Brazilian Civil Rights Framework for the Internet in Transformation: New Decrees Impact Big Techs

Today (May 21, 2026), Decrees No. 12,975/2026 and 12,976/2026 were published as part of the Federal Government’s initiative aimed at strengthening accountability and digital safety mechanisms in Brazil.

Decree No. 12,976/2026 seeks to protect women in the digital environment, in line with Article 21 of the Brazilian Civil Rights Framework for the Internet (“Marco Civil da Internet” or “MCI”- Law No. 12,965/2014). The regulation strengthens mechanisms to combat violence against women in the digital ecosystem, with the support of major platforms and social networks – including through dedicated reporting channels and mandatory content removal within two hours – especially in cases involving the non-consensual disclosure of nudity images (including AI-generated content), nudity involving girls and women, stalking, and coordinated harassment.

Decree No. 12,975/2026, in turn, regulates the Marco Civil da Internet following the Brazilian Supreme Federal Court’s (“STF”) decisions in RE 1037396 (General Repercussion Topic 987) and RE 1057258 (Topic 533), which recognized the partial unconstitutionality of Article 19 of the MCI, which is the provision that governs the liability of digital platforms for third-party content.

Accordingly, platforms will be required to constitute a legal representative in Brazil and adopt preventive measures to curb the circulation of content related to crimes such as terrorism, child sexual exploitation, human trafficking, and violence against women. In addition, advertisements and sponsored content must retain certain information to facilitate investigations.

Appropriate measures shall consider the economic scale, the level of interference in the circulation of third-party content, the state of the art, and the risks involved in the service, especially regarding small internet application providers.

It is important to highlight Article 16-D, which addresses the notification of criminal or unlawful content, to be carried out through a permanent and easily accessible reporting channel, including procedures for response, review, and possible removal, always in compliance with the principle of freedom of expression.

Once again, the Brazilian Data Protection Agency (“ANPD”) will play a central role in overseeing compliance with the obligations imposed on platforms.

The rules impact marketplaces, social networks, applications, digital providers, and companies that commercialize advertisements. On the other hand, the duty of care set forth in Articles 16-B to 16-J excludes email, instant messaging, and audiovisual services. It is worth noting that the Decree will fully enter into force within 60 (sixty) days, and the affected providers will be required to adopt the measures contemplated therein. In general terms, we highlight the following:

• updating moderation and data retention policies;

• notice-and-takedown procedures and a dedicated reporting channel for complaints;

• regulatory risk management;

• data protection and governance; and

• transparency and auditing obligations.

It has been a significant week for technology companies in Brazil: the Decrees were published in the same week in which the STF scheduled the so-called “big tech appeals” concerning social media regulation, with hearings expected to take place between May 29 and June 9, 2026, and only days after the European Commission published a draft of its guidelines on the classification of high-risk artificial intelligence systems.

Our team continues to closely monitor these developments and remains available to assess regulatory impacts, review internal policies, and support compliance and adaptation strategies. Should you have any questions, please contact us at digital@kasznarleonardos.com.