Brazil tightens ANPD oversight of platforms

Brazil’s ANPD has published its 2025 and 2026 Enforcement Map, which foresees at least 75 control actions, while decree 12.975/2026 begins to take effect with new obligations for digital platforms operating in the country. Taken together, the two measures raise LGPD compliance expectations for online services and artificial intelligence projects that process personal data in Brazil.

A map focused on sensitive data and platforms

According to material released by Licks Attorneys, the Enforcement Map is organized around four pillars. The first groups 40 actions tied to data subject rights, with a focus on biometric, health and financial data, as well as secondary use of data for advertising and profiling. The second targets the protection of children and adolescents under the ECA Digital. The third covers data processing by the public sector. The fourth brings together artificial intelligence and emerging technologies, with 20 actions concentrated in 2027, signaling sharper enforcement around AI uses that involve personal data.

At the same time, the ANPD’s 2025-2026 Regulatory Agenda keeps 19 priority topics. These include data subject rights, the Relatório de Impacto à Proteção de Dados Pessoais, data sharing by the public sector, sensitive data, technical and administrative security measures, artificial intelligence, high-risk data processing, anonymization and pseudonymization, religious organizations, and the regulation and enforcement of the ECA Digital.

New rules for digital platforms

Poder360 reported that digital platforms operating in Brazil have until Monday, July 20, 2026, to comply with decree 12.975/2026. The text requires them to proactively remove content linked to crimes such as racism, terrorism, child sexual exploitation, violence against women, and incitement to suicide, without needing a prior court order.

The same decree gives the ANPD new powers to regulate, inspect, and investigate violations related to user rights and platform duties in the context of content moderation. CNN Brasil also noted that these decrees, which increase the liability of big tech companies, take effect this Monday and require permanent complaint channels.

People of Internet added that decree 12.975 would require each internet application provider to establish and maintain a headquarters and legal representative in Brazil, with the ability to respond before courts, provide information to authorities, and pay fines.

Political pushback in the Senate

On the legislative front, Senate bill PDL 460/2026 seeks to nullify the effects of the presidential decree that changes rules for internet providers and digital platforms. The measure argues that the text imposes new obligations such as content monitoring and data retention.