Brazilian Federal Government publishes two decrees updating the regulatory framework of the Brazilian Internet Civil Rights Framework and establishing guidelines for the protection of women in the digital environment

Brazilian Federal Government publishes two decrees updating the regulatory framework of the Brazilian Internet Civil Rights Framework and establishing guidelines for the protection of women in the digital environment

On May 20, 2026, President Luiz Inácio Lula da Silva signed two decrees expanding Brazil’s regulatory framework for the digital environment. Decree No. 12,975 is part of the set of measures adopted during the 100-day ceremony of the National Pact Brazil Against Femicide, updating the regulation of Law No. 12,965/2014 (the Internet Civil Rights Framework, known as Marco Civil da Internet) with regard to the liability of digital platforms for illicit content, and Decree No. 12,976 establishes guidelines for combating violence against women on the internet.

Decree No. 12,975/2026 amends Decree No. 8,771/2016, which regulated the Marco Civil da Internet, and introduces a new chapter dedicated to the liability of internet application providers. It first establishes general duties applicable to these companies: the establishment and maintenance of a registered office or legal representative in Brazil with powers to respond before authorities and comply with court orders, the provision of a permanent channel for reporting criminal or illicit content, and the adoption of measures against artificial networks for content distribution.

The most legally significant innovation, however, is the introduction of the concept of systemic failure as an autonomous basis for liability. Under the previous regime of the Marco Civil da Internet, internet application providers were only held liable for third-party content upon non-compliance with a specific court order. The decree breaks with this logic for certain categories of criminal content — including terrorism, incitement to suicide or self-harm, incitement to discrimination based on race, ethnicity, religion, sexual orientation or gender identity, crimes against women on the basis of sex, sexual crimes against vulnerable individuals and children, human trafficking, and crimes against the democratic rule of law. In these cases, a provider that fails to demonstrate the adoption of adequate measures, proportionate to the state of the art for the type of service it offers, and that does not show it has inhibited the mass circulation of such content will be held liable for systemic failure, regardless of any prior judicial trigger.

The decree also structures the procedure for extrajudicial notification of criminal content and provides that, upon removal of content, the provider must notify both the reporting party and the author of the publication, with reasons and an indication of available means of contestation. The analysis of content must take into account the context of publications, their informational, educational, critical, satirical or parodic purpose, and freedom of religion, so as to safeguard the principle of freedom of expression.

With regard to paid advertisements and boosted content, the decree introduces a presumption of provider liability when illicit content is distributed through such means, regardless of prior notification — a presumption that may be rebutted if the provider demonstrates it acted diligently and within a reasonable time. Platforms are also required to retain data on advertisements and advertisers for a minimum period of one year.

Finally, email services, interpersonal instant messaging, and restricted-group video conferencing are excluded from the scope of these obligations, in observance of the right to secrecy of communications guaranteed by Article 5, XII, of the Brazilian Federal Constitution.

Enforcement and investigation of violations will fall to the National Data Protection Authority (ANPD), pursuant to the new Article 19-A, in coordination with the Marco Civil da Internet, the General Data Protection Law (LGPD), and Law No. 15,211/2025 (the Digital Statute for Children and Adolescents).

Decree No. 12,976/2026, in turn, operates in a complementary manner. It establishes guidelines for the protection of women in the digital environment and for combating gender-based violence carried out through platforms and technological resources, including psychological violence, digital stalking, political gender-based violence, non-consensual sharing of intimate content, threats, and content that spreads hatred or aversion toward women. Expressly, the decree covers situations involving the manipulation of images and sounds by artificial intelligence — a scenario of growing relevance given the proliferation of synthetic content generation tools.

Replicating the systemic failure framework of Decree No. 12,975/2026, platforms that fail to demonstrate the adoption of adequate technical measures to inhibit the mass circulation of such content will be held liable. Among the obligations imposed on platforms, particular emphasis is placed on the duty to promptly remove non-consensual intimate content following notification, treated as a priority given the potential for irreversible harm associated with the non-consensual exposure of intimate images. The decree also innovates by creating a duty to mitigate the reach and visibility of coordinated digital harassment — regardless of prior notification — with priority given to situations of political violence against women or when the victim is a professional with public exposure, such as journalists.

Taken together, the two decrees consolidate a broader movement toward regulatory repositioning of digital platforms in Brazil. By replacing the logic of liability contingent on court orders with a systemic, prevention-oriented approach — for specific categories of criminal content — Decree No. 12,975 redefines the standard of diligence expected of internet application providers and expands the role of the ANPD as the central authority in overseeing the digital environment. Decree No. 12,976, in turn, complements this framework with differentiated, gender-sensitive obligations, recognizing that the digital environment constitutes a significant space for the reproduction and amplification of forms of violence against women.

The full text of Decree No. 12,975/2026 is available at: DECREE No. 12,975, OF MAY 20, 2026 – DOU – National Official Gazette

The full text of Decree No. 12,976/2026 is available at: DECREE No. 12,976, OF MAY 20, 2026 – DOU – National Official Gazette

Note: For quick release, this English version is provided by automated translation without human review.