Brazil's New Internet Liability Rules: Balancing Censorship Risks & Free Speech

Brazil's Supreme Court has finalized changes to the country's internet intermediary liability rules, introducing mechanisms for notice-and-takedown and duty of care obligations for digital platforms. Legal experts warn that while these measures aim to address online harms, they may inadvertently encourage overreach in enforcement and censorship of protected speech.

The court issued its decision in June, clarifying aspects of a 2025 ruling that had deemed parts of the previous liability framework unconstitutional. In late May, the government published two presidential decrees outlining how the new rules will be applied.

Under the revised regime, social media platforms and other online services that curate or modify user-generated content may be held liable for third-party posts if they fail to remove the material after receiving a user complaint—unless there is reasonable doubt regarding the content's unlawfulness. For serious offenses such as defamation, platform liability remains contingent on non-compliance with a judicial order. In cases involving severe crimes like human trafficking or violence against women, platforms are obligated to remove related content immediately and may face legal consequences for systemic failures to do so. The boundaries of what constitutes a systemic failure remain undefined.

Stricter regulations now apply to paid advertisements, promoted content, and automated accounts (bots). The previous framework, established under Brazil’s Civil Rights Framework for the Internet (Marco Civil da Internet), required platforms to remove content only after receiving a court order, with limited exceptions such as unauthorized disclosure of private sexual images. The Supreme Court, however, found that this approach did not sufficiently protect democracy and fundamental rights.

Brazil’s shift reflects global discussions on addressing online harms and platform accountability. Yet, expanding intermediary liability carries risks, including increased surveillance, arbitrary censorship, and the reinforcement of dominant platforms’ control over information flows.

The government enacted two decrees to implement the new regime: Decree 12.795, which amends prior regulations to address elements not fully clarified by the court, and Decree 12.976, which focuses on combating digital violence against women. The Supreme Court’s decision did not establish clear due process protections for users facing content removal requests, instead relying on self-regulation by platforms—a move critics argue could lead to excessive censorship.

The decrees introduce provisions requiring platforms to notify both the complainant and the content author when deciding to remove or retain material, including the reasoning behind the decision and available appeals processes. They also prohibit the weaponization of notification systems. Additionally, Decree 12.795 instructs platforms to retain content when legal doubt exists, considering factors such as context, freedom of expression, and satirical intent.

One of the most contentious provisions mandates that platforms proactively report suspected criminal content to authorities, including user identification details. While this requirement may only apply to services already subject to content-related obligations, it raises concerns about state surveillance and the circumvention of judicial oversight. The Ministry of Justice will regulate this provision, though the Supreme Court did not address it in its ruling.

The decrees also clarify exemptions for messaging services, excluding features that enable public content dissemination or open group discussions from liability protections. However, the definition of "open groups" remains unclear, particularly regarding end-to-end encrypted applications, where monitoring obligations could undermine privacy and security. The Supreme Court’s decision suggests that judicial orders may compel email, voice, and messaging providers to remove private communications, raising concerns about privacy protections.

Decree 12.976 broadens the definition of online violence against women to include any act causing psychological, political, or economic harm through digital technologies. Critics argue this expansive definition could lead to the suppression of legitimate criticism and protected speech.

The decrees also grant the Brazilian Data Protection Agency (ANPD) authority to oversee the new regime, including the power to impose penalties for breaches of content-related obligations. Legal experts note that these powers may exceed the agency’s statutory authority, as they extend beyond data protection and child safety regulations. While the ANPD has engaged with civil society, critics contend that sanctioning powers should be explicitly defined by law.

The changes underscore the challenges of balancing platform accountability with the protection of free expression and privacy. As Brazil implements these reforms, legal and policy experts emphasize the need to prevent overreach, maintain judicial oversight, and uphold fundamental rights in the digital sphere.