From Court Order to Duty of Care
For over a decade, Article 19 of Brazil's Marco Civil da Internet (Law 12.965/2014) functioned as Latin America's closest analogue to Section 230: platforms could only be held liable for third-party content if they defied a specific judicial takedown order (Senado Federal legislative study). That shield effectively ended on June 26, 2025, when the Supreme Federal Tribunal (STF) ruled, in the joined cases known as Themes 987 and 533, that Article 19 was partially and progressively unconstitutional. On June 17, 2026, the Court resolved thirteen pending motions for clarification against that ruling, fixing its final scope and starting a 60-day clock — running to roughly August 17, 2026 — for large platforms to implement the "duty of care" obligations the decision now imposes (Baker McKenzie).
The new framework is tiered, not blanket. Claims of defamation and other "crimes against honor" still require a court order, preserving Article 19's original protection for contested speech. Everything else shifts toward notice-and-takedown: platforms become liable for ordinary unlawful content once they receive extrajudicial notice and fail to act. Paid advertising and bot-amplified content carries a presumption of liability even without notice. For a defined list of severe harms — terrorism, child sexual exploitation, incitement to suicide, racial and religious discrimination, crimes against women, human trafficking — platforms now face strict "systemic failure" liability if they lack adequate preventive infrastructure, whether or not anyone flagged the specific post (Global Network Initiative).
The Executive Fills the Gap
Justice Luiz Fux, who wrote the lead opinion, described the Court's approach as "minimalist" — a floor of constitutional criteria meant to invite a "profícuo diálogo institucional" (fruitful institutional dialogue) so Congress could legislate the details (Tech Policy Press). Congress hasn't obliged. Instead, President Lula moved by decree: Decrees 12.975 and 12.976/2026, signed May 20, 2026, operationalize the ruling administratively. The first hands Brazil's data protection authority, ANPD — which only became a full regulatory agency with expanded autonomous powers in September 2025 — the job of supervising whether platforms meet their systemic obligations. Notably, the decree bars ANPD from ordering removal of individual posts; its mandate is to audit whether platforms' processes are diligent, not to become a content censor itself (ANPD).
The second decree targets gender-based digital violence specifically, requiring platforms to remove non-consensual intimate images within two hours of notification and to block re-uploads using hashing and similar detection tools, plus proactive measures against coordinated harassment campaigns even absent a complaint (Inside Privacy).
The Case For It — and Its Limits
The strongest argument for this shift isn't abstract. Brazil spent a decade watching Article 19's court-order requirement collide with the pace of viral harm: coordinated harassment of women, non-consensual intimate imagery, and child-exploitation material can reach millions of viewers long before a judge issues an order, by which point the injury is irreversible. A narrowly targeted duty of care for the worst, most time-sensitive harms — with a genuinely two-hour response window for NCII — is a defensible, proportionate response, one Brazil shares in spirit with the EU's Digital Services Act and the UK's Online Safety Act.
The problem is that the STF's framework reaches well past that narrow case.
"Systemic failure" and "adequate preventive measures" are undefined terms that thousands of first-instance judges across Brazil's decentralized court system will now interpret independently, with no unified statutory guidance until Congress — which the Court itself invited to act — actually legislates. Platforms facing open-ended liability for failing to prevent harms they cannot always detect in advance have every incentive to over-remove: take down borderline political speech, satire, and journalism rather than risk a systemic-failure finding. That risk falls hardest on smaller platforms and nonprofits that lack the legal teams and moderation infrastructure of Meta or Google — the local-representative and annual transparency-reporting requirements alone function as a compliance moat that entrenches incumbents even as regulators aim their rhetoric at Big Tech.
The political reaction underscores how contested this remains. Within 24 hours of the decrees' publication, Brazilian lawmakers filed 26 separate legislative proposals to suspend or amend them (Tech Policy Press) — evidence that governing by decree, however well-intentioned, is not a substitute for the legislative process the STF itself said it wanted. Reporting on Decree 12.975 notes that, as an executive act, it bypasses congressional review entirely (Congresso em Foco); durable rules for online speech deserve more than a presidential signature.
What to Watch
ANPD has opened a public consultation on implementation, and its own compliance window runs roughly alongside the STF's — a real opportunity for platforms, civil society, and smaller Brazilian services to press for narrower definitions of "systemic failure" before enforcement begins in earnest. Brazil was right to close the gap between Article 19's rigidity and the real-time harms of 2026's internet. Whether it built a workable duty of care or an unpredictable compliance minefield depends on what "adequate measures" comes to mean in practice — and on whether Congress finally does the legislating the Court asked for.