The duties of digital platforms now cover risk prevention, moderation, transparency and rules for advertisements.
What has changed in the duties of digital platforms
The duties of digital platforms have been given more detailed parameters by Decree No. 12,975/2026. The rule amended Decree No. 8,771/2016, which regulates the Marco Civil da Internet (Brazilian Internet Civil Rights Framework).
First, application providers must maintain a registered office and a legal representative in Brazil. That representative must answer before administrative and judicial authorities, comply with court orders and respond to sanctions applicable to the provider.
In addition, platforms must offer a permanent and accessible channel for reports. The channel must allow express notification of criminal or unlawful content.
The decree also requires measures against artificial networks for the distribution of unlawful content. Likewise, providers must adopt means aimed at the security and transparency of their services.
The rule further expanded the duties regarding the retention of records. Where necessary for unequivocal identification, the retention of the IP address must include the source logical port.
Who is affected by the new rules for digital platforms
The rules reach providers that intermediate content generated by third parties. In particular, the text provides for liability in the event of a systemic failure to immediately remove criminal content defined in the decree.
This group includes, for example, content relating to terrorism, suicide, discrimination, violence against women and the sexual exploitation of children and adolescents. It also covers human trafficking and crimes against the Democratic Rule of Law.
However, the mere isolated presence of unlawful content does not characterise a systemic failure. The authority must assess whether the provider adopted adequate prevention or removal measures.
In addition, providers must diligently monitor, identify, assess and manage systemic risks. The analysis takes into account the activities of the service and the circulation of the content covered by the rule.
On the other hand, e-mail services, private interpersonal messaging and audiovisual communication within restricted groups receive different treatment. For these categories, the duties set out in part of the moderation rules do not apply.
Deadlines and exceptions in content moderation
After receiving a notification, the platform must confirm receipt. It must then assess the content and inform the notifying party and the user responsible for the publication of its decision.
In the event of removal, the provider must state the specific grounds and the means of challenge. If it keeps the content online, it must also explain the reasons for the decision.
The decree requires the removal of content that constitutes a criminal offence, upon notification, except in the case of offences against honour. Therefore, for offences against honour, the provider’s liability continues to depend on a specific court order.
In addition, the platform may keep the content online where there is reasonable doubt as to its criminal nature. In such a case, it must provide reasoned justification to the notifying party.
The application of these measures must take into account the context of the publication. Religious freedom, informative purpose, criticism, satire and parody must also be preserved.
What to do now and what depends on further regulation
Companies operating applications should review reporting channels, internal workflows and decision records. They must also examine their rules on profiling, advertising and paid boosting.
For paid advertisements, the decree requires measures against the contracting of criminal or unlawful content. In addition, providers must retain data on advertisements and advertisers for one year after the end of their display.
The text presumes the provider’s liability for unlawful content in advertisements, boosted posts or artificial networks. However, the provider may rebut that liability if it proves diligent action within a reasonable period.
Platforms must also publish and review self-regulation rules. Those rules must cover notifications, due process and annual transparency reports.
Finally, the ANPD (Brazilian National Data Protection Authority) will act in the regulation, supervision and investigation of infringements. Complementary criteria on notifications, deadlines and parameters of diligent action will still be required.
The new regime calls for attention to digital governance and to the organisation of internal processes. Monitoring of changes in business legislation.
Full text: https://www.planalto.gov.br/ccivil_03/_ato2023-2026/2026/decreto/D12975.htm