Those who have been litigating for years in incidents with legal repercussions on digital platforms know that the means of addressing these issues provided for in the Brazilian Internet Bill of Rights have not become as swift as they should be, in favor of the victims.

When the victim is Brazilian, court orders are usually enforced by social media platforms—but not as quickly as expected, especially when dealing with illegal activities on digital platforms.

I am referring to the belated compliance with court orders to remove a photo, meme, or any other manipulated illicit content that has already gone viral. Too late to prevent the false advertisement from continuing to harm retirees.

Too late to hold the platform accountable for ignoring notifications for months.

The two decrees that come into effect from this date — one updating the regulations of the Brazilian Internet Bill of Rights, the other focused on protecting women in the digital environment — attempt to shorten this distance. They succeed, in part. In another aspect, they raise questions that will generate work and expectations in the coming months.

Background

The decrees didn’t appear out of nowhere. They attempt to implement, within the platforms’ routine, what the Supreme Federal Court decided in June 2025, when it ruled article 19 of the Civil Rights Framework for the Internet partially unconstitutional. That rule, from 2014, shielded the networks: they were only held civilly liable if they disobeyed a court order.

It worked while the internet was predictable. It broke down when the ecosystem began to include artificial intelligence, deepfakes , industrial-scale scams, scams via Pix (Brazil’s instant payment system), coordinated hate networks, and real-time crimes against children.

The Brazilian Supreme Court (STF) established two scenarios in which the platform responds without a court order: in the seven groups of serious crimes (terrorism, incitement to mutilation or suicide, coup d’état and attacks on democracy, racism, homophobia, crimes against women and children), when there is a “systemic failure”; and in other crimes, when it ignores extrajudicial notification. The decrees translate this decision into operational obligations.

What changes in the victim’s real life?

The key change is invaluable: it ends the mandatory legal battle in cases of obvious illegality. Victims of defamation, leaked nudes , or fraudulent advertisements can now directly notify the platform. If the complaint is substantiated and the content is illegal, removal is the network’s responsibility, without the need for a judge, lawyer, or injunction.

It’s difficult to grasp what this means for someone who has never litigated on this issue. In a recent case I followed, a client had intimate photos, manipulated by AI, published on three social media platforms. From the complaint to the first removal, twenty business days passed. During that time, the material circulated in private groups, was saved by strangers, and fueled extortion profiles.

With the new design, on paper, the process takes hours. For non-consensual intimate content, the deadline is two hours from the time of notification.

There are other relevant changes that deserve attention:

Active prevention against scams and fraud. Clearly fraudulent advertisements — such as “iPhone for R$ 200”, “illegal cable TV”, pyramid schemes disguised as investments, and dubious raffles and sweepstakes — can no longer circulate until the victim complains. The preventive omission of platforms now generates liability.

Mandatory data retention for publications and advertisers. It changes the game regarding accountability. Today, digital fraudsters disappear, delete their profiles, and the victim is left without a trace. Now there is a duty to preserve evidence, which enables investigation and redress.

Due process within the platform. Anyone whose content has been removed has the right to be informed, to contest, and to appeal. The networks are beginning to operate as small private courts, with clear rules of adversarial proceedings.

ANPD as an overseer. For the first time, there is a mandate to scrutinize what big tech companies are doing here. The action will be systemic — with policies, tools, and response standards — and not ad hoc. The platforms will have to submit periodic reports.

Mandatory legal representation in Brazil. A crucial operational detail: many cases were failing due to the inability to serve summons. Now there is an office and a local representative with the power to respond.

Second decree: digital violence against women

The second decree establishes three structural obligations.

Exclusive and permanent channel for reporting non-consensual intimate content, including real images and deepfakes . Integration with the 180 helpline connects digital reporting to the official women’s support system.

Two-hour deadline for removal after justified notification. Anyone who works with these cases knows: the damage grows exponentially in the first few hours. Cutting off circulation quickly is what distinguishes a scare from a tragedy.

