A data regulator becomes a speech regulator
On 21 October 2026 the Electronic Frontier Foundation published its submissions to Brazil's data protection agency, the ANPD. EFF's post says the ANPD now has a pivotal role in regulating digital platforms. Two bodies of rules put it there: the intermediary liability regime that replaced the old reading of Marco Civil Article 19, and the child-protection law 15.211/2025, known as the ECA Digital.
The ANPD began life as a privacy regulator. It is now also an enforcer of content-related duties. Whether it ends up as a proportionate referee or a general-purpose speech regulator depends on the secondary rules it writes over the coming months.
The strongest case for the new regime
The case for acting is serious. Brazil's Supreme Court concluded its Article 19 review on 26 June 2025. According to EFF's account of the follow-on rules, platforms now owe a duty of care for grave crimes such as human trafficking and crimes against women. They can be liable if they fail systemically to remove such content. Notice-and-takedown became the general rule, and the regime requires platforms to tell both the notifier and the poster the reasons for a decision and how to appeal. Judicial orders remain the rule for crimes against honor such as defamation.
A country that has watched coordinated abuse and child-safety harms spread through large platforms has reason to want a regulator with an enforcement capacity. The old model, under which platforms generally faced liability only after ignoring a court order, left some victims waiting. Parts of the new design are also sensible. Letting content stay up where there is reasonable doubt about its illegality, and weighing satire, criticism and parody, protects speech.
Where the design is fragile
The problem is the instrument and the vagueness. EFF's August analysis says the two presidential decrees, 12.975 and 12.976, were published in late May 2026. They give the ANPD power to oversee the regime and apply penalties for content-related breaches. EFF argues those powers go beyond what the data protection law and Law 15.211/2025 give the agency, and that sanctioning powers should be set by statute, not by decree.
That is not only an NGO complaint. A Chamber of Deputies bill, PDL 454/2026, presented on 21 May 2026 by Deputy Mauricio Marcon, would suspend both decrees under Article 49, item V of the Constitution. The Câmara's page shows it awaiting dispatch by the Chamber's President, with no votes recorded. A bill by one opposition-aligned deputy is not a verdict, but the dispute over legal basis is real. Rules built on contested authority invite litigation, and litigation means uncertainty for startups that cannot afford it.
What EFF asked the ANPD to do
The post lists a set of guardrails, and each one targets a specific way enforcement can overreach:
- Keep duty of care and "systemic failure" narrow. Liability should attach to systemic neglect of grave categories, not to individual posts. EFF notes the limits of "systemic failure" are still unclear.
- Require appeals for removed posts. Notice-and-takedown without a path back is a one-way ratchet.
- Be cautious about AI-based moderation. Automated filters misread context, which is exactly what the reasonable-doubt standard is meant to protect.
- Avoid normalizing platform blocking. Blocking whole services is a blunt remedy with collateral damage for lawful speech.
- Avoid general monitoring duties. Prevention duties should scale to each provider's type and structure, and EFF asked that non-dominant players such as federated networks and free software applications be treated differently.
The last point matters for innovation. A compliance regime written with the largest platforms in mind can be impossible for a small forum or an open-source project to meet.
Age assurance: the second pressure point
The ECA Digital took effect on 17 March 2026, and Decree 12.880 followed on 18 March. The ANPD's own notice says it published preliminary age-assurance guidance on 20 March 2026. That guidance serves as the monitoring reference until definitive guidance follows a public consultation. Monitoring began with app stores and proprietary operating systems. A second stage is planned for August 2026, once the final guidance is out, and would reach other provider groups by risk level.
EFF's objection is to a blanket approach. Age verification is often inaccurate and invasive. It can lock out adults without valid IDs and people whose faces or bodies do not fit a system's assumptions. EFF asks the ANPD to confine restrictions to products and services already deemed inadequate or prohibited for minors. It also asks the agency to count access to information and participation in society as part of a child's best interests. On privacy, it says zero-knowledge proofs alone are not enough. It recommends unlinkability, selective disclosure, on-device processing and no "phoning home" to issuers.
Protecting children is a legitimate goal, and the ECA Digital's ban on profiling-based advertising to minors is a privacy gain. But mandatory checks for every user would build an identity layer into the open internet. That is a heavier cost than the evidence of benefit supports.
What a proportionate ANPD looks like
The tests are practical. Does the ANPD define systemic failure with objective thresholds? Does it publish appeal and transparency requirements before enforcement begins? Does it tier obligations so that a federated server is not treated like a global network? And does it leave the question of sanctioning power to Congress or the courts, where challenges are already pending?
Brazil can protect children and fight abuse without making permanent a regulator that monitors everything and blocks by default. The ANPD's next rulemakings will show which model it chooses.