Internet & Online Safety · Brazil
Online safety & content laws in Brazil (2026)
Brazil shaded by its internet & online safety status
Online safety rules in Brazil: partial.
FrameworkMarco Civil da Internet (Law 12,965/2014) as modified by the STF's 26 June 2025 ruling on Article 19, plus the Digital ECA (Law 15,211/2025, in force since 17 March 2026, enforced by ANPD); the general 'Fake News Bill' (PL 2630/2020) remains stalled in Congress.
Brazil does not yet have a single unified online-safety statute equivalent to the EU DSA or UK OSA, but it operates a layered regime: the Marco Civil da Internet (2014) as reshaped by a landmark 2025 Supreme Court (STF) ruling imposing a qualified duty of care on platforms, and the Digital ECA (Lei 15.211/2025), a dedicated child/adolescent online-safety law enforced by the ANPD that took effect in March 2026. The proposed comprehensive 'Fake News Bill' (PL 2630) remains stuck in the Chamber of Deputies.
Key points
Law 12,965/2014 (Marco Civil da Internet) is Brazil's foundational internet law establishing net neutrality, user rights, data-protection principles and, originally in Article 19, a judicial-order model of platform liability for user content.
The Federal Supreme Court, by 8-3, declared Article 19 partially unconstitutional and adopted a duty-of-care standard: platforms can be civilly liable without a prior court order for manifestly illegal content (e.g., incitement to violence, hate speech, serious disinformation, terrorism, CSAM, crimes against honor), and must maintain notice-and-action, transparency reports, systemic-risk mitigation and a Brazilian legal representative.
Signed 17 Sept 2025 and in force from 17 March 2026, the Estatuto Digital da Criança e do Adolescente applies to any digital service aimed at or likely to be accessed by minors in Brazil, banning behavioural profiling and targeted ads to children, banning loot boxes for minors, and requiring parental consent for app downloads by under-16s.
Article 9 of Lei 15.211 explicitly bans self-declaration; platforms must use 'effective and reliable' age assurance such as document verification, biometric age estimation, or CPF-based database checks. Guidance is being issued by the ANPD, with fines up to BRL 50 million per violation and possible service suspension or platform bans.
Decree 12.622/2025 formalises the Autoridade Nacional de Proteção de Dados (ANPD) as the regulator of the Digital ECA, empowered to set age-verification standards, oversee parental-supervision mechanisms, require transparency reports and apply administrative sanctions.
The comprehensive platform-governance bill PL 2630/2020, which would introduce DSA-style transparency, algorithmic-accountability and multi-stakeholder oversight duties, was approved by the Senate but remains stuck in the Chamber of Deputies after heavy platform lobbying and has not been enacted.
Timeline - major decisions & events
Law No. 15.211/2025 took effect six months after publication, obliging platforms, app stores and games accessed by minors to adopt secure age verification, default privacy settings, parental controls and content restrictions, with fines up to 10% of Brazilian revenue. It marks the operational start of Brazil's dedicated online child-protection regime.
AgĂȘncia Brasil âCongress fast-tracked Law No. 15.211/2025 after a viral campaign about the 'adultization' of children online, banning self-declaration of age and imposing child-by-design duties on digital services. It is Brazil's first comprehensive law focused on minors' online safety.
PresidĂȘncia da RepĂșblica (Planalto) âBy an 8-3 vote the STF struck down the rule that shielded platforms from liability for user content absent a court order, creating a fault-based regime under which platforms can be liable for failing to remove serious illegal content after 'unequivocal knowledge.' It also imposed DSA-style transparency and local-representative duties.
STF (via Columbia Global Freedom of Expression) âJustice Alexandre de Moraes ordered X shut down after it failed to name a legal representative and to comply with orders to block accounts spreading disinformation; a five-judge panel upheld the ban, which lasted until X complied and was restored on 8 October 2024. It demonstrated regulators' power to suspend a major platform.
Al Jazeera (reporting STF decision) âThe data-protection authority issued a preventive measure halting Meta's updated privacy policy that fed Facebook/Instagram posts into AI training, citing inadequate legal basis and risks to minors; it was lifted on 30 August 2024 after Meta filed a compliance plan. It was a landmark application of the LGPD to generative AI.
ANPD âThe platform-accountability and disinformation bill, passed by the Senate in 2020, lost momentum amid heavy lobbying by Google, Telegram and others, and its scheduled Chamber vote was shelved. Its failure left platform regulation to the courts, setting the stage for the 2025 STF ruling.
Brazilian Congress (via Wikipedia summary) âBrazil's General Data Protection Law (Law No. 13.709/2018) came into force, establishing GDPR-style rules for processing personal data including online, with administrative sanctions phased in from August 2021. It underpins privacy enforcement against online platforms.
PresidĂȘncia da RepĂșblica (Planalto) âLaw No. 13.853/2019 established the ANPD as the body to interpret, supervise and enforce the LGPD and impose sanctions. The authority became the central regulator for online data-privacy matters.
PresidĂȘncia da RepĂșblica (Planalto) âA lower-court judge ordered a nationwide suspension of WhatsApp, the third such block in under a year, after the company refused to hand over encrypted message data in a criminal probe; the Supreme Court quickly overturned it as disproportionate. The episode framed Brazil's debate over encryption and intermediary obligations under the Marco Civil.
AFP/Phys.org âPresident Dilma Rousseff signed Law No. 12.965/2014, Brazil's 'Internet Bill of Rights,' codifying net neutrality, privacy, freedom of expression and, via Article 19, the rule that platforms are liable for user content only after ignoring a court removal order. It is the foundational framework for online content regulation.
PresidĂȘncia da RepĂșblica (Planalto) âLaw No. 12.737/2012 amended the Penal Code to criminalize unauthorized access to computers and devices and theft of digital data, after leaked private photos of actress Carolina Dieckmann. It was Brazil's first statute specifically punishing cybercrimes against online privacy.
PresidĂȘncia da RepĂșblica (Planalto) âBrazil - other topics
Internet & Online Safety in other countries
Last verified 8/15/2026 · Orientation, not legal advice - verify against the primary sources linked above. Methodology & how to cite · State of Technology Regulation 2026 · Explore the full world map â