Mechanisms to prevent the recirculation of already removed content. This acknowledges that the fight doesn’t end with the first removal: the same material resurfaces in new accounts, edits, and montages. There are also restrictions on the use of AI in creating fake or sexualized intimate images of women.

New strategies for lawyers working on these cases.

The situation calls for a review of routines. Five adjustments seem to be priorities.

Extrajudicial notification as an essential pre-trial act. It is the trigger for liability. Printout, hash, description of the offense and the violated device are important. A poorly executed notification compromises the claim of omission.

The request is anchored in the taxonomy of the seven serious crimes. The more the claim is linked to the categories of the Supreme Federal Court and the decree, the more difficult it becomes for the platform to allege doubt. Political violence, for example, is an attack on democracy, not an “opinion.”

Evidentiary records are required from the first contact. Even if there is immediate removal, the duty to preserve them must be explicitly stated. This is what enables the author and, potentially, the platform to be held accountable.

ANPD (Brazilian National Data Protection Authority) called upon in cases of systemic failures. The new architecture rewards administrative complaints that demonstrate a pattern of omission. Good cases will shape regulatory jurisprudence.

Intimate deepfake as an autonomous category. The decree equates real images with fake images generated by AI. The petition needs to explore this equivalence, including in the quantification of moral damages.

The points that are still a concern.

It would be reckless to present the decrees as a complete solution.

The instrument remains, in a way, fragile. A decree only regulates; it does not create an obligation. Part of the text goes beyond what the Civil Rights Framework for the Internet explicitly authorizes.

The partial unconstitutionality declared by the Supreme Federal Court opened a window for interpretation, but the safe path remains the law passed by Congress. Bill 2,630, on fake news, remains stalled, and this omission will exact its price—probably in direct actions of unconstitutionality in the coming weeks.

“Systemic failure” requires specific definitions. Without objective criteria, it will be up to the ANPD (National Data Protection Authority) to define, on a case-by-case basis, what constitutes a sanctionable omission. Regulatory uncertainty on all sides.

There is a real risk of excessive removal. Platforms, fearing fines, tend to delete too much content. Political criticism, satire, journalistic exposés, harassment complaints made by the victim themselves—everything can slip through the cracks. The decree expressly protects criticism, parody, satire, news, and religious expression, but the line is thin, and automated moderation makes mistakes every day.

The ANPD (National Data Protection Authority) lacks the structure for the size of its role. It was created to oversee personal data, not content. There is a shortage of positions, specialized technical staff, and institutional maturity. Without increased budget, oversight will be merely symbolic.

Alert from SaferNet — a leading organization in the fight against online child pornography. The organization highlights the risk of hindering automated detection technologies ( hashing , computer vision, deep learning ), which currently proactively remove millions of abusive images. If the text is interpreted as requiring prior notification for every removal, an essential layer of protection for the child is lost. This point requires a systematic reading of the Digital ECA (Brazilian Statute for Children and Adolescents).

Undefined sanctions. Without clarity regarding fines, suspensions, and blocking, the incentive for compliance weakens. Foreign platforms only comply when non-compliance costs more than compliance.

What to expect in the coming months

The regulation that matters begins now, with sub-legal norms from the ANPD (National Data Protection Authority) regarding deadlines, procedures, authorized parties, and the operational definition of a systemic failure.

Meanwhile, the first legal challenges are expected — likely from platform associations — and a new chapter in the dispute over the limits of regulatory power.

For the victim, the immediate outcome is positive. For the first time, there is a fast, free, and direct path. For the system, it will depend on three variables: the ANPD’s (National Data Protection Authority) supervisory capacity, the technical quality of the complementary regulations, and the Judiciary’s willingness to uphold—or overturn—what was done by decree.

What can no longer be done is to treat digital crimes with the same slowness as analog ones, under a particularly lenient accountability regime for platforms. In this assessment, even with all the reservations, the decrees are correct.

Credits: Conjur