Digital platform decrees take effect despite opposition pressure; the Brazilian Data Protection Agency (ANPD) shares views on its supervisory role
On July 20, Decrees #12,975/2026 and #12,976/2026 entered into force, expanding the obligations applicable to digital platforms and granting new supervisory powers to ANPD. Despite the entry into force of these measures, opposition lawmakers continue to push for the approval of Legislative Decree Bills (PDLs) aimed at suspending their effects, arguing that the decrees introduced new regulatory obligations without congressional participation.
The main controversies concern the expansion of ANPD’s role in overseeing compliance with obligations established under the Brazilian Internet Act and the authority granted to the Attorney General’s Office to request the removal of content involving fraud, as well as misleading or abusive advertising related to public policies. Government representatives maintain that the decrees merely update the existing regulatory framework and argue that their constitutionality is supported by recent Brazilian Supreme Court rulings.
In an interview regarding the ANPD’s new powers, agency President Waldemar Gonçalves stated that the ANPD will not act as a content moderator on social media platforms. Instead, its role will focus on the systemic oversight of digital platforms, assessing governance mechanisms, reporting channels, notification-handling procedures, transparency measures, and risk prevention and mitigation frameworks.
Our Client Alert provides a more detailed assessment of Decrees #12,975/2026 and #12,976/2026.
Why it matters?
Organizations should be aware that the entry into force of these decrees confirms that Brazil’s new regulatory framework for digital platforms is already producing legal effects, despite ongoing political challenges. Consequently, companies must continue preparing to comply with the new obligations.
The Brazilian Superior Electoral Court (TSE), digital platforms, and the integrity of the 2026 elections
On July 10, the Electoral Public Prosecutor’s Office issued recommendations to major digital platforms ahead of the 2026 elections. The recommended measures include: (i) greater transparency regarding content moderation policies, recommendation systems, and risk management practices; (ii) the creation of permanent channels for reporting unlawful content; (iii) the removal of content related to anti-democratic acts, political violence, hate speech, and electoral disinformation; and (iv) the adoption of mechanisms to prevent the recirculation of content already deemed unlawful by the Electoral Justice.
The recommendations also cover: (v) the preservation of digital evidence prior to content removal; (vi) restrictions on the promotion of unlawful content and enhanced transparency regarding political advertising; (vii) the labeling of AI-generated content; (viii) the identification of inauthentic accounts, bots, and coordinated inauthentic behavior networks; (ix) limitations on microtargeting based on sensitive personal data; and (x) the implementation of compliance programs designed to safeguard the integrity of the electoral process.
On July 14, the Brazilian Superior Electoral Court (TSE) hosted a virtual workshop with representatives from political parties and digital platforms to discuss electoral communication on social media during the elections. The meeting aimed to share recommendations, best practices, and guidelines for the responsible use of digital tools.
In addition, on July 16, the President of the TSE met with representatives from leading digital platforms operating in Brazil to discuss measures to counter disinformation during the elections. The meeting focused on developing a cooperation agreement between the court and the companies, with a particular emphasis on combating fake news, deepfakes, and the misuse of AI. Discussions also covered implementing the court’s recently approved rules governing synthetic content and adopting mechanisms that enable faster identification and removal of unlawful or misleading content.
On July 18, Bill #3,742/2026 was introduced before the House of Representatives. The bill seeks to prohibit elected officials from monetizing social media and digital platform content related to their public functions.
On July 24, the Senate published an overview of the rules applicable to social media during the 2026 elections, highlighting the TSE’s guidelines on electoral advertising, content boosting, and the use of AI. Noncompliance with these rules may result in content removal, rights of reply, liability for those involved, and, in certain circumstances, even the cancellation of a candidate’s registration.
Finally, on July 30, the TSE issued Ordinance #463/2026, regulating the submission, review, and monitoring of electoral compliance plans required from certain internet application providers for the 2026 Brazilian elections. In-scope providers must submit their compliance plans by August 16, 2026. Our Client Alert provides a more detailed assessment of the Ordinance.
Why it matters?
The Brazilian Superior Electoral Court is developing a comprehensive compliance framework for digital platforms ahead of the 2026 elections, with a key requirement being the submission of compliance plans by 16 August 2026. Companies operating social media platforms, messaging services, and generative AI tools should expect heightened scrutiny regarding transparency, electoral advertising, and measures to combat fake news, deepfakes, and the misuse of AI.
