On Thursday, May 21, 2026, the federal government published Decrees #12,975 and #12,976, which establish new rules for digital platforms in Brazil. The first aims to update the regulation of the Brazilian Internet Act (MCI) in light of the understanding recently adopted by the Brazilian Supreme Court regarding platform liability. The second seeks to expand the protection of women in digital environments by detailing platform duties in the face of violent crimes committed in those contexts.

Some of the main innovations introduced by the decrees include:

• Liability of providers for third-party content: the decrees consolidate the liability regime established by the Supreme Court in its decision on the unconstitutionality of Article 19 of the MCI:
  • Systemic failure: platforms will be held liable in the event of systemic failure to promptly make unavailable content amounting to serious crimes (as listed in Article 16-B of Decree #12,975/2026). A systemic failure exists where the provider cannot demonstrate that it adopted adequate measures to prevent or remove unlawful content. The isolated existence of unlawful content does not, in itself, constitute systemic failure — in such cases, the notice-and-takedown regime applies.
  • Crimes against honor: in such cases, platforms will be held liable only pursuant to a court order.
  • Unlawful content conveyed in advertisements, paid boosting, or distributed through artificial content distribution networks: platform liability will be presumed where unlawful content is conveyed in advertisements, promoted through paid boosting, or distributed through artificial content distribution networks. In such cases, liability arises regardless of prior notice and will only be excluded if providers demonstrate that they acted diligently and within a reasonable time to make the content unavailable.
  • E-mail, instant messaging, and videoconferencing services: these providers are exempt from the rules above and will be held liable only pursuant to a court order.
• Security and transparency: platforms must adopt measures to ensure the security and transparency of their services.
• Assessment of systemic risks: platforms must monitor, identify, assess, and manage, with due diligence, the systemic risks arising from or intensified by their activities or by the circulation of unlawful content.
• Reporting channel: platforms must provide a permanent and easily accessible channel for receiving and handling reports of criminal or unlawful content. Providers must also implement measures to prevent the unlawful or abusive use of such channels.

Reporting channels must include a specific, permanent, free, prominent, and easily accessible space for receiving and handling reports related to intimate content, with acknowledgment of receipt and the possibility for the victim or their representative to track the case.

• Due process for handling reports: upon receiving notice of a crime or unlawful act, the platform must (i) acknowledge receipt; and (ii) assess its content, adopt the appropriate measures, and inform the notifying party of the grounds for its decision (removal or maintenance of the content), as well as the available means to challenge it.
• Removal of criminal content: in response to reports, platforms must make unavailable third-party content that amounts to a crime, except in cases of crimes against honor. Content may be maintained where there is reasonable doubt as to its unlawfulness.

Once criminal content is identified, the provider must forward to the competent authorities the content and the information necessary to enable the determination of authorship and materiality.

Certain types of content must be removed within specific deadlines, counted from the notice:

• • Within 2 hours: intimate content generated by third parties.
  • Within 6 hours: content amounting to crimes or unlawful acts against women based on their condition as women, as listed in Article 4 of Decree #12,976/2026.
  • Within 24 hours: other cases of violence against women in digital environments.

In addition, Decree #12,976/2026 requires the adoption of proportionate technical measures to promptly reduce the reach and visibility of coordinated attacks against women.

• Prohibition on generating intimate content: providers are prohibited from generating or modifying third-party intimate content through artificial intelligence or equivalent technology that alters the victim’s image or voice. Providers based on artificial intelligence functionalities or equivalent technological tools must implement mechanisms to identify and block these requests.
• Retention of records: platforms are now required to retain “TCP port information” whenever necessary for the unequivocal identification of the originating terminal or the next network hop.
• Legal representative: in line with the Supreme Court’s decision, platforms must maintain a legal representative in Brazil, in the form of a legal entity with powers to (i) respond in administrative and judicial proceedings; (ii) comply with court orders; (iii) respond for penalties and fines; and (iv) provide information relating to the service to the competent authorities.
• Self-regulation: platforms must establish terms of use and other internal policies covering (i) reporting systems; (ii) due process guarantees; and (iii) annual transparency reports on out-of-court notices, advertisements, and paid boosting.

Decree #12,975/2026 also clarifies that private messaging, e-mail, and videoconferencing services are not subject to the new rules on the circulation of unlawful content, in light of the constitutional confidentiality of communications.

The National Data Protection Authority (ANPD) will act in regulation, oversight, and enforcement regarding the protection of users’ rights and compliance with providers’ duties.

The new rules will enter into force on July 20, 2026.

Our team closely monitors developments in digital regulation in Brazil and remains available to assist companies in assessing the impacts of the new decrees and designing compliance strategies. For further information, please contact us at info@lickslegal.com.