Brazil is embarking on a significant overhaul of its internet intermediary liability regime, a move spearheaded by the Supreme Court and further detailed by recent presidential decrees. These changes introduce a complex landscape for online platforms, balancing the need to address online harms with the imperative to protect freedom of expression. ### The Shifting Sands of Liability The core of the new regime, following a **Supreme Court** decision in June clarifying its 2025 finding, dictates that social media platforms and other internet applications that curate or interfere with posts can be held liable for third-party content. This liability kicks in if they fail to remove content after a user notification, unless there's reasonable doubt about its unlawfulness. For certain serious crimes, such as human trafficking and crimes against women, platforms now bear a *duty of care* to remove related content immediately and can be held liable for systemic failures to do so. This marks a significant departure from the previous regime, established by Article 19 of the **Brazilian Civil Rights Framework for the Internet** (**Marco Civil da Internet**). The former framework largely protected online expression by holding providers liable for user content only if they failed to comply with a judicial order for removal, with limited exceptions. The court found this insufficient to safeguard democracy and fundamental rights. ### New Decrees: Strengths and Flaws Two presidential decrees, **Decree 12.975** and **Decree 12.976**, published in late May, further elaborate on the new rules. Decree 12.975 introduces changes to the previous **Decree 8.771/2016**, while Decree 12.976 focuses on measures to tackle online violence against women. Crucially, the decrees address user due process rights, which were not explicitly covered by the Supreme Court's decision. They mandate that providers must inform users (both the notifier and the content author) about content removal or retention decisions, the reasons behind them, and the available appeal mechanisms. This aims to prevent over-censorship by encouraging platforms to reconsider and reinstate content after an appeal. **Decree 12.975** also reinforces the ability of applications to keep content online when there's reasonable doubt about its unlawfulness, emphasizing the need to consider context, freedom of religion and belief, and any informational, educational, critical, satirical, or parodic purpose. This approach mirrors the **Digital Services Act**'s "notice-and-action" framework. However, the decrees introduce several concerning provisions: * **Proactive Reporting to Authorities**: A particularly troubling requirement mandates applications to proactively report content related to criminal conduct to government authorities, along with user identification information. This provision, which the Supreme Court did not address, raises significant privacy concerns as it appears to enable platforms to police and report users without a clear judicial order. * **Messaging Application Exemptions**: While clarifying exemptions for messaging applications from notice and duty of care obligations, the decrees exclude features for public dissemination and "open groups." The precise definition of "open groups" remains unclear, raising concerns about the potential impact on end-to-end encrypted communications, which must be safeguarded to protect privacy and free expression. * **Broad Definition of Online Violence**: **Decree 12.976** includes a broad definition of online violence against women, encompassing "any act, conduct, or omission that causes (...) psychological, political, or economic suffering (…) in any aspect of their lives, committed, instigated, facilitated, or aggravated, in whole or in part, by the use of digital technologies." This expansive definition could inadvertently lead to the censorship of legitimate criticism and other protected speech. ### Oversight and Future Challenges The decrees also grant the **Brazilian Data Protection Agency** (**ANPD**) powers to oversee and regulate the new regime, including the authority to apply penalties for breaches of content-related obligations. This expanded mandate for the ANPD has sparked debate regarding its legal basis, as these obligations extend beyond the agency's traditional competencies under the Data Protection Law. Brazil's new intermediary liability regime reflects a global trend towards increased platform accountability for online content. However, the path ahead is fraught with risks, including the potential for entrenching dominant platforms' power, escalating arbitrary online surveillance, and undue censorship. Cybersecurity professionals and privacy-conscious users must remain vigilant as these regulations take shape, ensuring that the pursuit of a safer online environment does not come at the cost of fundamental digital rights.