Brazilian Data Protection Agency (ANPD) expands its domestic and international presence
On the international front, from June 23 to 25, the ANPD participated in IAPP Navigate 2026 in the United States, presenting progress on the implementation of the Digital Statute for Children and Adolescents (ECA Digital) and sharing initiatives aimed at protecting minors online.
During the event, the agency highlighted measures already adopted, including guidance on age assurance mechanisms, the creation of a dedicated reporting channel, and monitoring and enforcement activities. The ANPD also took part in discussions and meetings with foreign regulators on data protection, AI, and digital safety.
Also on the international front, the ANPD joined the Global Online Safety Regulators Network (GOSRN), becoming the first regulatory authority in South America to join the network dedicated to cooperation among authorities and agencies responsible for online safety regulation. According to the agency, membership will enable Brazil to monitor global trends, share best practices, and develop joint initiatives with peer regulators facing similar challenges.
On the domestic front, the ANPD and the Administrative Council for Economic Defense (Cade) renewed the Technical Cooperation Agreement originally signed in 2021, extending the partnership for an additional five years. The renewed agreement expands cooperation on matters involving personal data protection, competition law, and digital policy, providing for information sharing, joint studies, training initiatives, and collaboration on investigations of mutual interest.
Why it matters?
These developments reinforce the ANPD’s growing role as a key digital regulator, both in Brazil and internationally.
House of Representatives committees approve measures on child protection, digital platform accountability, and competition
On July 1, the House of Representatives’ Communications Committee (CCOM) approved Bill #6,260/2025, which expands the protection of children’s and adolescents’ image rights in the digital environment.
The proposal establishes rules governing the online disclosure of minors’ images, videos, and personal data, including content published by parents or legal guardians, and seeks to address issues such as: (i) the overexposure of children on social media; (ii) the commercial exploitation of their image; (iii) the circulation of intimate content and deepfake-manipulated content; and (iv) the recurrence of previously removed content.
Also on July 1, the House of Representatives’ Economic Development Committee (CDE) approved Bill #2,768/2022, which addresses the regulation of digital platforms in Brazil. The approved substitute bill revises the original proposal by transferring the authority to review anticompetitive practices involving large digital platforms to the Administrative Council for Economic Defense (Cade), replacing the initial model that assigned this role to the Brazilian Telecommunications Agency (Anatel).
On July 15, the House of Representatives’ Public Security and Organized Crime Committee (CSPCCO) approved Bill #4,614/2025, which seeks to strengthen the investigation of digital crimes. The text requires tech companies, social media platforms, and internet providers to cooperate with law enforcement in certain investigations, while empowering courts to block accounts and profiles repeatedly used for unlawful activities.
All three bills remain under consideration in the House of Representatives.
Why it matters?
Although these proposals remain under legislative consideration, they clearly signal Congress’ current priorities regarding digital regulation. If enacted, the bills will impact online child protection, content removal, digital platform governance, competition oversight, and cooperation with law enforcement.
Political party challenges the use of biometric data for age verification and the prohibition of loot boxes before the Brazilian Supreme Court
On July 29, the political party Missão filed a lawsuit before the Brazilian Supreme Court challenging the use of biometric data for age verification to access content and services restricted to individuals over 18. According to the initial complaint, collecting biometric data, such as facial recognition, fingerprints, iris scans, and voice data, raises privacy and security concerns, particularly due to the creation of sensitive databases and the potential for surveillance by private platforms.
The lawsuit also challenges the prohibition of loot boxes in electronic games aimed at children and adolescents, arguing that greater flexibility should be permitted subject to parental or legal guardian authorization.
The Brazilian Data Protection Agency (ANPD) initiates a sanctioning proceeding following a data incident involving 500,000 patients
On July 8, the ANPD initiated a Sanctioning Administrative Proceeding against the Institute of Health and Citizenship (Isac), a nonprofit organization managing public healthcare units across several Brazilian states, for alleged failures in safeguarding the sensitive personal data of approximately 500,000 patients affected by a ransomware attack in 2025.
According to the ANPD, the affected records included approximately 78,772 children and adolescents and 47,921 elderly individuals. Potentially exposed data comprised identification details and health-related information, including medical records, test results, prescriptions, diagnoses, and hospitalization records.
Why it matters?
Platforms should pay close attention, as this proceeding demonstrates the ANPD’s growing readiness to enforce compliance regarding cybersecurity incidents and sensitive personal data protection. It also reinforces the agency’s expectations for implementing effective security measures, appropriate incident response protocols, and transparent communication with affected data subjects.
