A comprehensive guide to the key federal laws, statutes, and regulatory acts governing digital platforms, data protection, and online services in Brazil.
Federal Constitution
Brazil’s Federal Constitution, in force since 1988, is the starting point for discussions on the regulation of new technologies in the country, as it defines fundamental rights and principles that guide the operation of digital platforms and online services. In practice, constitutional guarantees such as freedom of expression, privacy, dataprotection, confidentiality of communications, and due process of law frequently arise in disputes involving users and companies, functioning as constitutional limits and safeguards applicable to the online environment.
The Constitution also establishes the powers and jurisdiction of the branches of government and of the higher courts, such as the Supreme Federal Court (STF) and the Superior Court of Justice (STJ), whichplay a central role in interpreting these rights and in harmonizing statuto ry law.
Many decisions that affect digital platforms, including content removal, moderation policies, and data protection, are ultimately grounded in the Federal Constitution, which serves as the foundation for subsequent regulationof the digital ecosystem.
The Constitution also establishes the powers and jurisdiction of the branches of government and of the higher courts, such as the Supreme Federal Court (STF) and the Superior Court of Justice (STJ), whichplay a central role in interpreting these rights and in harmonizing statuto ry law.
Many decisions that affect digital platforms, including content removal, moderation policies, and data protection, are ultimately grounded in the Federal Constitution, which serves as the foundation for subsequent regulationof the digital ecosystem.
The Brazilian Federal Constitution is available in English here
* Made available by Supreme Federal Court
Brazilian Internet Act
Key Guarantees
Freedom of expression
Privacy
Data protection
Net neutrality
The Brazilian Internet Act sets out the principles, rights, and duties that govern the use of the internet in Brazil, applying to users and service providers. It enshrines important guarantees such as freedom of expression, privacy, data protection, and net neutrality, while also establishing duties and responsibilities for internet access providers.
For technology companies, the law serves as an important regulatory framework, because it defines parameters for issues such as content moderation, data retentionand access, and transparency.
One of the core elements of the Internet Act is the provision regarding the civil liability of digital platforms for damages arising from user-generated content. The original version of the law established a judicial-takedown regime, under which platforms could only be held liable after failing to comply with a valid court order indicating the URL for removal, with a few exemptions under the notice-and-take-down system.
In June 2025, however, the Brazilian Supreme Court ruled this provision of the Internet Act partially unconstitutional and reshaped the civil liability regime, establishing the notice-and-take-down regime for content involving crimes and illicit acts in general, as well as imposing several other duties on platforms.
For technology companies, the law serves as an important regulatory framework, because it defines parameters for issues such as content moderation, data retentionand access, and transparency.
One of the core elements of the Internet Act is the provision regarding the civil liability of digital platforms for damages arising from user-generated content. The original version of the law established a judicial-takedown regime, under which platforms could only be held liable after failing to comply with a valid court order indicating the URL for removal, with a few exemptions under the notice-and-take-down system.
In June 2025, however, the Brazilian Supreme Court ruled this provision of the Internet Act partially unconstitutional and reshaped the civil liability regime, establishing the notice-and-take-down regime for content involving crimes and illicit acts in general, as well as imposing several other duties on platforms.
The Brazilian Civil Rights Framework for the Internet is available in English here
* Made available by the Brazilian House of Representatives
General Data Protection Act (LGPD)
Brazil's General Data Protection Act (LGPD), inspired by the European General Data Protection Regulation (GDPR), structured the Brazilian data protection framework and has become one of the most important laws governing the operation of digital platforms in the country.
It sets out the legal bases for the processing of personal data, establishes rights for data subjects, and imposes obligations on controllers and processors. The law also requires the adoption of security, transparency, and governance measures.
In addition, the LGPD created the Brazilian Data Protection Agency (ANPD), an independent regulatory body responsible for issuing guidance, overseeing compliance, and imposing administrative sanctions.
It sets out the legal bases for the processing of personal data, establishes rights for data subjects, and imposes obligations on controllers and processors. The law also requires the adoption of security, transparency, and governance measures.
