Brazil's internet has operated for over a decade on a simple premise: platforms are not liable for what users post unless a court orders them to remove it and they refuse. As of roughly August 18, 2026 — 60 days after the Supreme Federal Court (STF) published the minutes of its clarifying judgment on June 19 — that premise is gone.
What Changed
The STF's ruling on Article 19 of the Marco Civil da Internet (Law 12.965/2014) replaced the judicial-order requirement with a hybrid regime. For ordinary unlawful content, platforms now face liability if they fail to act within a reasonable period after receiving an extrajudicial notice — a framework the Court modeled on Article 21's rules for non-consensual intimate imagery. Content involving violations of honor, along with private messaging and video-call services, keeps the old judicial-order requirement. For a defined category of serious crimes — terrorism, incitement to suicide or self-harm, hate crimes, crimes against women and children, human trafficking, and anti-democratic acts — platforms must act proactively, without waiting for any notice, under a new "duty of care" standard (Leonardi Advogados).
Executive Decree No. 12.975/2026, published May 21 and now in force, fills in the mechanics: platforms must run permanent, accessible complaint channels, give users reasoned takedown decisions with appeal rights, and — critically — proactively report criminal content to authorities along with user-identifying data, independent of any judicial request (Decree 12.975/2026, lexml.gov.br). Brazil's data protection authority, the ANPD, now oversees compliance system-wide — it does not adjudicate individual posts, but audits whether a platform's governance, moderation infrastructure, and complaint-handling meet the standard, backed by fines of up to 10% of the economic group's Brazilian revenue (ANPD, gov.br).
The Case for the Change
The strongest argument for this shift is not abstract. Brazil's 2014 framework required a court order even for content that was manifestly illegal and rapidly spreading — a slow, resource-intensive process ill-suited to material like non-consensual intimate imagery, coordinated harassment of women, or organized violent extremism, where every hour of delay compounds real harm. The STF's own 2025 finding was that Article 19's pure judicial-order model no longer adequately protected fundamental rights in a media environment where a single viral post can reach millions before a judge ever sees a docket. A notice-and-takedown backstop for the worst categories of content, paired with a diligent-review safe harbor for platforms that can show they assessed a notice in good faith, is a defensible middle path between total immunity and strict liability — and it's the same basic architecture the EU's Digital Services Act and the U.S. DMCA already use in narrower contexts.
Why the Execution Should Worry Free-Expression Advocates
But architecture is not implementation, and Brazil's version has real gaps. The Electronic Frontier Foundation, reviewing the regime as it took effect, warns it "can create problematic incentives for enforcement overreach and over censorship of protected speech" (EFF). Three specifics justify that concern.
First, "systemic failure" — the trigger for duty-of-care liability — has no settled definition yet. Facing joint-and-several liability for getting it wrong, platforms operating at Brazilian scale have every incentive to over-remove borderline political speech, satire, and reporting on the very crimes the rule targets, rather than risk a fine calculated on global-group revenue.
Second, the mandatory reporting of criminal content with user-identifying data to authorities happens without judicial pre-screening. A regime built to bypass slow courts for takedowns now also bypasses courts for handing identifying data to the state — a due-process gap that matters most for the government-critical speech authoritarian-adjacent regimes have historically tried to unmask.
Third, the diligent-review safe harbor that's supposed to protect platforms acting in good faith is itself undefined in practice, meaning smaller or foreign platforms without large Brazilian legal teams face the most uncertainty and the strongest incentive to simply comply with every notice.
The Better Path Was Already on the Table
Brazil's legislature has a pending option that would fix much of this: Bill 3.283/2025, introduced in the Senate in August 2025, would require platforms to notify Congress, the judiciary, prosecutors, and bar associations whenever content is removed without a court order — restoring a layer of institutional oversight the current court-and-decree patchwork lacks (Lahorgue Advogados). Legislating clear, narrow definitions of "systemic failure" and requiring judicial sign-off before user data reaches investigators would preserve the regime's legitimate goal — faster action on genuinely dangerous content — without handing platforms and regulators the discretion to chill everything upstream of it. Until Congress acts, Brazil's intermediary liability regime runs on rules drafted by a court and an executive decree, not a legislature, and enforced by an agency with 10%-of-revenue fines and no requirement to show a judge first.