São Paulo Prosecutors’ Office challenges iris-scanning practices; the Brazilian Data Protection Agency (ANPD) publishes deepfake report
On July 21, the São Paulo Prosecutors’ Office (MPSP) filed a Civil Class Action against Tools for Humanity, the company behind the World ID project, and Amazon AWS Serviços Brasil, alleging abusive practices related to the collection of iris biometric data in exchange for financial compensation.
The MPSP argues that the initiative primarily targeted individuals in situations of socioeconomic vulnerability. Among other measures, the lawsuit seeks the suspension of further iris collection activities involving any form of payment or benefit, the deletion of all collected data, and at least BRL 240 million in collective moral damages.
In addition, the ANPD published the sixth edition of its Technology Radar series, dedicated to deepfakes. The report examines the functioning, evolution, and applications of this technology, along with its implications for personal data protection and digital security. It also highlights risks associated with fraud, voice and image cloning, electoral disinformation, gender-based violence, non-consensual intimate content, and other forms of synthetic content misuse.
Ministry of Justice steps up oversight of betting apps
The Ministry of Justice notified Apple and Google after identifying betting apps available through their app stores that allegedly lacked adequate age-verification mechanisms. The authority requested information regarding the companies’ procedures to verify the legality of the apps available in their stores and to restrict minors from accessing such services.
Subsequently, the Ministry rejected the arguments presented by Google and maintained that app stores have independent preventive duties, including adopting measures to block unauthorized betting apps. According to the authority, these obligations arise from the ECA Digital and Decree #12,880/2026.
CGI.br advocates a proportional approach to the implementation of the ECA Digital
The Brazilian Internet Steering Committee (CGI.br) submitted a technical contribution to the ANPD, defending that the regulation of the ECA Digital by the agency should take into account the differences among regulated entities and impose obligations proportionate to the functions performed by each digital service. According to the Committee, the implementation of the law should consider factors such as economic size, the degree of interference in the circulation of third-party content, the state of the art, and the risks associated with the relevant service.
CGI.br also recommended that the ANPD differentiate the obligations applicable to operating systems, digital platforms, and other categories of technology providers based on their functionalities, architecture, governance models, technical limitations, and effective capacity to implement the measures required under the ECA Digital.
Why it matters?
These recommendations may influence forthcoming ANPD regulations implementing the ECA Digital. If adopted, a proportionality-based approach could significantly affect how obligations are allocated among operating systems, app stores, digital platforms, open-source initiatives, and other technology providers.
Ministry of Justice warns that AI-powered toys may violate the ECA Digital and expose children to risks
The National Secretariat for Digital Rights (Sedigi), within the Ministry of Justice, published a technical report indicating that certain AI-powered toys may violate privacy protection provisions established under the ECA Digital.
The study examined children’s devices that are capable of capturing audio and images, connecting to the internet, and interacting through conversational assistants. It concluded that these features may enable personal data collection and processing, behavioral profiling of children and their families, exposure to inappropriate content, and emotional dependency.
Based on these findings, Sedigi recommended that the National Consumer Secretariat (Senacon) and the ANPD investigate the potential irregularities identified. The report further notes that manufacturers, sellers, and online marketplaces form part of the consumer supply chain and may therefore be held liable for commercializing products that do not comply with the ECA Digital.
iFood obtains age-rating reclassification
The Ministry of Justice (MJSP) reclassified iFood from “not recommended for individuals under 18” to “not recommended for individuals under 14,” after the platform demonstrated it had implemented mechanisms to prevent minors from accessing products intended exclusively for adults.
In announcing the decision, the MJSP emphasized that applications and digital platforms implementing effective child protection measures in compliance with the ECA Digital may request a review of their age rating.
What to expect in the coming months?
Over the coming months, Brazil’s digital regulatory agenda is expected to remain focused on implementing the new regulatory framework for digital platforms, particularly the obligations introduced by Decrees #12,975/2026 and #12,976/2026. The ANPD is likely to assume an increasingly prominent role in overseeing governance mechanisms, transparency, risk management, and online safety measures.
The protection of children and adolescents will also remain at the center of the regulatory agenda, with the implementation of the ECA Digital set to advance further.
At the same time, as the 2026 elections approach, initiatives aimed at ensuring electoral integrity in the digital environment are expected to intensify.
