Online safety & content laws in Brazil (2026)

Law No. 15.211/2025 took effect six months after publication, obliging platforms, app stores and games accessed by minors to adopt secure age verification, default privacy settings, parental controls and content restrictions, with fines up to 10% of Brazilian revenue. It marks the operational start of Brazil's dedicated online child-protection regime.

Congress fast-tracked Law No. 15.211/2025 after a viral campaign about the 'adultization' of children online, banning self-declaration of age and imposing child-by-design duties on digital services. It is Brazil's first comprehensive law focused on minors' online safety.

By an 8–3 vote the STF struck down the rule that shielded platforms from liability for user content absent a court order, creating a fault-based regime under which platforms can be liable for failing to remove serious illegal content after 'unequivocal knowledge.' It also imposed DSA-style transparency and local-representative duties.

Justice Alexandre de Moraes ordered X shut down after it failed to name a legal representative and to comply with orders to block accounts spreading disinformation; a five-judge panel upheld the ban, which lasted until X complied and was restored on 8 October 2024. It demonstrated regulators' power to suspend a major platform.

The data-protection authority issued a preventive measure halting Meta's updated privacy policy that fed Facebook/Instagram posts into AI training, citing inadequate legal basis and risks to minors; it was lifted on 30 August 2024 after Meta filed a compliance plan. It was a landmark application of the LGPD to generative AI.

The platform-accountability and disinformation bill, passed by the Senate in 2020, lost momentum amid heavy lobbying by Google, Telegram and others, and its scheduled Chamber vote was shelved. Its failure left platform regulation to the courts, setting the stage for the 2025 STF ruling.

Brazil's General Data Protection Law (Law No. 13.709/2018) came into force, establishing GDPR-style rules for processing personal data including online, with administrative sanctions phased in from August 2021. It underpins privacy enforcement against online platforms.

Law No. 13.853/2019 established the ANPD as the body to interpret, supervise and enforce the LGPD and impose sanctions. The authority became the central regulator for online data-privacy matters.

A lower-court judge ordered a nationwide suspension of WhatsApp—the third such block in under a year—after the company refused to hand over encrypted message data in a criminal probe; the Supreme Court quickly overturned it as disproportionate. The episode framed Brazil's debate over encryption and intermediary obligations under the Marco Civil.

President Dilma Rousseff signed Law No. 12.965/2014, Brazil's 'Internet Bill of Rights,' codifying net neutrality, privacy, freedom of expression and—via Article 19—the rule that platforms are liable for user content only after ignoring a court removal order. It is the foundational framework for online content regulation.

Law No. 12.737/2012 amended the Penal Code to criminalize unauthorized access to computers and devices and theft of digital data, after leaked private photos of actress Carolina Dieckmann. It was Brazil's first statute specifically punishing cybercrimes against online privacy.