Brazil's Supreme Court Rewrote Platform Liability Rules: What Foreign Tech Companies Must Do Now
Brazil's Supreme Court rewrote platform liability law in June 2026. Learn what changed under the Marco Civil da Internet and what foreign platforms must do
7/30/20264 min read
Your platform just received an extrajudicial notice from a user in Brazil claiming a piece of content is defamatory or unlawful, and your legal team is asking whether you can wait for a court order before deciding what to do with it. Until recently, the answer was yes. As of June 2026, in most cases, it is no.
On June 17, 2026, Brazil's Supreme Federal Court (STF) closed out the last appeals in the case that had already declared Article 19 of the Marco Civil da Internet (Brazil's Internet Civil Rights Framework, Law No. 12,965/2014) partially unconstitutional. The Court unanimously declared the ruling final and enforceable immediately, even before the written judgment is published. Two federal decrees issued shortly before, Decree No. 12,975/2026 and Decree No. 12,976/2026, already put detailed implementation rules in place. This is not a bill working its way through Congress. It is current law, and it changes how any platform with users in Brazil, wherever the company is headquartered, must handle takedown requests, notices, and content moderation.
For foreign social media companies, marketplaces, SaaS platforms with user generated content, and any business whose product lets Brazilian users post, comment, or upload, this is not a background policy shift. It is an operational compliance deadline.
What the old rule said
Until this ruling, Article 19 gave platforms a broad safe harbor: a platform could only be held civilly liable for third party content if it failed to comply with a specific court order to remove that content. Extrajudicial notices, complaints sent directly by users or by lawyers, generally did not trigger liability on their own. This made Brazil one of the more protective jurisdictions for platforms compared to the EU's Digital Services Act or the evolving US approach to Section 230.
What changed: two liability regimes
The STF replaced that single rule with two separate tracks, depending on the type of content involved.
Regime one: ordinary unlawful content. For most unlawful content and civil wrongs, a platform that receives an extrajudicial notice and fails to act without justification can now be held jointly and severally liable with the person who posted the content. This is a meaningful expansion of exposure. The Court did build in a safeguard: liability is excluded if the platform can show it conducted a diligent and qualified review and had reasonable doubt about whether the content was actually unlawful. In practice, this means platforms need a documented, defensible review process, not just a mailbox for complaints.
Regime two: serious, mass circulation crimes. For a defined list of severe content, including anti democratic acts, terrorism, incitement to suicide, crimes against women, child sexual abuse material, and human trafficking, the rule is stricter. Takedown must be immediate and does not depend on a prior notice at all. Liability arises from systemic failure to act, unless the platform demonstrates it responded diligently within a reasonable timeframe. Platforms (or the person who posted the content) can also seek a provisional injunction to prevent removal, which adds a due process check in the other direction.
Paid content and boosting. Advertisements and algorithmically boosted content are no longer subject to a flat presumption of liability. The Court replaced it with a "relative presumption of fault," a more nuanced standard that still puts paid and amplified content under closer scrutiny than organic posts.
What stayed the same. Obligations around platform self-regulation, user service channels, and the requirement to maintain a legal representative in Brazil were preserved.
The two decrees that came before the ruling
Decree No. 12,975/2026 details how the new liability regime works in practice: platforms must issue reasoned decisions on content removal or retention, communicate those decisions to affected users, and provide a means to contest them. Extrajudicial notices themselves now have formal requirements, they must identify the content precisely and state the reasoning behind the complaint.
Decree No. 12,976/2026 sets out specific protections for women facing digital gender violence, holding platforms responsible for systemic failure to promptly remove content that constitutes crimes against women.
The compliance deadline
The ruling's effects run retroactively (ex nunc) from August 5, 2025, except for ongoing acts and cases already final. Separately, platforms have 60 days from the publication of the appeals ruling minutes (published June 18, 2026) to implement the structural duty of care obligations tied to serious, mass circulation content. That puts the operational deadline in mid August 2026.
What foreign platforms should do now
Companies operating in Brazil, even without a local office, should review their notice and takedown workflow to confirm it can process extrajudicial notices on the new timeline, document the "diligent and qualified review" standard for content that is not clearly unlawful, confirm their local legal representative arrangement is current, and update user facing processes for reasoned decisions and contestation, as now required by Decree 12,975/2026.
FAQ
Does this ruling apply to platforms with no physical presence in Brazil?
Yes. If a platform has users in Brazil, Brazilian law and the legal representative requirement apply regardless of where the company is incorporated or headquartered.
What counts as "unjustified inaction" after an extrajudicial notice?
The precedent does not set a fixed number of days. It requires platforms to show a genuine, documented review of the notice. A generic auto reply or an indefinite delay is unlikely to qualify as diligent action.
Is there still any safe harbor for ordinary content?
Yes, but it is narrower and conditional. A platform can avoid liability for ordinary unlawful content if it shows reasonable doubt about the content's unlawfulness following a diligent, qualified review, not simply by waiting for a court order as before.
Does this treat social media, marketplaces, and SaaS platforms differently?
The core liability framework applies broadly to internet application providers hosting third party content. Marketplaces and SaaS products with user generated content (reviews, listings, uploads) fall within scope, though the practical risk profile varies by how much third party content the product surfaces.
What is the actual deadline to comply?
Structural duty of care obligations for serious, mass circulation content must be implemented within 60 days of the June 18, 2026 publication of the ruling's minutes, putting the deadline around mid August 2026.
Is your platform ready for Brazil's new content moderation standard
If your company operates a platform with users in Brazil and needs to assess exposure under the STF's new liability framework, review notice and takedown procedures, or confirm your legal representation is in order, Reis Araujo Advogados' digital law team can help. contact us
