exploitation, hate speech, antidemocratic acts, crimes against women, trafficking): failure triggers “systemic failure” liability.
• Adopt measures to block illegal paid ads/boosting (presumed liability applies).
• Publish self-regulatory terms and annual transparency report.

Decree 12.976 — Protection Against Gender-Based Digital Violence

• Remove the content or notify the complainant of the grounds for maintaining it and the available means to challenge that decision, within the following timeframes from receipt of the victim’s notification:
• unauthorized intimate content within 2 hours of notification;
• manifestly illegal content against women within 6 hours;
• other cases related to violence against women in the digital environment within 24 hours.
• Proactively mitigate coordinated attacks against women, no prior notification from the victim required.
• AI platforms must block generation of intimate deepfakes.

Who is affected

• All internet application providers intermediating third-party content, such as social media, video platforms, search engines, app stores, ad platforms, AI content services.
• ExemptFrom the duty-of-care provisions only: email, private instant messaging, and closed video conferencing services.

Note : Different criteria may be applied depending on the size of the provider and the risk level of the activity.

Who is the regulatory authority?

The Brazilian National Data Protection Authority (ANPD) is responsible for regulating, supervising, and investigating violations under the Decrees.

How we can help

We are supporting clients with:

1. Adequacy assessments.
2. Gap analyses of current content moderation policies.
3. Implementation of a systemic risk management and mitigation framework.
4. Notification system and transparency report design.
5.   AI safeguard implementation strategies.
6. Assistance with preparing accountability documentation.
7. Local representation structuring.

We are closely monitoring these developments and their potential impact on businesses and remain available to discuss this topic and assist with compliance strategies.

Content also available in PDF here.

This material is provided for informational purposes only and does not constitute a legal opinion or legal advice. Legal consequences depend on the specific circumstances of each case, and obtaining individualized legal counsel is recommended.