The Brazilian government has significantly expanded the regulatory powers of its National Data Protection Authority through two presidential decrees signed on Wednesday and published Thursday, transforming how digital platforms operate within the country’s borders.
The decrees, signed by President Luiz Inácio Lula da Silva, establish comprehensive administrative rules that translate a landmark Supreme Court decision on platform liability into enforceable regulations. The move represents a major shift in Brazil’s approach to digital governance at a time when legislative efforts on tech regulation remain stalled.
One decree specifically targets the protection of women from online violence and harassment in digital spaces. The second decree has broader implications, amending existing regulations under Brazil’s 2014 Internet Bill of Rights, commonly known as the Marco Civil da Internet. This amendment details platforms’ specific obligations regarding third-party content and establishes clear operational requirements.
Under the new rules, internet platforms must maintain physical offices and legal representatives within Brazil. The regulations establish detailed procedures for handling notifications of illegal content, managing advertisements, monitoring paid promotions, and addressing artificial content distribution networks.
The National Data Protection Authority, known by its Portuguese acronym ANPD, emerges as the central regulatory body with expanded powers to regulate, supervise, and investigate potential violations. Originally created to oversee compliance with personal data protection laws, the agency now assumes a significantly broader role in digital regulation.
The regulatory framework stems from a June 2025 Supreme Court decision that fundamentally altered how platforms are held liable for user-generated content. The court moved away from its previous interpretation of Article 19 of the Marco Civil, which had generally held platforms liable only when they failed to comply with court orders for content removal.
The new liability structure creates distinct categories of responsibility. For serious criminal content, platforms may face liability for systemic failures if they do not implement adequate preventive measures. Other violations may trigger liability following extrajudicial notices, while defamation cases still require court orders.
Legal experts note that the decrees address critical questions left unresolved by the Supreme Court’s ruling. Francisco Brito Cruz, a lawyer and director at the São Paulo-based InternetLab, explained that the government has used these decrees to clarify areas of uncertainty, particularly regarding the definition of systemic failure and criteria for extrajudicial notices.
The ANPD’s expanded role focuses on establishing technical parameters for assessing systemic failures rather than reviewing individual posts. Rony Vainzof, founding partner at VLK Advogados, emphasized that the agency will not evaluate content on a case-by-case basis but will instead assess whether platforms have systemic failures in their content moderation systems.
Fabrício Polido, a partner specializing in digital law at L.O. Baptista, described the development as placing the ANPD at the center of Brazil’s digital governance structure. The debate has evolved beyond simple content removal to encompass how platforms structure their prevention, reporting, response, and risk management mechanisms.
The agency has confirmed it is preparing to implement these new responsibilities, focusing on platforms’ systemic conduct rather than individual content review. Its oversight will include compliance with obligations aimed at preventing mass circulation of criminal content, digital fraud, misleading advertisements, and online scams.
The timing and context of these decrees reflect an unusual legal situation. The Supreme Court’s ruling was based on the concept of “progressive unconstitutionality,” suggesting that rules once considered adequate may become insufficient to protect constitutional rights as circumstances evolve.
The regulatory landscape could still shift. The Supreme Court is scheduled to review clarification motions regarding its Marco Civil ruling on May 29. Additionally, technology companies may seek legislative intervention, potentially pressuring Congress to pass laws that modify or replace the current regulatory framework established by the court ruling and presidential decrees.
The arrangement’s durability remains uncertain, as future presidents could potentially modify or revoke these rules through similar executive actions. This regulatory evolution represents Brazil’s attempt to balance digital innovation with citizen protection in an increasingly complex online environment.
Leave a Reply