Platforms must act proactively, but the line between accountability and censorship remains blurred.
In a ceremony timed to mark 100 days of Brazil's National Pact Against Femicide, President Lula signed a decree reshaping the country's digital governance, placing new obligations on platforms that profit from Brazilian users regardless of where those companies are incorporated. The update to the 2016 Marco Civil de Internet reflects a broader global reckoning with the question of who bears responsibility for the harms that flourish in digital spaces — the users who create content, or the companies that amplify and monetize it. Brazil's answer, for now, is the latter, with a newly empowered Data Protection Authority positioned to hold that line.
- Digital fraud, child exploitation, human trafficking, and coordinated disinformation have outpaced the decade-old rules meant to govern Brazil's internet, creating urgent pressure for reform.
- The decree disrupts the long-standing posture of global platforms that claimed neutrality and used foreign incorporation to sidestep local accountability — that exemption is now explicitly closed.
- A single regulatory body, the National Data Protection Authority, absorbs sweeping new investigative and supervisory powers, consolidating enforcement in ways that could either sharpen accountability or concentrate institutional risk.
- Platforms must now retain advertising data trails, notify users of content reviews, and take proactive steps against criminal material — concrete mechanisms designed to convert legal obligation into operational practice.
- The decree's explicit protections for free expression, parody, and religious speech signal an attempt to hold two competing values in tension, but the real test arrives only when enforcement begins.
On May 20, President Luiz Inácio Lula da Silva signed a decree at the Palácio de Planalto that fundamentally redraws Brazil's digital regulatory landscape. The signing was deliberately timed to coincide with 100 days of the National Pact Against Femicide, anchoring the new rules in the government's stated commitment to protecting vulnerable populations from online harm.
The decree updates the Marco Civil de Internet — the foundational framework established in 2016 — by shifting responsibility for harmful content away from passive conduits and onto the platforms themselves. Companies are now required to take "proactive and proportional" measures to prevent the circulation of criminal material, and crucially, this obligation applies to any platform operating in Brazil regardless of where it is headquartered. A California or Singapore address offers no legal shelter.
The National Data Protection Authority, previously confined to privacy matters, gains broad new powers to investigate and enforce platform compliance. Platforms that sell advertising must retain data identifying who placed ads and who profited — creating traceable records that can expose fraud and support victim compensation. The rules specifically target terrorism, child sexual exploitation, human trafficking, self-harm promotion, and violence against women. A notification system requires platforms to inform both the person who flags content and the account holder before any review is concluded, building in transparency and limiting arbitrary removals.
The government framed the decree as a necessary response to the explosion of digital crime across Brazilian social media — scams, fake advertisements, and disinformation campaigns that platforms have profited from while claiming neutrality. Yet explicit guardrails were written in: protections for free expression, criticism, parody, and religious speech remain intact. Whether the decree becomes a model for digital citizenship or a mechanism for suppression will depend entirely on how the Data Protection Authority chooses to wield its new mandate.
President Luiz Inácio Lula da Silva signed a decree on May 20 that fundamentally reshapes how Brazil regulates its digital platforms, tightening rules that have governed the internet since 2016. The signature came during a ceremony at the Palácio de Planalto marking 100 days of the National Pact Against Femicide, a timing that underscored the government's focus on protecting vulnerable populations from online harm.
The updated framework expands what platforms must do to combat fraud, violence, and illegal content circulating across their networks. Where the original Marco Civil de Internet established baseline protections for users, this new decree places the burden squarely on the companies themselves—requiring them to act with what the government calls "proactive and proportional" measures to prevent the spread of criminal material. Critically, the rule applies to any platform operating in Brazil, regardless of where its headquarters sit. A company based in California or Singapore cannot claim exemption by pointing to its foreign address.
The National Data Protection Authority emerges as the enforcement muscle. Previously focused narrowly on privacy issues, the agency now gains broad supervisory and investigative powers over platform compliance. It can examine whether companies are meeting their obligations, launch investigations into violations, and pursue accountability. This represents a significant consolidation of regulatory authority in a single institution.
The decree targets specific harms with concrete requirements. Platforms that sell advertising must retain data identifying who placed ads and who benefited from them—creating a paper trail that can expose fraud schemes and help victims pursue compensation. The rules explicitly address terrorism content, child sexual exploitation, human trafficking, self-harm promotion, and violence against women. When someone reports a post, platforms must notify both the person who flagged it and the account holder, then review the content according to set procedures. This notification system aims to create transparency without handing platforms a blank check to remove content without explanation.
The government framed the decree as a response to the explosive growth of digital crime. Scams, fake advertisements, and coordinated disinformation campaigns have proliferated across Brazilian social media. The new rules attempt to make platforms responsible for the ecosystem they profit from, rather than treating themselves as neutral conduits.
Yet the decree includes explicit guardrails against the kind of censorship that critics feared. The government reaffirmed protection for free expression, the right to information, religious speech, criticism, and parody. The notification and review procedures are designed to prevent arbitrary takedowns. The balance the government claims to strike—accountability without prior censorship—will face its real test in implementation. How strictly will the Data Protection Authority enforce these rules? How will platforms interpret "proactive" action without becoming overzealous? These questions will shape whether the decree becomes a model for protecting digital citizens or a tool for suppressing speech.
Citas Notables
Companies must act in a proactive and proportional manner to prevent the circulation of criminal content— Brazilian Government statement
The decree reaffirms protection for free expression, information rights, religious speech, criticism, and parody— Brazilian Government
La Conversación del Hearth Otra perspectiva de la historia
Why did the government choose to update the 2016 framework now, after a decade of relative stability?
The digital landscape has changed completely. Scams, coordinated disinformation, and violence against women have moved from rare to epidemic. The old rules didn't anticipate the scale or sophistication of what's happening now.
But doesn't putting this power in the hands of a single authority—the Data Protection Agency—create a concentration of control that could be abused?
That's the real tension. Yes, you're giving one agency enormous power. But the alternative is letting platforms police themselves, which they've shown they won't do effectively. The decree tries to constrain that power with notification procedures and explicit carve-outs for free speech.
How does a platform know what "proactive and proportional" means in practice?
That's deliberately vague, and it's a problem. A company might remove something aggressively to avoid penalties, or move slowly to avoid accusations of censorship. The Data Protection Authority will have to issue guidance, and that guidance will become the real law.
What happens to someone who gets defrauded through a fake ad on these platforms?
Now there's a trail. The platform has to keep records showing who bought the ad, who profited from it. That data can be used to identify the perpetrator and potentially recover money. Before, victims had almost no recourse.
Does this decree apply equally to small platforms and giants like Meta or TikTok?
Legally, yes. But enforcement will be uneven. A small Brazilian platform might face immediate scrutiny, while a multinational might negotiate. That's always the problem with regulation—the law is written in the abstract, but power determines how it's applied.
What's the biggest risk this decree creates?
That platforms, facing uncertainty and potential penalties, overcorrect and remove legitimate speech. A post criticizing the government, a religious sermon, a parody—all could get caught in the net if platforms are afraid.