Brazilian Supreme Court concludes judgment on platform liability; the National Data Protection Agency (ANPD) announces readiness to oversee compliance with the new obligations
On June 17, the Brazilian Supreme Court (STF) issued its final decision on the (un)constitutionality of Article 19 of the Brazilian Internet Act (MCI), reshaping the rules governing the liability of digital platforms for user-generated content. The decision is now final and no longer subject to further appellate review.
Article 19 of the MCI originally established that internet providers would only be held liable for damages arising from third-party content after failing to comply with a specific court order mandating the removal of such content (judicial-takedown). In June 2025, however, the Brazilian Supreme Court held that this provision was unconstitutional, reforming this civil liability regime.
The ruling was subject to appeals, which have now been resolved. The ruling preserved the core structure of the previous decision on the partial unconstitutionality of Article 19, but revised several aspects of its first version. Among these, the Court refined the notice-and-takedown regime, expanded the categories of content that remain subject to the judicial takedown model, and expressly called on both the Legislative and Executive Branches to adopt legislation and regulations addressing the issue. Our Client Alert provides a more detailed discussion of the Court’s decision.
The Brazilian Supreme Court also set a period of 60 days for internet providers to implement obligations associated with the so-called duty of care, including measures to reduce the risk of violations of fundamental rights, self-regulatory mechanisms, and specific dedicated channels for content removal requests.
As discussed in our newsletter last month, Decree #12,975/2026 designated the Brazilian Data Protection Agency (ANPD) responsible for overseeing compliance with a range of obligations applicable to digital platforms, including transparency requirements, content moderation obligations, risk mitigation measures, and customer service channels. Shortly after the Brazilian Supreme Court issued its final decision, the ANPD announced that it has the operational capacity to immediately begin monitoring compliance with the new obligations imposed on the platforms by both the Brazilian Supreme Court and the Federal Government.
According to the ANPD, its activities will follow a phased, coordinated, and risk-based approach, focusing on auditing companies' systems, procedures, and compliance mechanisms, rather than reviewing individual content removed or kept online. The authority also indicated that it is evaluating the implementation of a centralized reporting channel through which users could submit complaints regarding platforms' alleged failure to comply with applicable deadlines for removing content.
Why it matters
The Brazilian Supreme Court’s final ruling significantly reduces the legal uncertainty surrounding Brazil's new platform liability regime, while substantially increasing the urgency for companies to adapt their compliance programs and operational practices. Technology companies operating in Brazil should review their content moderation policies, notice-and-takedown procedures, governance frameworks, and customer service channels.
ANPD expands overseeing on data governance and personal data sharing
The ANPD has concluded the first phase of its monitoring proceedings concerning the appointment of Data Protection Officers and the availability of adequate communication channels for data subjects. Of the 56 organizations monitored, 27 fully complied with the authority's requests, eight still have pending issues, and 21 failed to respond to the remediation requests and may be referred for sanction proceedings.
The ANPD has also initiated an administrative enforcement proceeding against a telecommunications provider based on alleged irregularities involving the sharing of customers' personal data with a credit analysis company. The practice under investigation involved transferring customer data for the development of credit analysis assessment methodologies and market evaluation models. The agency found indications that the data sharing could be irregular because it was excessive and did not respect the principle of necessity, as well as because it was not transparent with customers. If the irregularities are confirmed, the companies involved may be penalized.
Why it matters
These measures demonstrate that the ANPD is directing its actions towards concrete data governance practices, particularly with respect to the appointment of Data Protection Officer, customer service channels, profile-based advertising, and the sharing of data with third parties.
For companies, the key takeaway is that compliance with the Brazilian General Data Protection Law (LGPD) requires more than just formal policies. The ANPD is increasingly assessing whether organizations can demonstrate, in practice, that they limit the use of data to what is necessary, provide data subjects with clear and transparent information, and maintain effective governance and compliance structures.
ANPD begins monitoring app stores and operating systems
On June 10, the ANPD began monitoring app stores and operating systems to verify the implementation of age assurance and age signals obligations set forth in the ECA Digital (Brazilian Digital Statute for Children and Adolescents). During this initial phase, the authority's focus is on major companies that operate app stores and operating systems widely used by children and adolescents.
According to the ANPD, these agents were prioritized because they serve as a key gatekeepers for access to digital products and services. The initiative is part of the implementation roadmap for the ECA Digital.
The ANPD also stated that its enforcement activities will be expanded gradually. The initial focus is on major digital infrastructure players, before extending to other market participants, including online marketplaces and other companies offering content or services that are directed to, or are likely to be accessed by, children and adolescents.
Why it matters
This initiative demonstrates that the ANPD is prioritizing foundational elements of the digital ecosystem before expanding towards a broader enforcement. The oversight of app stores and operating systems can influence technical standards and regulatory expectations that may subsequently be applied to marketplaces, platforms, applications, and digital services directed at or likely to be accessed by children and adolescents.
Accordingly, all companies subject to the scope of the law must monitor the issue, even those that are not part of the initial group covered by the ANPD's current monitoring phase.
Judicial permit requirement for child influencers comes into effect
On June 17, a new requirement mandating prior judicial permit for the dissemination of monetized or promoted content that habitually exploits the image or daily life of children and adolescents came into effect. The referred rule is set forth in Decree #12,880/2025, which regulates the ECA Digital.
As a result, digital platforms host or distribute content featuring children and adolescents have begun notifying account holders to regularize their status with the courts, even suspending accounts that failed to obtain the required judicial authorization to feature minors in monetized content.
