President Luiz Inácio Lula da Silva has signed two decrees that expand Brazil’s rules for digital platforms, adding new duties on content moderation, transparency and the protection of women online. The measures have opened a broader dispute over who should regulate online speech and platform conduct in Brazil: Congress, the courts, the executive branch or a still-young data-protection agency.
The decrees, published on May 21 after being signed the previous day, update rules linked to the Marco Civil da Internet, Brazil’s 2014 Internet Bill of Rights. The government says the measures respond to online crimes, fraud, sexual exploitation, harassment and the non-consensual sharing of intimate images.
What the Rules Do
Decree No. 12,975 changes the 2016 regulation of the Marco Civil. According to the government, it sets duties for internet application providers on content moderation, service security, risk management, transparency reports, paid promotion and the prevention of mass circulation of criminal content.
The decree covers content linked to terrorism, child sexual exploitation, trafficking in persons, violence against women, electronic fraud and artificial networks used to spread illegal material. It says platforms may be held responsible for systemic failures to adopt adequate prevention or removal measures, while also stating that an isolated illegal post does not by itself prove systemic failure.
A second decree, No. 12,976, creates rules focused on violence against women in digital spaces. It requires platforms to remove non-consensual intimate content within two hours after notification by the victim or a representative. It also covers threats, cyberstalking, gender-based political violence, misogynistic content and manipulated images or audio created with artificial intelligence.
The government frames the rules as part of a broader push against femicide and violence against women. Lula said at the Planalto Palace, the seat of Brazil’s executive branch, that society must treat violence against women and girls as a shared responsibility.
Legal Objections
The measures rely in part on recent case law from Brazil’s Supreme Federal Court (STF), which changed the legal debate over Article 19 of the Marco Civil, the provision that traditionally limited platform liability for third-party content unless there was a specific court order.
Ronaldo Lemos, a lawyer and director of the Rio de Janeiro-based Institute for Technology and Society, argued in a Folha de S.Paulo column that the decrees overstep constitutional limits. He wrote that presidential decrees can regulate laws, not court decisions, and said the STF itself had called on Brazil’s Congress to legislate on the issue.
Lemos also argued that the texts create new rights and obligations by decree, which he says should be done only by statute. His strongest criticism concerns the National Data Protection Authority (ANPD), which the decrees designate as the body responsible for regulation, supervision and sanctions related to the new platform duties.
The ANPD Problem
The ANPD was created to enforce Brazil’s General Data Protection Law. It has now become central to the country’s response to digital platforms, artificial intelligence and online harms. That expansion is raising practical questions.
Agência Lupa reported that the ANPD opened only one formal inspection procedure in 2026, against X over allegations involving Grok-generated images of children and adolescents. That compares with 38 procedures opened between January and May 2025, according to Lupa.
The agency told Lupa that the number of formal procedures does not, by itself, measure its institutional activity. But specialists quoted by the outlet said the agency faces overload, staff shortages and political pressure as it absorbs new responsibilities, including duties under the ECA Digital, a child-protection law for online environments.
Lupa reported that the ANPD had 140 staff members, all seconded from other public bodies, and was awaiting authorization for a civil-service hiring process. The agency also faces leadership uncertainty, with one board seat vacant and three directors’ terms due to end later this year.
The decrees therefore combine two separate debates. One is substantive: whether Brazil needs faster tools to curb fraud, sexual abuse, harassment and AI-enabled violations online. The other is institutional: whether those tools can be created by presidential decree and enforced by an agency that may not yet have the structure to carry them out.