With the entry into force of Decrees No. 12,975/2026 and No. 12,976/2026, Brazil's National Data Protection Agency (ANPD) has assumed an even more prominent role in the governance of the country's digital environment. The new regulations updated the framework implementing the Brazilian Internet Act and expanded the Agency's powers, assigning it regulatory, supervisory, and enforcement responsibilities concerning digital platforms' obligations and the protection of users' rights.
In general, Decree No. 12,975/2026 revised the liability framework applicable to internet application providers, incorporating into the Brazilian legal system the interpretation adopted by the Brazilian Supreme Court (STF) in its binding precedents issued under General Repercussion Themes No. 987 and 533. In these decisions, the STF held that Article 19 of the Brazilian Internet Act was partially unconstitutional. Under that provision, digital platforms could only be held liable for third-party content if they failed to comply with a court order requiring the removal of the content.
Consistent with the STF's ruling, the new decree establishes several circumstances in which platforms may be held liable for failing to remove unlawful content even in the absence of a prior court order. Internet application providers may be held liable where there is a systemic failure to promptly disable access to content related to terrorist crimes, incitement to suicide, the sexual exploitation of children and adolescents, incitement to discrimination, among other offenses.
In addition, the decree also introduced new obligations concerning platforms' proactive conduct, transparency, risk prevention and mitigation, and the fight against online fraud and scams.
Decree No. 12,976/2026, in turn, establishes guidelines for the protection of women in digital environments. Among other measures, the decree imposes specific obligations on digital platforms regarding the prevention and removal of unlawful content, the protection of victims of digital violence, and measures to combat the non-consensual creation and dissemination of intimate content, including content generated or manipulated using artificial intelligence.
However, while most attention has focused on the new obligations imposed on internet application providers, it is equally important to understand how the ANPD intends to exercise its expanded powers. To provide guidance to regulated entities, the Agency has launched a dedicated section on its website addressing the regulation of the Brazilian Internet Act and has published an implementation roadmap outlining the stages through which oversight measures will be introduced, as well as its regulatory priorities for the coming years.
The ANPD's Implementation Roadmap
The ANPD has structured its implementation roadmap into three phases. The Agency has opted for a gradual approach, initially focusing on guidance and monitoring before moving to more robust regulatory and supervisory action.
Phase I: Guidance, Stakeholder Engagement, Public Consultation, and Initial Monitoring
The first phase, which took place during June and July 2026, was primarily preparatory in nature. The measures envisaged included the publication of guidance materials, public consultations, technical meetings with stakeholders, updates to reporting channels, and the implementation of monitoring activities related to the obligations imposed on internet application providers under the new decrees.
One of the most significant initiatives during this phase was the launch of a call for contributions aimed at gathering stakeholder views on the implementation of the new rules applicable to digital platforms. According to the ANPD, the contributions received were intended to help identify areas of uncertainty, highlight sensitive issues, and inform the Agency's future regulatory priorities. The submission period remained open until August 17, 2026.
In addition, the ANPD announced the development of a Technology Radar on deepfakes, reflecting the Agency's growing focus on emerging technologies and their potential risks, particularly following Decree No. 12,976/2026, which introduced obligations relating to the generation and manipulation of intimate content through artificial intelligence.
The Agency also initiated monitoring activities aimed at assessing compliance with the obligations introduced by the new decrees. At this stage, its oversight efforts focused on internet application providers' general obligations, the duty of care, notice-and-takedown mechanisms for criminal content, advertising and paid promotions, and risks associated with the creation and dissemination of AI-generated or AI-manipulated intimate content.
However, it is important to note that, although this is the timeline presented by the ANPD, it does not constitute a limitation on the Agency's supervisory and enforcement powers. Should the ANPD identify situations that it considers relevant or capable of posing significant risks to users, it may adopt broader supervisory and enforcement measures immediately.
This is because the obligations established by the decrees are already in force and producing legal effects. Accordingly, in addition to the ANPD's activities, digital platforms may be subject to enforcement initiatives by other authorities, including investigations conducted by public prosecutors, measures adopted by consumer protection authorities, and judicial proceedings related to non-compliance with the new rules.
Phase II: Defining Regulatory Priorities
The second phase is scheduled for November and December 2026 and is intended to support the development of a more structured regulatory framework. During this period, the ANPD plans to identify the topics that may form part of its 2027-2028 Regulatory Agenda, taking into account stakeholder contributions, monitoring findings, and the Agency's own technical assessments.
The ANPD also intends to update its enforcement and sanctioning procedural regulations, incorporating the powers conferred by the new decrees into its internal frameworks.
Phase III: Ongoing Enforcement
Beginning in 2027, the ANPD intends to implement permanent enforcement activities aimed at ensuring compliance with the obligations imposed on internet application providers under Brazilian law.
The Agency also plans to establish continuous monitoring of digital risks, including those associated with deepfakes and other emerging technologies. The objective is to develop ongoing mechanisms for technological oversight and risk mitigation as the digital ecosystem continues to evolve.
Further information on the implementation of the new decrees, including the complete roadmap, is available on the ANPD's Brazilian Internet Act webpage.
