Brazil Moves to Increase Citizens' Security Online

Nina Santos is Deputy Secretary for Digital Policies and João Brant is Secretary for Digital Policies at the Brazilian Presidency.

In May, Brazil's federal government signed two executive decrees updating the regulatory framework of the Marco Civil da Internet, the country's foundational internet law, enacted in 2014. The decrees are a practical translation of a major court ruling into enforceable rules, at a moment when the costs of digital harm — to individuals, to institutions, and to democracy — have become impossible to ignore.

For over a decade, Article 19 of the Marco Civil shielded platforms from civil liability for third-party content unless they failed to comply with a specific court order to remove it. The rule was designed to protect free expression and prevent platforms from being overwhelmed by takedown demands. In 2014, it made sense. But the digital environment of 2014 barely resembles what exists today: platforms are far larger, their algorithmic amplification is far more powerful, and the scale of harm caused by illegal content has grown exponentially.

In June 2025, Brazil's Supreme Court (STF) confronted this mismatch directly. In a landmark ruling — decided eight to three — the Court declared Article 19 partially and progressively unconstitutional, concluding that the provision no longer offered sufficient protection for fundamental rights and democratic values. The Court did not strike the article down but applied a new approach. For defamation and other crimes against honor, the old judicial-order requirement remains in place, but for the prevention of a broad category of serious crimes — including terrorism, child exploitation, incitement to self-harm, violence against women, racism and anti-democratic acts — platforms are now expected to act proactively, in a duty of care approach, without waiting for a court order. Furthermore, the general rule becomes that when notified about any crime they should act, in a similar system to Europe.

Critically, the STF framed this shift as provisional: its interpretation would govern until the Brazilian Congress enacted new legislation. The ruling was also forward-looking, explicitly calling on lawmakers to fill the gap. At the moment, as Congress has decided not to create new comprehensive rules - it did so for children and adolescents only-, the executive decrees No. 12.975/2026 and No. 12.976/2026, published May 21, step in to give the Court's ruling operational meaning, based on the set of laws approved by legislators and in light of the Supreme Court's decision.

Three pillars of the updated framework

The first and broadest decree updates the 2016 regulatory instrument that had previously operationalized the Marco Civil. It organizes new platform obligations around three main axes.

The first is the duty of care. Platforms that intermediate user-generated content are now required to act proactively to prevent the mass circulation of content that constitutes serious crimes — the seven categories established by the STF ruling. When platforms receive a notification about potentially illegal content, they must analyze it, remove it if it falls within the defined categories, and provide the reporting user with information about what action was taken and why. This procedural transparency requirement is significant: it creates a feedback loop that currently does not exist in a systematic way.

The second axis addresses online advertising — a domain that has become one of the primary vectors for financial fraud in Brazil. The decree establishes a preventive obligation for platforms to adopt due diligence practices to advertisement, acting against fraudulent advertising before harm occurs, not only after. It also requires platforms to retain more detailed data about ads and advertisers, so that users who eventually suffer financial harm can seek redress and investigators can trace illegal activity. Brazil has been experiencing what many analysts describe as an epidemic of digital fraud and financial scams, depleting savings, eroding trust in financial institutions, and weakening legitimate brands. Holding advertising infrastructure accountable is a necessary piece of any serious response.

The third axis concerns institutional enforcement. The National Data Protection Agency (ANPD) is designated as the body responsible for overseeing compliance. This is a deliberate and important design choice: the ANPD is explicitly prohibited from ordering the removal of specific pieces of content. Its mandate is to evaluate the systemic behavior of platforms — whether they are fulfilling their proactive obligations in a consistent and diligent way — not to act as a content arbiter in individual cases. This distinction is essential to prevent the oversight mechanism from becoming a tool of censorship or political interference.

A decree for women's safety online

The second decree, focused specifically on women's safety in digital environments, offers a sharper set of obligations for one of the most pressing problems in Brazil's digital landscape: the use of technology as a weapon of gender-based violence.

Three provisions stand out. First, platforms are now required to remove non-consensual intimate imagery within two hours of notification. This tight deadline acknowledges a well-documented reality: the longer such content remains accessible, the more copies proliferate and the harder the harm becomes to undo. The decree also explicitly prohibits artificial intelligence systems from generating intimate images of third parties, a forward-looking provision that addresses the growing threat of deepfake sexual imagery.

Second, platforms must inform their users about "Ligue 180," Brazil's official national hotline for reporting violence against women and supporting victims. Placing this obligation on platforms — not just on government agencies — reflects an understanding that the fight against gender-based violence must meet women where they are, including in the digital spaces where abuse increasingly originates and spreads.

Third, the decree establishes a mechanism to combat coordinated online attacks against women, particularly women journalists and public figures. Platforms will be required to reduce the reach of messages that constitute coordinated harassment campaigns. This provision takes aim at one of the most effective tools used to drive women out of public life: not individual insults, but organized, high-volume pile-ons designed to intimidate, silence, and exhaust. The chilling effect of such attacks on women's participation in journalism, politics, and public discourse is well-documented and deeply damaging to democratic life.

Why this matters beyond Brazil

Brazil's regulatory move arrives in a global context where governments are wrestling with the same fundamental question: how to build a digital society that can enjoy and profit from the many benefits that the digital ecosystem offers us with the necessary safeguards to fundamental rights?

Brazil chose the path of considering that digital security is not a luxury or an afterthought. It is a precondition for the exercise of fundamental rights in an era when so much of political, economic, and social life happens online. When fraud runs rampant, when women are systematically driven out of public discourse, when platforms operate without meaningful accountability, the promise of the open internet is hollowed out.

Brazil's 2014 Marco Civil was ahead of its time. A decade later, the country is grappling with what it takes to keep that vision alive in a far more complex environment. The two decrees are a significant step — not a final answer, but a serious attempt to translate principle into practice.