What expired on August 17
Brazil's Supreme Court (STF) closed the book on Article 19 of the Marco Civil da Internet on June 17, 2026, issuing the final, clarified text of its ruling on Tema 987 of general repercussion. The 60-day implementation clock the Court attached to that ruling — running from June 18 — expired on August 17, 2026. As of that date, platforms operating in Brazil are expected to have live systems for a duty-of-care regime that replaces, for most unlawful content, the old rule that providers were immune until they defied a specific court order.
The new framework runs on two tracks. For the general run of unlawful content, liability now attaches through extrajudicial notice: a provider that receives notice and does nothing becomes jointly and severally liable alongside whoever posted the material. For a narrower list of serious offenses — anti-democratic acts, terrorism, incitement to suicide, crimes against women, child sexual abuse material, and human trafficking — platforms must remove content proactively, without waiting for any notice at all, with liability turning on whether the company suffered a "systemic failure" rather than missed any single post (Leonardi Advogados).
Sitting alongside the STF ruling, two executive decrees — 12.975 and 12.976 of 2026, in force since July 20 — fill in the administrative plumbing: platforms must run a permanent reporting channel, keep moderation records, give users notice and an appeal path when content is removed, and maintain a legal representative in Brazil who can receive court orders (ANPD). Decree 12.976 adds a specific, aggressive rule for non-consensual intimate imagery: take it down within two hours of notification (ANPD).
The case for it
The strongest argument for this regime is that the old rule was failing on its own terms. Under pure Article 19, a platform could watch coordinated disinformation, non-consensual intimate images, or incitement to violence circulate for weeks while a victim waited for a judge to issue a takedown order — a process that, in a court system already carrying a large docket, is not fast. Brazil's Supreme Court majority concluded that treating court-order immunity as absolute was, in cases of flagrant illegality, effectively subsidizing harm the platform's own recommendation systems were often amplifying. A duty to act on clear, well-evidenced notice — rather than a duty to wait for litigation — is a defensible response to that failure, and it is the same basic architecture the EU's Digital Services Act and Germany's NetzDG already use.
Where the risk actually sits
But the mechanism for enforcing that duty matters enormously, and this is where the regime should be watched closely rather than waved through. The Electronic Frontier Foundation's assessment of the finished rules, published August 20, 2026, does not object to notice-and-takedown as a concept — it objects to specific design choices that push platforms toward over-removal and, more alarmingly, toward proactively handing user identification data to authorities without a court order, which EFF calls a step that turns platforms into surveillance intermediaries rather than content moderators (EFF). That is a fair criticism, not a strawman: joint and several liability creates an asymmetric incentive. Leaving genuinely unlawful content up risks a lawsuit; taking down genuinely lawful but merely accused content risks nothing except a user complaint that most platforms, at scale, will not meaningfully process. Notice-and-takedown regimes reliably produce more takedown than notice justifies, everywhere they've been tried.
EFF also flags that Brazil's data protection authority, ANPD, has been handed enforcement power over content-moderation obligations — including fines of up to 10% of a platform's Brazil revenue for "systemic failures" — that sit outside its original mandate to police personal-data handling (ANPD). An agency built to audit data-processing compliance is a different institution from one equipped to judge, at scale, whether a platform's content moderation was diligent enough. Mission creep here isn't hypothetical; it's baked into the decrees as written.
The guardrail worth defending
What keeps this regime from tipping fully into a censorship machine is a single doctrinal feature: the STF's "diligent review" safeguard. A platform that can show it conducted a genuine, documented assessment and had reasonable doubt about a piece of content's unlawfulness does not lose the case automatically for leaving it up (Leonardi Advogados). Paired with the decrees' user-notice and appeal requirements, that is the part of this framework that actually protects speech — it rewards platforms for keeping records and making judgment calls rather than reflexively deleting anything flagged. Brazilian regulators and courts should treat that safeguard as load-bearing, not decorative, when the first enforcement disputes reach them. If ANPD applies its 10%-of-revenue fine power narrowly — to platforms with no takedown process at all — rather than broadly, to platforms that made a defensible judgment call, the regime can function close to how the Court intended. If it doesn't, Brazil will have swapped one predictable failure mode (court backlog) for a more corrosive one: providers deleting first and never asking questions, because notice, not proof, is now what triggers liability.