Brazil's platform liability overhaul is now in its implementation phase, and the details matter more than the headline. On August 20, 2026, the Electronic Frontier Foundation published Intermediary Liability in Brazil: The Intricate Path Ahead. It examines how the Supreme Court's ruling on Article 19 of the Marco Civil da Internet is being turned into operating rules. The court's decision is settled. The decrees carry the design choices that will determine whether the regime stays proportionate.
What the court and the executive did
In June 2025 the Supreme Court declared Article 19 partially unconstitutional. That article had shielded platforms from liability for third-party content unless they ignored a court order. As EFF explained at the time, notice-and-takedown became the general rule. Article 19's protection was preserved for messaging apps and crimes against honor.
The court then resolved the follow-up appeals in June 2026. According to the Supreme Court's own news service, platforms have 60 days to implement the structural measures tied to the duty of care. Press coverage dates the judgment's conclusion to June 17, which puts the deadline in mid-August. That deadline has now passed.
The executive filled in the mechanics in May 2026 through two decrees. Decree 12.975 amends the 2016 Marco Civil regulation and details notice-and-action procedures and duty-of-care obligations. Decree 12.976 addresses online violence against women. Per the ANPD's own explainer, the data protection authority polices the regime. It can issue warnings and fines of up to 10% of group revenue, and it can order temporary service suspensions. Two-hour removal of non-consensual intimate content is among the obligations it enforces.
The strongest case for the regime
The case for acting is real. Under the old Article 19 rule, a victim of a fraudulent ad, a deepfake or non-consensual intimate imagery had to win a court order before a platform faced any legal exposure. That is slow and expensive, and harm compounds by the hour. A systemic duty of care, judged on whether a platform's processes are reasonable, is also better than liability for every individual post. It does not force platforms to over-remove in order to avoid case-by-case exposure. The ANPD says it will not evaluate isolated posts and that isolated content does not by itself show systemic failure. That is a sensible design principle.
Where proportionality breaks down
EFF's analysis identifies several problems that go beyond drafting details.
- Reporting without a judge. EFF reports that the decrees require platforms to report content related to criminal conduct to the authorities, including user identification data, apparently without a court order. The Ministry of Justice is expected to regulate this duty. A mandate to hand over identity data on the platform's own assessment of what looks criminal turns private companies into an intake pipeline for the state. That is the opposite of judicial oversight. It also invites over-reporting, because a platform that faces penalties for missing a crime has every reason to report anything ambiguous.
- A decree doing a statute's job. EFF's analysis argues that sanction powers must be set by law rather than by decree. The ANPD's fining and suspension powers rest on an executive instrument. Regulated companies will litigate that point, and legal uncertainty is itself a cost for smaller services that cannot afford the challenge.
- Vague trigger language. The duty for serious crimes rests on liability for "systemic failures," a term EFF says remains undefined. Undefined standards push risk-averse compliance teams toward removing lawful speech.
- Encryption and private communications. EFF flags ambiguity over how the rules apply to end-to-end encrypted messaging, and over judicial orders that could reach private communications in email and video conferencing. Broad definitions of online violence against women also risk sweeping in legitimate criticism.
The problems compound. A vague systemic-failure standard creates an incentive to remove and report broadly. A reporting duty with no judicial gate then turns that over-caution into surveillance exposure for users.
An institutional mismatch
The ANPD was built to enforce data protection. Making the same body the referee of content-related duties gives one agency two potentially conflicting roles. It protects personal data, yet it is also the recipient of a mandate that moves personal data to police. That tension is not fatal, but it argues for a firewall. The reporting duty should be limited to narrowly defined serious offences such as trafficking and child abuse. It should also require judicial authorization before identification data is disclosed, except where life is at imminent risk.
What to watch
Three things will show whether Brazil lands on a proportionate model.
- The Ministry of Justice regulation. Whether it limits the reporting duty by offence type, by threshold and by judicial gate will be the single most important variable.
- ANPD enforcement practice. If its first actions target demonstrably weak systems, the regime looks like the systemic model it claims to be. If it chases individual posts, it becomes a takedown bureau.
- Legislative ratification. Congress can put sanctions and definitions on a statutory footing, with debate and amendment. That would be better than governing a speech regime by decree.
Brazil has good reason to want faster remedies for real harms. It can have them without a duty to hand user identities to the state unsupervised. Getting the reporting rule right is the difference between a duty of care and a duty to inform.