In addition, the LGPD created the Brazilian Data Protection Agency (ANPD), an independent regulatory body responsible for issuing guidance, overseeing compliance, and imposing administrative sanctions.
Legal Bases
Sets out the legal bases for the processing of personal data
Data Subject Rights
Establishes rights for data subjects and obligations on controllers and processors
ANPD
Created the Brazilian Data Protection Agency responsible for oversight and sanctions
The LGPD is available in English here
* Translation made by the Brazilian Data Protection Authority – ANPD
Digital Statute of the Child and Adolescent (Digital ECA)
Key Guarantees
Age assurance
Parental controls
Content moderation and safety measures
Handling of user reports
Reporting to Law Enforcement
Risk assessments and Transparency reports
The Digital Child and Adolescent Statute (Digital ECA) introduced a legal framework to protect minors in the online environment, creating specific obligations for service providers.
The rules address issues such as Age assurance, Parental controls, Content moderation and safety measures, Handling of user reports, Reporting to Law Enforcement, Risk assessments and Transparency reports.
The statute supplements the existing Child and Adolescent Statute (ECA) by reinforcing protections against undue exposure, aiming to safeguard minor's emotional and physical integrity.
The rules address issues such as Age assurance, Parental controls, Content moderation and safety measures, Handling of user reports, Reporting to Law Enforcement, Risk assessments and Transparency reports.
The statute supplements the existing Child and Adolescent Statute (ECA) by reinforcing protections against undue exposure, aiming to safeguard minor's emotional and physical integrity.
The ECA Digital is available in English here
* Unnoficial translation by Instituto Alana made available by the Brazilian Government
Decree No. 12.880/2024
Decree No. 12.880 establishes complementary guidelines for the implementation of the Digital Statute of the Child and Adolescent, detailing governance mechanisms and reinforcing the responsibilities of digital platforms in preventing risks to minors.
The regulation emphasizes transparency, accountability, and the adoption of structured procedures to mitigate harmful content and interactions in online environments aimed at children and adolescents.
The regulation emphasizes transparency, accountability, and the adoption of structured procedures to mitigate harmful content and interactions in online environments aimed at children and adolescents.
Decree No. 12.975/2024
Decree No. 12.975 advances the regulatory framework by defining operational standards for monitoring, reporting, and responding to potential threats involving minors in digital ecosystems.
It highlights the role of platforms in adopting proactive risk assessment practices and strengthening cooperation with public authorities to ensure a safer and more controlled online experience for younger users.
It highlights the role of platforms in adopting proactive risk assessment practices and strengthening cooperation with public authorities to ensure a safer and more controlled online experience for younger users.
Decree No. 12.976/2024
Decree No. 12.976 consolidates additional technical and compliance requirements, focusing on enforcement mechanisms and the continuous improvement of safety-by-design practices.
The decree reinforces the obligation of service providers to implement protective measures throughout the product lifecycle, ensuring that children's rights are safeguarded from the conception of digital services to their operation and monitoring.
The decree reinforces the obligation of service providers to implement protective measures throughout the product lifecycle, ensuring that children's rights are safeguarded from the conception of digital services to their operation and monitoring.
* The English versions of the decrees are unofficial translations prepared by Licks Attorneys.
Consumer Protection Code (CDC)
Brazil's Consumer Protection Code (CDC) is the country's primary statute aimed at protecting consumers.
The legislation is grounded in the recognition of the consumer's vulnerability in commercial relationships and, on that basis, establishes rules on matters commonly arising in these interactions. Although enacted in 1990, before the consolidation of the digital economy, its principles fully apply to digital platforms.
The legislation is grounded in the recognition of the consumer's vulnerability in commercial relationships and, on that basis, establishes rules on matters commonly arising in these interactions. Although enacted in 1990, before the consolidation of the digital economy, its principles fully apply to digital platforms.
* Provided by the State Secretariat for Consumer Protection of Rio de Janeiro.
Offices
Rio de Janeiro
Sao Paulo
Brasilia
Curitiba
Tokyo
Proudly associated byLicks Attorneys