A Court Ruling Looking for an Enforcer
On June 26, 2025, Brazil's Supreme Federal Tribunal ruled that Article 19 of the Marco Civil da Internet — the 2014 law that shielded platforms from civil liability for user-generated content unless a court specifically ordered removal — no longer adequately protected fundamental rights for the most serious harm categories. By majority vote, the Court moved Brazil from a judicial-order-only regime toward a notice-and-takedown model: platforms become liable when they fail to act after being notified of content like incitement to violence, hate speech and crimes against women, while defamation claims still require a judge.
Decrees 12,975 and 12,976, both signed May 20, 2026 and published in the Diário Oficial da União the next day, are the executive branch's attempt to turn that ruling into an operating manual. They enter into force July 20, 2026 — sixty days after publication. Decree 12,975 updates Marco Civil regulation broadly: a duty of care obliging platforms to act on serious-crime content without waiting for a court order, due-diligence and record-keeping requirements for paid advertising, a mandatory Brazil-based legal representative, and systemic risk assessments scaled to "economic scale, level of interference in the circulation of third-party content" and related factors. Decree 12,976 narrows in on gender-based violence: platforms must act on notice of non-consensual intimate imagery within up to two hours, block re-upload, proactively reduce the reach of coordinated harassment campaigns even absent a complaint, and stop AI tools from generating or altering intimate images of real people. The National Data Protection Authority, ANPD, becomes the enforcement and sanctioning authority for both decrees.
The Case For Acting
The steelman here is genuinely strong. Non-consensual intimate imagery causes concentrated, often irreversible harm, and every hour it stays online multiplies the damage through re-sharing — a two-hour clock is not radical by the standards of comparable regimes elsewhere. Brazil's own experience gave regulators a live case study: coordinated harassment campaigns against women in public life, and a wave of AI-generated "deepnude" content, are exactly the failure modes a pure notice-plus-court-order regime handles badly, since courts move in weeks while harassment campaigns move in hours. Requiring a local legal representative and basic ad due diligence closes a real accountability gap — Brazilian authorities have long struggled to serve orders on platforms with no local presence. None of this is invented harm; it is the harm the STF majority cited when it found the old Article 19 shield insufficient.
The Case For Caution
Set against that, three design choices deserve scrutiny before July 20. First, "presumed liability" for unlawful advertising and a duty of care that applies independent of judicial decisions push platforms toward removing first and litigating later — the classic collateral-censorship dynamic, where the cheapest compliant response to ambiguous, fast-moving content is over-removal rather than careful review. A two-hour window leaves little room for a human reviewer to distinguish a genuine non-consensual image from a photo the subject posted themselves, or from commentary that references but doesn't reproduce the underlying content.
Second, the compliance burden isn't calibrated only to Meta- and Google-scale platforms. A "systemic risk assessment" tied to undefined "state of the art" factors is a heavier lift for a mid-sized Brazilian platform than for an incumbent with an existing trust-and-safety org chart — the kind of asymmetric compliance cost that tends to entrench whoever already has the largest legal department, not whoever moderates best.
Third, and most concretely: ANPD opened a public consultation on how it will implement its new authority under both decrees on June 30, 2026, running through August 17, 2026. That means the substantive duties — the two-hour clock, the risk assessments, the ad-liability rules — take effect nearly a month before the regulator finishes taking input on how it plans to enforce them. Platforms must comply with obligations whose implementing guidance doesn't yet exist, administered by an agency that only recently absorbed this mandate.
What to Watch
None of this argues against the STF's underlying diagnosis — Article 19's blanket immunity genuinely struggled to reach fast-moving, high-harm content, and gendered digital violence deserved a faster remedy than years of individual litigation. The design questions worth tracking are narrower: whether ANPD's forthcoming guidance builds in a good-faith error allowance for the two-hour window rather than treating every miss as sanctionable; whether the risk-assessment tier genuinely scales down for smaller platforms rather than becoming a fixed cost only incumbents can absorb; and whether ANPD — which the decrees explicitly bar from ordering removal of specific content itself — holds that line in practice. Brazil has picked a defensible target. Whether the implementation protects speech as carefully as it protects victims will be decided over the next few months, not in the text signed in May.