What changed
On May 20, 2026, Brazil's federal government signed Decrees No. 12,975 and 12,976, publishing them in the Official Gazette the next day. Both take effect 60 days later, on July 20, 2026 (Câmara dos Deputados, official decree text). Decree 12,975 rewrites the enforcement chapter of the regulation underlying the 2014 Marco Civil da Internet, Brazil's foundational internet-rights law. Its Article 16-A now requires every internet application provider — not just the largest platforms — to "establish and maintain headquarters and a legal representative" in Brazil, one empowered to answer to courts, hand over information to authorities, and pay fines. Decree 12,976 layers on a parallel regime for gender-based digital violence, with a two-hour takedown window for non-consensual intimate imagery.
The Supreme Court did this first
The decrees are not a standalone policy invention. They operationalize a June 26, 2025 ruling by Brazil's Supreme Federal Tribunal (STF), which held by an 8-3 vote that Article 19 of the Marco Civil — which had shielded platforms from liability for user content absent a court order — was partially unconstitutional (Conjur). The Court invented a "systemic failure" standard: platforms can now be held civilly liable, without a prior judicial order, if they fail to adopt adequate measures to prevent or remove grave illegal content — terrorism, child exploitation, human trafficking, incitement to violence. The decrees translate that judicial doctrine into administrative machinery, assigning Brazil's data protection authority, ANPD, to "regulate, supervise, and investigate" compliance under Article 19-A of Decree 12,975.
The case for it
The strongest argument for this regime is that Brazil had a real accountability gap. Platforms with hundreds of millions of Brazilian users could previously operate with no legally reachable local presence, forcing courts and victims to chase foreign entities for basic compliance. CGI.br — Brazil's multistakeholder internet steering committee, not a government mouthpiece — called the decrees a "legitimate and relevant initiative" to implement the Court's ruling, and specifically credited the drafting for preserving "transparency, clear criteria, and the possibility of contestation" in takedown decisions, plus incorporating CGI.br's own provider-typology work (CGI.br public note). Notably, ANPD itself has said its new mandate is limited to overseeing "mechanisms, processes, and structures," not adjudicating individual content — a real, self-imposed guardrail against becoming a censorship body (ANPD public consultation notice). A headquarters-and-legal-representative mandate is, on its own, a modest and internationally familiar ask — the EU's Digital Services Act imposes comparable local-representative duties on providers with no EU establishment.
Why the vehicle still matters
But the mechanism by which this regime arrived should trouble anyone who cares about durable rules for speech online: it is an executive decree, not legislation passed by Congress. Brazil's Congress noticed immediately — 26 competing bills were filed within 24 hours of publication, mostly by lawmakers arguing the executive branch overstepped its constitutional rulemaking authority (Tech Policy Press). Legal scholars including Ronaldo Lemos and Carlos Affonso Souza — hardly industry shills — separately warned that terms like "systemic failure" and "duty of care" are vague enough to push platforms toward defensive over-removal, since erring toward takedown is legally safer than defending a content-retention decision after the fact. That is a legitimate proportionality concern, not a talking point: a standard invented by nine judges and operationalized by a ministry, without the amendment process and floor debate a statute would require, is inherently more fragile and more contestable than a law — and Brazil's own industry association (representing Meta, Google, TikTok, and others) is already treating the decrees' legal footing as an open question rather than settled law.
The proportionality gap
The deeper problem is that "systemic failure" liability and a Brazil-incorporation mandate land very differently on a company with global compliance infrastructure than on a mid-sized platform trying to serve Brazilian users at all. ANPD can fine violators up to 2% of Brazilian revenue, capped at R$50 million per infraction, under the same sanctions framework it already applies to data-protection violations (LGPD Article 52) — a real number for a large platform, an existential one for a smaller entrant weighing whether Brazil is worth the compliance overhead at all. None of that argues against accountability; it argues for the government to legislate this properly, with clear safe harbors for good-faith moderation, rather than leaning on decree power that a change of administration — or a future Supreme Court panel — could unwind just as unilaterally as it arrived.
Bottom line
Brazil identified a genuine accountability gap and built a defensible response to it — a local legal representative requirement is proportionate, and ANPD's stated restraint from content-level adjudication is the right design choice. But codifying an untested "systemic failure" standard through decree rather than statute trades short-term speed for long-term legitimacy, and the 26 rival bills already in Congress suggest the fight over that choice — not the underlying accountability goal — is where this actually gets decided.