Brazil's New Internet Liability Law Ends Safe Harbor, Imposing 'Duty of Care' on Global Tech Platforms

Brazil has fundamentally altered its internet liability landscape, implementing a new legal framework that subjects global digital platforms to increased regulatory risk and compliance costs for third-party content. The new regime, which became effective in July 2026, combines a landmark Supreme Court ruling with two Presidential Decrees that establish a proactive "duty of care" and a new notice-and-takedown mechanism, significantly expanding the scope for platform liability. The change directly affects major social media companies and application providers, requiring them to shoulder a greater responsibility for illegal and harmful user-generated content on their services.

The shift dismantles the central protection previously afforded by the Marco Civil da Internet, Brazil’s 2014 Internet Bill of Rights. Previously, Article 19 of the Marco Civil da Internet shielded platforms from civil liability unless they failed to comply with a specific judicial order demanding the removal of content. The Supreme Federal Court (STF) ruled that this provision was partially unconstitutional, arguing that it failed to adequately address the unchecked spread of content related to serious crimes and antidemocratic acts. The presidential decrees, signed by President Luiz Inácio Lula da Silva, transform the STF’s decision into administrative requirements for all internet application providers operating in the country.

Under the new regulations, social media platforms face liability through two primary avenues. For most unlawful content, platforms can now be held liable if they do not remove the material after being notified by the user seeking takedown, relaxing the previous requirement for a court order. More critically, for a defined list of serious crimes—including hate speech, human trafficking, terrorism, and crimes against women—platforms are now subject to a proactive “duty of care” and can be held liable for "systemic failure". A systemic failure occurs if a provider cannot demonstrate it adopted adequate measures to prevent the mass circulation of such content. Furthermore, platforms face presumed liability for unlawful content spread via paid advertisements or distributed through automated "bot" networks, regardless of prior notification.

To ensure compliance, the decrees also mandate that platforms maintain a legal entity representative in Brazil with the authority to respond to authorities and courts. Oversight of these new duties has been assigned to the National Data Protection Authority (ANPD), expanding the scope of the agency beyond data privacy into broader digital regulation. This framework forces companies like Meta and Google to invest heavily in local content moderation, artificial intelligence, and sophisticated reporting channels to manage their legal exposure and adhere to the varying standards for different categories of speech, which range from a continued need for a judicial order (for defamation) to immediate, proactive removal (for serious crimes).

What to watch next is the enforcement action taken by the ANPD and any subsequent clarifications from the STF. While the new rules are in effect, the legal community is still awaiting a final, concrete definition of what constitutes a "systemic failure," a term that will ultimately determine the scale of liability for platform companies operating in the Brazil liability environment.

What it touches The new regime directly increases the operational and compliance costs for the digital and tech sectors in Brazil, particularly for companies that rely on user-generated content and advertisement revenue. The added legal uncertainty and the need for localized content moderation infrastructure represent a clear headwind for multinational technology companies operating in the Brazilian market.