A Deadline Born From a Supreme Court Reversal
On July 20, 2026, the 60-day compliance window created by Brazil's Decree 12.975/2026 closed. The decree — published May 21, 2026, alongside companion Decree 12.976/2026 — rewrites Decree 8.771/2016, the implementing regulation for the 2014 Marco Civil da Internet, to operationalize a Supreme Federal Court (STF) ruling that upended a decade of intermediary-liability law. Platforms operating in Brazil had two months to stand up notice-and-takedown channels, publish transparency reports, and — for foreign companies — install a legal representative on Brazilian soil (ANPD).
The trigger was the STF's June 2025 judgment in Themes 987 and 533, which held by an 8-3 vote that Article 19 of the Marco Civil — the rule requiring a specific court order before a platform could be held liable for user content — was "partially and progressively unconstitutional" (Tech Policy Press). The Court preserved the narrower judicial-order requirement for ordinary defamation claims, but imposed a proactive duty on platforms to act without waiting for a judge's order against an enumerated list of serious harms: terrorism, incitement to suicide and self-harm, hate crimes, crimes against children, human trafficking, anti-democratic acts, and non-consensual intimate imagery.
Steelmanning the Decree
The case for this shift isn't hard to make. A regime that requires a judicial order before a platform can be held liable for hosting terrorist recruitment material or child sexual abuse imagery effectively guarantees that the worst content stays up longest — Brazil's courts are notoriously backlogged, and a specific-order requirement can take weeks. Algorithmic recommendation systems now amplify content platforms don't merely host but actively promote, undermining the original Marco Civil premise that treated hosts as passive conduits. CGI.br, the multistakeholder body that helped write the 2014 law, endorsed this logic directly, describing the new "duty of care to prevent circulation of criminal and illicit content and guarantee protection of women in the digital environment" as consistent with — not opposed to — its own long-standing "Application Provider Typology" (CGI.br).
The decree's liability mechanics are also more speech-protective than they first appear. ANPD, the data-protection authority now deputized as internet-content regulator, has said it will not adjudicate individual takedown disputes; it evaluates whether platforms maintain adequate "mechanisms, processes, and governance structures," and penalizes systemic failure rather than any single wrong call on a single post (ANPD). That is a real design choice — and a better one than a strict per-post liability standard that would reward reflexive over-removal on every ambiguous notice.
Where the Steelman Breaks Down
Two problems remain, and neither is about whether Brazil should regulate platforms at all — it plainly can and should have some notice-and-action regime for genuinely serious harms. The first is procedural. The STF's ruling created the systemic-failure standard for the enumerated crime categories; it did not create ANPD's expanded oversight apparatus, its mandatory annual transparency reports, its one-year advertising-data retention mandate, or its two-hour takedown clock for non-consensual intimate imagery. A meaningful share of Brazil's new internet-governance architecture was built by executive decree, not by the Congress that passed the Marco Civil or the Court that reinterpreted it. That is a separation-of-powers shortcut, and it is durable only as long as the current administration wants it to be — a future government could rewrite the same decree without any legislative involvement.
The second problem is competitive. A mandatory in-country legal representative with authority to respond administratively and in court is a real fixed cost, and fixed compliance costs bite hardest on the platforms with the fewest lawyers — not Meta or Google, which already maintain Brazilian subsidiaries, but the smaller and newer entrants an open, competitive internet depends on. ConJur's own analysis of the decree concludes the risk isn't that Brazil is calling this "regulation" rather than "censorship" — it plainly is regulation, not prior restraint — but that loosely bounded duties invite defensive over-removal at the margin, a risk the piece says demands "permanent institutional oversight and jurisdictional control" precisely because the decree's authors, not a court weighing a live case, drew the lines (ConJur).
The Test Is Enforcement, Not the Text
Brazil's systemic-failure framework is a genuinely better template than per-notice liability creep elsewhere — it protects platforms from being sued into censorship over any single contested post. But a good liability standard built on a shaky procedural foundation is still a shaky foundation. With the grace period now expired, the next test isn't the decree's text but how ANPD actually audits governance structures in practice, and whether Brazil's Congress ever puts these obligations into statute rather than leaving them revisable at presidential discretion (Migalhas).