Brazil Toughens Big Tech Liability with New Decrees, Mandating Action Without Court Order

Digital platforms operating in Brazil, including US-listed giants like Meta and Google, now face significantly increased legal risk after President Luiz Inácio Lula da Silva signed two decrees that modify the country’s foundational internet law, the Marco Civil da Internet (MCI). Effective July 21, 2026, the new regulations hold application providers civilly liable for certain illicit content—such as terrorism, anti-democratic acts, child exploitation, and crimes against women—even without a prior judicial order mandating removal. This marks a major shift for a market that is one of the world's largest digital arenas.

The changes, enacted via Decrees No. 12.975 and 12.976, codify a landmark shift initiated by Brazil's Supreme Federal Court (STF) in June 2025. That decision partially invalidated a key provision in the 2014 MCI that had previously shielded platforms from civil liability for third-party content unless they failed to comply with a specific court order. The STF’s ruling established a “systemic duty of care” for platforms that disseminate content at scale, arguing the old model was inadequate for addressing the mass circulation of serious criminal content.

The decrees detail the mechanism by which this new platform liability will be assessed, primarily through the concept of "systemic failure." Platforms must now implement robust risk management systems, maintain effective local representation with the power to respond to authorities, and proactively combat digital fraud and misleading advertisements, which are now subject to a presumption of liability. For content involving non-consensual intimate material, platforms face tight deadlines—as short as two hours from notification—to remove the post. The new rules also introduce an expectation that platforms will remove other forms of manifestly illegal content after notification, without a court order, to avoid being held liable for a systemic failure.

The oversight and enforcement of these new requirements fall to the National Data Protection Authority (ANPD), an agency created to enforce Brazil’s comprehensive data protection law, the LGPD. The ANPD now has the authority to regulate, supervise, and investigate non-compliance, which can result in warnings, fines, and other penalties. This regulatory move by the executive branch comes amid a long-stalled debate in the Brazilian Congress over a more comprehensive big tech regulation bill, underscoring the government's willingness to use presidential decree and judicial precedent to push its agenda on content moderation.

What it touches The new liability regime directly impacts publicly traded, foreign internet application providers with significant operations in the Brazilian market, which is a major revenue stream. Companies like Meta (META), Alphabet (GOOGL), and ByteDance (via TikTok) are among those that will incur higher compliance and operational costs to meet the new local representation, risk management, and expedited content removal requirements. The shift from a purely judicial-order standard to a notice-and-takedown or "systemic failure" standard increases their exposure to civil litigation and administrative fines from the ANPD.