On June 23, the National Council of Justice (CNJ) approved a resolution establishing rules for granting, overseeing, and monitoring these permits. The purpose of the rule is to provide an operational framework for issuing permits, establishing parameters for judges to evaluate authorization requests and impose appropriate safeguards, including limits on frequency, duration and timing of online exposure, measures to protect their physical and emotional health, safeguards to ensure continued school attendance and measures to protect their assets.
Why it matters
The rule that came in force creates new obligations for platforms and for the digital influence market involving children and adolescents. Companies that engage influencers, agencies, advertisers, and platforms should ensure that content featuring minors has proper judicial authorization and complies with applicable restrictions governing exposure, monetization, and image protection.
Brazilian Senate advances bill on content moderation
On June 17, the Brazilian Senate Committee on Human Rights approved Bill #3,283/2025, which requires internet service providers to notify users when content is removed without a court order. The bill proposes to amend the MCI to create transparency mechanisms applicable when platforms remove content on their own initiative, and now proceeds to the Senate's Committee on Constitution and Justice for further consideration.
The bill was introduced in the wake of the Brazilian Supreme Court decision regarding platform liability for third-party content. Under the approved text, platforms would be required to notify certain governmental and institutional bodies, including the National Council of Justice (CNJ), the National Council of the Prosecutor's Office (CNMP), the Brazilian Bar Association (OAB), and the Brazilian Congress, within 24 hours of specified content removals. The reporting obligation would not apply to automated removals aimed at combating spam, malware, fraud, copyright infringement, or other forms of technical abuse.
Why it matters
If enacted, the bill will introduce new reporting obligations for content removal decisions that can profoundly impact digital platforms. Companies should monitor the bill’s development to anticipate possible changes in their content removal notification procedures.
ANPD begins monitoring pornographic websites
The ANPD has begun monitoring websites hosting pornographic content and escort services operating in Brazil to assess whether they have implemented mechanisms to prevent access by children and adolescents. According to the ANPD, the initiative is preventive in nature and intended to evaluate companies' level of compliance with recently adopted regulatory requirements while identifying compliance gaps that could support future enforcement actions.
ANPD opens public consultations on data protection and new rules applicable to digital platforms
The ANPD and the Brazilian Office of the Comptroller General have opened a public consultation on the Guide to Transparency and Personal Data Protection, with contributions open until July 24. The document provides objective guidelines to assist public bodies and government agencies in evaluating requests for access to information involving personal data, and seeks to promote an appropriate balance between government transparency, access to information, and the protection of personal data.
Furthermore, on June 30, the ANPD opened a call for contributions regarding the new rules applicable to digital platforms under Decrees #12,975/2026 and #12,976/2026. As detailed in our previous Client Alert, “ANPD opens Call for Contributions on Brazilian Internet Act updates”, the consultation seeks to gather contributions on regulatory priorities, the duty of care, systemic risk, transparency, proportionality of regulatory requirements, and supervisory strategies. Contributions can be submitted until August 17.
Why it matters
These public consultations are intended to inform the development of future regulations addressing transparency in the context of data protection, as well as the new obligations applicable to digital platforms. This is a good opportunity to anticipate regulatory trends and influence their rulemaking process.
Other relevant regulatory developments
On June 1st the ANPD launched a dedicated channel for reporting violations of the ECA Digital, allowing citizens to report irregularities related to the protection of children and adolescents on platforms and websites. As discussed in our Client Alert, “ANPD Opens Reporting Channel for the Digital ECA", the initiative represents a significant step in the implementation of the new legal framework, by establishing a dedicated mechanism for receiving and analyzing complaints by the authorities.
In the gaming sector, the 1st Court of Childhood and Youth of the Federal District issued a decision condemning major game developers and app stores operators to pay multimillion-dollar damages for offering — or allowing the offering of — loot boxes to minors through their platforms. The total amount awarded reached BRL 333,000,000.00 (three hundred and thirty three million Brazilian reais). As discussed in our Lexology article, “Brazil's First Loot Box Ruling:"Key Takeaways for Digital Companies," the decision offers important guidance for digital companies operating in Brazil — not just those directly involved with loot boxes, but any company that offers digital services for underages in Brazil.
On June 12, the ANPD submitted to the Ministry of Justice and Public Security a set of guidelines for the development of the Brazilian Policy for the Protection of Personal Data and Privacy. The proposal forms part of the 2025-2026 Regulatory Agenda and is intended to guide the actions of public authorities, private sector organizations, and civil society on issues including data protection culture, governance, transparency, international cooperation, and the protection of vulnerable data subjects.
Finally, during the G7 Summit on June 17, President Lula reiterated his support for regulation of the digital environment as a means of protecting fundamental rights, combating online crime, and addressing risks associated with the use of artificial intelligence. His remarks also emphasized the protection of children and adolescents online and called for greater engagement by major technology companies.
What to expect in the coming months
Over the coming months, the Brazilian digital regulatory agenda should focus on the practical implementation of the new rules applicable to digital platforms. The Supreme Federal Court's final decision and the call for contributions opened by the ANPD should guide the next steps regarding the duty of care, transparency, overseeing, and proportionality of obligations.
The protection of children and adolescents must also remain a priority, with continued implementation of the ECA Digital, oversight of app stores, operating
systems, and websites containing pornographic content.
At the same time, the ANPD is expected to continue its enforcement on data governance, including topics such as the appointment of a data protection officer, customer service channels, and data sharing with third parties.
