For over a decade, Article 19 of Brazil's Marco Civil da Internet (Law 12,965/2014) anchored one of the developing world's most speech-protective intermediary liability regimes: platforms were not civilly liable for third-party content unless they ignored a specific judicial order to remove it. That changed in 2025, when the Supreme Federal Court (STF) concluded its long-running judgment of RE 1037396 (Theme 987) and RE 1057258 (Theme 533), partially declaring Article 19 unconstitutional and grafting onto it new duties that activate on mere notification for a defined set of grave illegalities.
The shift is significant on its own terms. But its real weight comes from how it stacks on top of two pre-existing mechanisms — Article 22 of Marco Civil, which governs law-enforcement data requests, and Article 4, III of the LGPD, which carves public-security and criminal-investigation processing out of the data protection framework — and from how aggressively Justice Alexandre de Moraes's standing inquiry into 'digital militias' (Inq 4874) has used these tools to compel disclosures and account removals.
What the STF Actually Decided
According to the published reasoning and the official summaries released by the Court, the new framework keeps Article 19's court-order requirement as the default for ordinary content disputes — defamation between private parties, commercial speech, most political opinion. But it carves out categories where platforms must act on notification (extrajudicial notice) or face civil liability:
- Crimes against the democratic state (Law 14,197/2021)
- Acts of terrorism and incitement to terrorism
- Child sexual abuse material (already covered by stricter rules in Law 8,069/1990)
- Incitement to suicide, self-harm, and serious violence
- Racism and discrimination offenses
- Coordinated inauthentic behavior tied to grave political crimes
Platforms also acquire a 'duty of care' to deploy reasonable systems against these categories, broadly mirroring obligations from the EU's Digital Services Act. Paid advertising and content amplified by algorithmic recommendations face an even tighter regime: the platform is presumed to know of the content and is responsible for it.
The Data-Disclosure Multiplier
Article 22 of Marco Civil lets authorities request connection and application-access logs through a judicial order, and Article 15 already requires platforms to retain those logs for six months. The LGPD's Article 4 expressly removes public-security and criminal-investigation processing from its general protections, leaving it to be governed by a still-unfinished sectoral law that the National Congress has debated since 2020.
This means that, in practice, Brazilian law enforcement — and especially the STF acting on the Inquérito das Milícias Digitais (Inq 4874), opened in 2019 to investigate alleged disinformation networks — has wide latitude to compel platforms to identify users, hand over access logs, and remove accounts. Independent reporting by Folha de S.Paulo, Reuters, and the Financial Times has documented repeated orders to Meta, Google, and X under this inquiry, including the suspension of X in Brazil for roughly five weeks in 2024 over its refusal to designate a legal representative and comply with takedown orders.
Layer the new Article 19 duties on top of this, and the operational reality for any platform serving Brazil's roughly 180 million internet users is this: receive an extrajudicial notice citing one of the carve-out categories, fail to act swiftly, and you risk civil damages — even when the underlying notice comes from a private actor and the speech may, on closer inspection, be lawful.
Why Proportionality Matters Here
People of Internet supports targeted, evidence-based rules against material that causes concrete harm: CSAM, terrorist recruitment, doxxing campaigns, coordinated incitement to political violence. The STF was right to recognize that Article 19's bright-line court-order rule was a poor fit for those categories. But three problems flow from how the ruling is structured.
First, the categories are defined by reference to broad criminal statutes, several of which (notably the 'crimes against the democratic state' law) are themselves contested in their reach. Platforms making split-second liability calls will tend to over-remove, which is the well-documented behavior of intermediaries operating under notice-and-takedown regimes — a finding consistent with Stanford's Internet Observatory work on DMCA-style systems and with the European Commission's own DSA transparency reports.
Second, the procedural pairing with Article 22 and Inq 4874 means the same notification that triggers takedown duties can, in the same investigation, generate data-disclosure orders for the user whose content is now down. That sequence concentrates a remarkable amount of state power over speech and identification in a single forum.
Third, Brazil still lacks the sectoral 'LGPD-for-criminal-investigations' law that was supposed to fill the public-security gap. Until it passes, oversight of how law-enforcement requests are scrutinized — minimization, necessity, judicial review — depends almost entirely on the requesting authority's own restraint.
A Better Path
The Lula administration's pending PL 2630 ('Fake News Bill') and the Senate's draft data-protection-for-public-security law are the right places to fix this. A workable settlement would: (1) keep the STF's narrow notification carve-outs but require platforms to publish granular transparency on extrajudicial notices and removals; (2) introduce a fast-track judicial review channel — a kind of speech-court — for contested notices in political-speech-adjacent cases; (3) pass the LGPD criminal-investigation chapter so data requests sit under enforceable minimization and proportionality tests; and (4) sunset the 'milícias digitais' inquiry, transferring its remaining matters to ordinary federal courts with adversarial process.
Brazil has built one of the world's most consequential internet legal regimes. The STF's 2025 ruling closes a gap that needed closing. Whether it tilts the system toward proportionality or toward overreach depends on what Congress and the platforms build around it next.