The debate surrounding the regulation of digital platforms has become an increasingly prominent topic on the regulatory agenda in Brazil. Over the last decade, the country has enacted a series of statutes that directly affect the operations of companies in the sector, including the Brazilian Internet Act, the Brazilian General Data Protection Act (LGPD), and, more recently, the Digital Statute for Children and Adolescents (ECA Digital), as well as their respective implementing regulations.

As part of this ongoing regulatory movement, Brazil’s Ministry of Justice and Public Security (MJSP), together with the Brazilian Secretariat for Consumer Protection (Senacon), the Brazilian Secretariat for Digital Rights (Sedigi), and the Brazilian Secretariat for Digital Policies (SPDIGI), recently issued Joint Ordinance #3/2026, which establishes new rules governing advertising, content boosting, and the prevention of misleading, abusive, or fraudulent advertising in the digital environment.

The Ordinance stems from Decree #12,975/2026, which amended the regulations implementing the Brazilian Internet Act to require providers offering advertising or content boosting tools to retain information regarding advertisements and advertisers for one year after the end of their dissemination. The measure was intended to facilitate the identification of individuals and entities responsible for scams, fraud, and other unlawful activities carried out through online advertising.

However, while the Decree established this data retention obligation, uncertainties remained regarding how public authorities could access and use such information. For this reason, the Decree stipulated that the procedures governing access to these records would be further regulated through a specific governmental act.

Against this backdrop, Joint Ordinance #3/2026 was published on September 23, establishing additional rules for the framework’s implementation and for the sharing of information retained by providers.

Who Is Subject to the Ordinance?

The Ordinance applies to (i) internet application providers that intermediate third-party content and offer advertising or content boosting services directed at the Brazilian consumer market, regardless of whether they are based outside Brazil and (ii) providers of advertising content disseminated through these platforms.

Transparency and Retention of Advertising and Content Boosting Information

A core focus of the Ordinance involves transparency obligations and data retention requirements for advertisements and boosted content. Platforms must provide mechanisms enabling the party responsible for the content to clearly disclose the identity of the natural or legal person with whom it maintains a material relationship concerning the dissemination of such content.

Providers must require, as a condition for contracting advertisements and content boosting, at least the following information:

• the content of the advertisement or boosted content;

• the advertised product, service, or brand;

• the identification of the contracting party;

• the period during which the content will be disseminated;

• the criteria used to target the advertisement, including parameters used to exclude user groups;

• the estimated number of users reached;

• the electronic addresses associated with the content;

• payment-related information; and

• the unique identifiers that allow the unequivocal location of the advertisement or boosted content.

This information must be retained for at least one year following the end of the relevant advertising placement. Platforms must also retain records of user notifications, court orders concerning the advertisement or boosted content, and the measures adopted in response to each case.

Furthermore, the regulation establishes specific requirements for advertisements involving financial products and services. In such instances, platforms must request and verify: (i) the identity of the contracting party; (ii) the validity of any registrations, authorizations, accreditations, or licenses required by the competent authority; and (iii) the advertiser's authority to represent the entity offering the product or service.

This verification must be renewed at intervals not exceeding twelve months. In addition, platforms may suspend the dissemination of an advertisement if inconsistencies are identified in the provided information, if the required authorizations are no longer valid, or if there are indications of misleading, abusive, or fraudulent practices.

Public Repository for Advertising and Content Boosting Information

To increase transparency, providers with over one million monthly active users in Brazil must maintain a public repository with the information retained (as detailed in the previous section).  

In addition to being public, free of charge, and accessible on a non-discriminatory basis, the repository must allow users to search, filter, sort, and retrieve the available information. Furthermore, the data must be provided in an open, structured, interoperable, and machine-readable format to enable automated queries.

Advertising Content Providers

The Ordinance establishes specific transparency obligations applicable to advertising content providers. Regardless of the medium through which the content is displayed, these entities must clearly disclose any material relationship connected to the dissemination of such content. This disclosure must be prominent, written in simple and clear language, and remain visible for as long as the related content is available.

Enforcement

Finally, the Ordinance takes effect in two stages. The obligation to provide mechanisms enabling the party responsible for the content to clearly disclose the identity of the natural or legal person with whom it maintains a material relationship concerning the dissemination of such content will take effect on December 22, 2026. All other provisions of the Ordinance have been in force since October 23, 2026.

Also, the Ordinance empowers Senacon to oversee and enforce the new rules. Sedigi and the Brazilian Secretariat for Digital Policies of the Secretariat for Social Communication of the Presidency will provide technical support to Senacon on matters concerning the protection of rights in the digital environment.

Platforms must diligently and expeditiously handle notifications issued by authorities within the National Consumer Protection System. The provider must promptly acknowledge receipt of the notification to the authority, inform it of the measures adopted, and transmit to the notifying authority the information that is necessary to identify the advertiser or sponsor of the advertisement or boosted content and to investigate the violation.

Next Steps

Joint Ordinance #3/2026 details the obligations introduced by Decree #12,975/2026, particularly those relating to advertising transparency and data retention. In doing so, the regulation seeks to strengthen the enforcement framework applicable to digital advertising and enhance consumer protection online.

Companies subject to the Ordinance must assess whether their current advertising, content boosting, and data retention practices align with the new requirements. Particular attention should be given to data retention procedures, the implementation of public advertising repositories, transparency mechanisms for sponsored content, and the verification processes required for financial advertisements.

Adopting compliance measures is essential for digital platforms to mitigate regulatory risks. Implementing these frameworks enables companies to avoid inquiries, enforcement actions, or potential sanctions imposed by competent authorities.

‍