Internet & Online Safety · Brazil
Online safety & content laws in Brazil (2026)
Brazil shaded by its internet & online safety status
Online safety rules in Brazil: comprehensive law, under Marco Civil da Internet (Law 12.965/2014) as modified by the STF's June 2025 ruling on platform liability, plus the Digital ECA (Law 15.211/2025) for child online safety; data aspects governed by the LGPD (Law 13.709/2018) and enforced by the ANPD..
Brazil regulates online content and safety through a layered framework: the 2014 Marco Civil establishes baseline internet rights, intermediary rules and a notice-and-takedown regime, which the Supreme Court (STF) partially struck down in June 2025 to expand fault-based platform liability and impose DSA-style duties of care, transparency and local legal representation. A dedicated children's online-safety statute, the 'Digital ECA' (Law 15.211/2025, in force 17 March 2026), adds mandatory age-verification and youth-protection obligations enforced by the data-protection authority (ANPD). There is no single omnibus online-safety act akin to the EU DSA, but the combined in-force regime is comprehensive, and Congress has been urged to enact unifying legislation.
Key points
Law 12.965/2014 sets out internet civil rights, net neutrality, privacy and the original intermediary-liability rule (Art. 19), under which providers were liable for third-party content only after ignoring a specific court removal order.
On 26 June 2025 the Supreme Court ruled Art. 19 partially unconstitutional (8-3), creating a fault-based regime where platforms can be liable without a prior court order for serious illegal content (e.g. incitement, terrorism, child sexual abuse, anti-democratic acts), and may be liable for systemic failure to act on notifications.
The STF imposed governance duties inspired by the EU Digital Services Act: self-regulation with clear moderation rules and due process, annual transparency reports, accessible complaint channels, and a mandatory local legal representative in Brazil.
Law 15.211/2025, sanctioned 17 Sept 2025 and in force 17 March 2026, requires 'effective and reliable' age-verification (banning self-declaration alone), parental consent for under-16s, parental controls, bans on profiling-based ads and loot boxes targeting minors, and transparency reports.
The ANPD (data-protection authority) regulates and enforces the Digital ECA, with a regulatory decree (Decree 12.622/2025); sanctions range from warnings and fines up to R$50 million or 10% of Brazilian revenue, with platform suspension requiring a judicial decision.
No omnibus online-platform statute has passed; the broad 'Fake News Bill' (PL 2630) stalled in Congress, leaving the STF ruling as the operative platform-liability standard and prompting the Court to call on Congress to legislate, a gap likely to persist through the 2026 elections.
Timeline - major decisions & events
Law No. 15.211/2025 took effect six months after publication, obliging platforms, app stores and games accessed by minors to adopt secure age verification, default privacy settings, parental controls and content restrictions, with fines up to 10% of Brazilian revenue. It marks the operational start of Brazil's dedicated online child-protection regime.
AgĂȘncia Brasil âCongress fast-tracked Law No. 15.211/2025 after a viral campaign about the 'adultization' of children online, banning self-declaration of age and imposing child-by-design duties on digital services. It is Brazil's first comprehensive law focused on minors' online safety.
PresidĂȘncia da RepĂșblica (Planalto) âBy an 8-3 vote the STF struck down the rule that shielded platforms from liability for user content absent a court order, creating a fault-based regime under which platforms can be liable for failing to remove serious illegal content after 'unequivocal knowledge.' It also imposed DSA-style transparency and local-representative duties.
STF (via Columbia Global Freedom of Expression) âJustice Alexandre de Moraes ordered X shut down after it failed to name a legal representative and to comply with orders to block accounts spreading disinformation; a five-judge panel upheld the ban, which lasted until X complied and was restored on 8 October 2024. It demonstrated regulators' power to suspend a major platform.
Al Jazeera (reporting STF decision) âThe data-protection authority issued a preventive measure halting Meta's updated privacy policy that fed Facebook/Instagram posts into AI training, citing inadequate legal basis and risks to minors; it was lifted on 30 August 2024 after Meta filed a compliance plan. It was a landmark application of the LGPD to generative AI.
ANPD âThe platform-accountability and disinformation bill, passed by the Senate in 2020, lost momentum amid heavy lobbying by Google, Telegram and others, and its scheduled Chamber vote was shelved. Its failure left platform regulation to the courts, setting the stage for the 2025 STF ruling.
Brazilian Congress (via Wikipedia summary) âBrazil's General Data Protection Law (Law No. 13.709/2018) came into force, establishing GDPR-style rules for processing personal data including online, with administrative sanctions phased in from August 2021. It underpins privacy enforcement against online platforms.
PresidĂȘncia da RepĂșblica (Planalto) âLaw No. 13.853/2019 established the ANPD as the body to interpret, supervise and enforce the LGPD and impose sanctions. The authority became the central regulator for online data-privacy matters.
PresidĂȘncia da RepĂșblica (Planalto) âA lower-court judge ordered a nationwide suspension of WhatsApp, the third such block in under a year, after the company refused to hand over encrypted message data in a criminal probe; the Supreme Court quickly overturned it as disproportionate. The episode framed Brazil's debate over encryption and intermediary obligations under the Marco Civil.
AFP/Phys.org âPresident Dilma Rousseff signed Law No. 12.965/2014, Brazil's 'Internet Bill of Rights,' codifying net neutrality, privacy, freedom of expression and, via Article 19, the rule that platforms are liable for user content only after ignoring a court removal order. It is the foundational framework for online content regulation.
PresidĂȘncia da RepĂșblica (Planalto) âLaw No. 12.737/2012 amended the Penal Code to criminalize unauthorized access to computers and devices and theft of digital data, after leaked private photos of actress Carolina Dieckmann. It was Brazil's first statute specifically punishing cybercrimes against online privacy.
PresidĂȘncia da RepĂșblica (Planalto) âBrazil - other topics
Internet & Online Safety in other countries
Last verified 5/23/2026 · Orientation, not legal advice - verify against the primary sources linked above. Methodology & how to cite · Explore the full world map â