Brazil’s New Intermediary Liability Framework Takes Shape: Supreme Court ruling, Executive Action, and Pressure on Congress

Last month, Brazil’s Supreme Court ruled on several motions for clarification concerning its landmark 2025 decision, which held that the Brazilian safe harbor provision for internet application providers (Article 19 of the Brazilian Civil Rights Framework for the Internet, or the “MCI”) is partially unconstitutional.

In its 2025 decision, the Court concluded that Article 19’s judicial-order requirement no longer provided adequate protection for fundamental rights and other constitutional rights in today’s digital environment. It therefore established a broader notice-and-take down framework modeled on Article 21, under which internet application providers may incur civil liability if, after receiving an extrajudicial notice concerning unlawful content, they fail to remove it within a reasonable period. However, according to the decision, content involving violations of honor remains subject to Article 19’s judicial order requirement. The same judicial-order requirement applies to private messaging and online meeting services. These providers may incur liability only if they fail to comply with a judicial order to remove the content.

In addition, the Court introduced new obligations for internet application providers, including a “duty of care” requiring providers to take reasonable measures to prevent the mass dissemination of content related to certain serious criminal offenses; adopt self-regulatory mechanisms; and maintain both an office and legal representative in Brazil. Furthermore, the Court established “presumed liability” in cases involving paid advertisements, boosted content, and artificial distribution networks (bots).

In its recent ruling on the motions for clarification, the Court refined several aspects of that framework. Most notably, it has introduced a 60-day transition period for internet application providers to implement the new duty of care obligations applicable to the mass dissemination of serious unlawful content, commencing on the date of the publication of the judgment session minutes, 19 June 2026. In addition, the Court has clarified that providers may be held jointly and severally liable for unlawful third-party content and inauthentic accounts; and created a safe harbor for providers that can demonstrate a reasonable basis for questioning the unlawfulness of the content after conducting a diligent and reasonable assessment. The Court also replaced the prior presumption of liability for paid advertisements and artificial amplification with a rebuttable presumption of fault. Finally, the Court held that internet application providers will not be liable if content they removed in compliance with their duty of care is later reinstated by court order.

Enacted in 2014, the MCI was widely regarded as an innovative framework for protecting fundamental rights online and became an international reference in internet governance. One of the defining features of the legislation was Article 19’s judicial-order liability regime, which reflected concerns that broad notice-and-takedown obligations could encourage platforms to remove lawful content and thereby generate a chilling effect on freedom of expression. As digital platforms evolved, however, it became increasingly evident that spaces once viewed as facilitating the free exchange of ideas had become fertile ground for disinformation; orchestrated mass posts with illicit content; threats to democratic institutions; and violations of fundamental rights. As a result, pressure grew to revisit the liability regime. Although Congress began discussing reforms through the so-called “Fake News Bill,” legislative efforts stalled after 2023, leaving a regulatory gap that ultimately prompted judicial intervention.

While Brazil’s Supreme Court revised framework seeks to better reflect the realities of today’s digital environment, it raises concerns regarding the potential excessive content removal. Faced with the prospect of joint and several liability and significant penalties, internet application providers may be encouraged to adopt more cautious moderation practices, particularly where legal standards remain uncertain. Furthermore, while the introduction of a reasonable doubt standard provides an important guarantee, the Court has offered limited guidance on how providers can demonstrate that they conducted a diligent and qualified assessment. As a result, companies may continue to operate within a compliance “grey area”.

It is worth noting that shortly before the Court ruled on the motions for clarification in 2026, the Federal Government enacted Decree No. 12.975/2026. The decree amended the existing regulatory framework under the MCI and set out rules implementing most aspects of the liability framework established by the Supreme Court, while assigning the National Data Protection Authority (ANPD) responsibility for regulating, supervising and enforcing compliance with the new obligations applicable to internet application providers.

Although both the decree and the Supreme Court’s ruling have been criticized as measures that should be left to the legislative branch, they reflect a joint effort to fill the regulatory vacuum identified by the Court. Acknowledging its institutional limits, the Supreme Court reiterated its call for Congress to enact comprehensive legislation protecting fundamental rights in the digital environment, while recognizing the Executive’s authority under the Federal Constitution to regulate certain aspects.

Meanwhile, Congress has been making rather slow progress. In August 2025, a Brazilian Senator introduced Bill No. 3,283/2025, which would require internet application providers to notify designated public institutions, such as the National Congress, the National Council of Justice (CNJ), the Public Prosecutor’s Office, and the Brazilian Bar Association (OAB), whenever content is removed without a judicial order, with the purpose of increasing transparency and preventing censorship. The bill is currently pending before the Senate.

In September 2025, the Brazilian Child Online Safety Law was enacted, requiring providers of IT products or services intended for minors to remove, upon notice from the victim, the victim’s legal representatives, the Public Prosecutor’s Office, or child rights organizations, content involving the following categories of harmful content: sexual exploitation and abuse, physical violence, cyberbullying and harassment, practices or behaviors that encourage, incite, instruct, or assist conduct harmful to the physical or mental health of minors, the promotion or sale of gambling, fixed-odds betting, lotteries, tobacco products, alcoholic beverages, narcotics, or products whose sale to minors is prohibited, predatory, unfair, or deceptive advertising and other practices known to cause financial harm to minors, as well as pornography.

The Supreme Court’s decisions, together with the Executive’s and ANPD’s implementing measures and Congress’s gradual legislative response, reflect a clear departure from the original judicial-order model established in 2014. While many aspects of the new framework remain to be tested in practice, companies operating in Brazil should expect increased regulatory scrutiny and more demanding obligations regarding content moderation, governance, and transparency.