Brazil activates new rules for big tech

What changed under the decrees

Decrees 12.975 and 12.976 took effect in Brazil on July 20, 2026, opening a new regulatory phase for digital platforms, despite legislative efforts to overturn them in Congress. In practical terms, big tech companies now operate under new obligations tied to governance, risk management, moderation and digital advertising.

Decree 12.975 creates an automatic presumption of liability for platforms when irregular content is spread through paid ads, boosting or artificial distribution mechanisms, even if the company had not been notified about that material beforehand. It also requires companies that sell ads to retain for one year the data needed to identify the people behind digital ad campaigns.

Duty of care and out-of-court response

The framework also sets a duty of care, requiring platforms to act on content linked to serious crimes without waiting for a court order. Analysis published by digital policy outlets notes that, after this STF-backed regulation, the general rule under Marco Civil shifts from requiring a judicial order to remove content to a model of mandatory extrajudicial notice. Under that setup, anyone can report content they believe is criminal, the platform must decide and explain its decision, cannot remain silent, and becomes liable if it fails to act against illicit or criminal content.

Poder360 added that platforms still do not face general liability for third-party content, but they must publish their removal policies, reporting channels and appeal mechanisms as part of their transparency obligations.

Intimate material, AI and harassment campaigns

Decree 12.976 sets a specific deadline of up to two hours to remove intimate content shared without consent, including manipulated material and AI-generated content. It also requires providers to block reuploads of that content and to notify both the author and the complainant of the basis for the decision to remove or keep the material, along with appeal options.

The same rule strengthens the ban on AI tools generating or altering intimate images of real people, and requires specific technical safeguards to prevent that type of output. It also obliges platforms to proactively reduce the reach of coordinated harassment campaigns against women, even when no formal complaint exists.

ANPD as the oversight authority

Both decrees explicitly designate the National Data Protection Authority, ANPD, as the agency responsible for monitoring compliance with the new obligations. Its role includes assessing preventive measures, internal reporting channels and the publication of moderation decisions.

At the same time, ANPD itself is in a phase of tighter enforcement. According to the reference materials, the agency is reviewing cases against 21 entities, strengthening LGPD enforcement and working on technical requirements that also affect those operating in data and compliance environments. For companies and security teams, the immediate effect is greater pressure on documentation, traceability, complaint handling and systemic risk controls.

What compliance is watching now

Systemic risk assessments must be calibrated according to factors such as the provider's economic size and its level of influence over how third-party content circulates. In practice, that shifts part of the focus away from a purely reactive posture and toward more structured oversight of digital advertising, moderation, internal channels and preventive measures.

With the decrees now in force, the Brazilian market has been pushed to align processes and operational evidence with a stricter regime, while ANPD is positioned as the control point for verifying whether platforms meet the new standard.