A Documented Problem, Not a Manufactured One
Brazil's Law 15.487/2026, published in the Official Gazette on August 7, 2026, arrives against a backdrop that makes the case for tougher rules on its own. SaferNet Brasil's national cybercrime hotline logged 63,214 reports of child sexual abuse and exploitation content in 2025 — the second-highest annual total in the organization's history — and abuse-related complaints made up 64% of all 76,997 cybercrime reports the hotline received between January and July 2025 alone, an 18.9% jump over the same period in 2024. This is the correct starting point for evaluating the law: it is not a solution in search of a problem.
What the Law Actually Does
Originating as House Bill 3066/25 (Deputy Osmar Terra, PL-RS) and passed by both chambers, the statute amends the Child and Adolescent Statute (ECA), the Penal Code and the Heinous Crimes Act. Production of child sexual abuse material now carries 4-10 years' imprisonment, up from 4-8; possession and storage rise from 1-4 to 3-6 years; and deliberately accessing such content via streaming now draws 3-6 years. A new Article 241-C criminalizes producing or distributing images that use "adulteração, montagem ou modificação" — including AI — to simulate a minor's participation in sexual content, closing a gap where fully synthetic imagery depicting no real child fell into a legal gray zone. A one-third-to-two-thirds sentencing enhancement (Art. 241-D, §2) applies when offenders use AI, deepfakes, filters, fake profiles, messaging apps, social networks or games to groom or impersonate minors. The law also authorizes "ronda virtual" — police patrols of public digital spaces such as forums and social networks (Art. 190-F) — and lets investigators request data from providers in emergencies without prior court approval, subject to judicial notification within 48 hours.
The AI Provision Is the Right Kind of Regulation
The strongest case for this law is the synthetic-imagery gap it closes. Before Law 15.487/2026, Brazilian courts faced real uncertainty over whether AI-generated images depicting no actual child qualified as prohibited material, even though the harm — sexualized content of what appears to be a minor, often built from a real child's likeness — is functionally identical to the harms the ECA already punished. Legislating narrowly on that specific output, rather than restricting AI tools generally, is the proportionate response advocates of innovation should want: it targets the abusive use, not the underlying technology. Brazil isn't inventing this concern from nothing — deepfake researchers cited by Global Voices' Advox project found that non-consensual sexual deepfakes are overwhelmingly female-targeted and grew sharply worldwide in 2022-2023, and Brazilian schools saw AI-generated nude images of classmates and teachers surface in 2023 and 2024. A sentencing enhancement for tech-facilitated grooming is a defensible, evidence-based calibration, not a moral panic.
Where the Law Gets Uncomfortable
The steelman for "ronda virtual" is straightforward: child abuse material spreads fast, offenders rotate platforms and fake identities within hours, and a mandatory warrant-first process can mean the difference between removing an image and letting it multiply. Investigators have a real operational case for faster access.
But the mechanism Brazil chose inverts the usual order of oversight. Emergency provider-data requests need only be reported to a court within 48 hours after the fact, not authorized beforehand — a structure that assumes the emergency justification will hold up in hindsight rather than being tested in advance. The patrol provision is nominally scoped to "public" digital spaces and to child-exploitation investigations specifically, but that scope is defined by the requesting agency itself, with judicial review arriving only after data has already been collected. That is a meaningfully different design than requiring a magistrate's sign-off before surveillance begins, and it lands at a moment when Brazil's intermediary liability regime is already shifting toward greater platform monitoring obligations following the Supreme Court's 2025 ruling narrowing Marco Civil da Internet's Article 19 safe harbor — a shift EFF has warned creates incentives for enforcement overreach even in its intended domain, let alone if a warrant-light patrol power migrates beyond CSAM investigations over time.
The Right Call, With One Provision to Watch
Raising sentences for AI-facilitated exploitation and criminalizing synthetic abuse imagery are targeted, defensible responses to a real and worsening problem — this is proportionate regulation working as it should, punishing a specific harmful output rather than restricting AI development broadly. The one component that deserves continued scrutiny is the virtual-patrol authorization: Brazilian courts and civil-society groups should insist on strict logging, narrow construction to CSAM investigations only, and swift post-hoc judicial review with real teeth — not just a 48-hour notification requirement — before this power is treated as a template for other categories of online crime.