Brazil gives data agency power to enforce Supreme Court’s Big Tech ruling

RIO DE JANEIRO (CN) — Two decrees signed Wednesday by Brazilian President Luiz Inácio Lula da Silva and published Thursday turn the Supreme Court’s ruling on digital platform liability into administrative rules and give Brazil’s National Data Protection Authority a central role in overseeing tech companies.

One decree addresses the protection of women online and violence against women in digital spaces.

The other has broader reach. It amends the regulation of Brazil’s 2014 Internet Bill of Rights, known as the Marco Civil da Internet, and details platforms’ obligations under the court’s ruling on liability for third-party content.

It creates obligations for internet platforms, sets rules for notifications of illegal content, ads, paid promotion and artificial content distribution networks, and requires platforms to maintain a local office and legal representative in Brazil.

It also gives the National Data Protection Authority power to regulate, supervise and investigate violations related to platforms’ duties. Known in Brazil by its Portuguese acronym ANPD, the agency was created to oversee compliance with the country’s personal data protection law and now assumes a broader role in digital regulation.

The rules follow a June 2025 Supreme Court decision that reshaped platforms’ civil liability for content posted by third parties.

The court changed its interpretation of Article 19 of the Marco Civil, which had generally held platforms liable only if they failed to comply with a court order requiring content removal.

The ruling created different liability regimes. In cases involving serious crimes, platforms may be held liable for systemic failure if they fail to adopt adequate measures against the circulation of illegal content.

In other cases, liability may arise after an extrajudicial notice. Defamation and similar offenses still require a court order.

Francisco Brito Cruz, a law professor at IDP, said the decree tries to answer questions left by the Supreme Court’s ruling, including how to define systemic failure and the criteria for extrajudicial notices.

“These questions were brought to the Supreme Court in motions for clarification, but depending on the court’s response, they would still continue to exist,” he said. “And eventually, they would be resolved through case law.”

Cruz said the government used the decree to work within that area of uncertainty and answer some of those questions. The main answer was to give the ANPD the role of setting parameters for applying the new rules.

“If there is one major new development, this is it,” Cruz said.

Cruz said the ANPD should not replace the judiciary in determining civil liability. The agency should establish technical parameters that may guide the analysis of systemic failures.

Rony Vainzof, founding partner at VLK Advogados, a law firm specializing in innovation and technology, said the ANPD’s role should not focus on reviewing individual posts.

“The ANPD, in this case, should not — and will not — analyze content individually to say whether a certain post is lawful or unlawful,” Vainzof said. “The assessment should focus on potential systemic failures.”

Vainzof said this is central because the isolated existence of illegal content is not enough to hold a platform liable.

Fabrício Polido, a partner in the digital law practice at L.O. Baptista, said the decree expands the ANPD’s institutional role and places the agency at the center of Brazil’s digital governance.

Polido said the debate is no longer limited to the removal of specific pieces of content. It now involves how platforms structure their prevention, reporting, response and risk management mechanisms.

“The central issue, therefore, will be the ANPD’s ability to structure itself technically and institutionally to perform this new role,” Polido said.

The new role adds to the ANPD’s regulatory workload. The agency already oversees personal data protection and has also taken on duties under Brazil’s Digital Child and Adolescent Statute, a law focused on protecting children and teenagers in digital environments.

In a statement, the ANPD said it is preparing to carry out the duties assigned to it under the decrees. The agency said it will assess platforms’ systemic conduct rather than review the content of specific posts.

It will also oversee compliance with obligations aimed at preventing the mass circulation of criminal content. Those duties also cover digital fraud, misleading ads and scams, the agency said.

The ANPD said its recent transformation into a regulatory agency expanded its institutional capacity and autonomy. It added that the decrees reinforce the need to continue strengthening the agency as it takes on new duties.

Cruz said the decrees were published in an unusual context created by the Supreme Court’s own ruling.

The court found that Article 19 of the Marco Civil had come to offer insufficient protection for Brazilians’ fundamental rights amid changes in the digital environment.

The decision cites the idea of “progressive unconstitutionality.” Under that reasoning, a rule that was considered adequate when it was created may later fail to protect constitutional rights as circumstances change.

“It is almost as if the Marco Civil had been born with sufficient protection, but the circumstances of the world had changed the degree of sufficiency in the protection of constitutional rights,” Cruz said.

From that reading, the executive branch had to organize parts of the law’s implementation under the Supreme Court’s interpretation, Cruz added.

The arrangement could still change. The Supreme Court is expected to begin reviewing motions for clarification on May 29 against the Marco Civil ruling. Cruz said the decrees may be mentioned in that review and that the court’s decision could still affect how the new rules are applied.

Tech companies may also take the dispute to Congress. Cruz said the Supreme Court’s ruling and the decrees reduce pressure from the court for lawmakers to act, since the justices have already defined a new regime. But platforms may now pressure Congress to pass a law that replaces or changes the arrangement created by the ruling and the decrees.

Because the parameters were set by decree, a future president could also change or undo part of the rules through the same instrument, Cruz said.

The Brazilian Chamber for the Digital Economy, an industry group representing major digital platforms in Brazil, did not respond to a request for comment.

Courthouse News reporter Marília Marasciulo is based in Brazil.