Internet Civil Rights Framework: new rules in Brazil require proactive risk-based approach

Brazil has taken another step to strengthen the regulatory framework on online platforms under the Internet Civil Rights Framework (Marco Civil da Internet). Two decrees published in May have recently entered into force, reinforcing a shift from a reactive liability model to a governance- and risk-based approach, introducing new expectations regarding proactive measures, transparency, risk mitigation, and the protection of users against unlawful digital content.

Following the entry into force of the decrees, the Brazilian National Data Protection Authority (ANPD) clarified the implementation of the new regime and launched a public consultation to support future regulatory developments related to Brazil’s Internet Civil Rights Framework.

Key regulatory developments

The new framework either introduces or reinforces the following obligations:

Systemic risk management

Platforms must monitor, identify, review, and manage systemic risks created or amplified by their services and by the circulation of certain criminal or unlawful content.

Proactive duty of care

Platforms that intermediate user-generated content may be held liable for systemic failures in ensuring that unlawful content is immediately made unavailable. An isolated unlawful post does not constitute a systemic failure; this review must assess if the platform has adopted adequate preventive and responsive measures.

Notice and action procedures

Platforms must maintain accessible reporting channels, acknowledge receipt of complaints, assess their merits, and communicate decisions and the reasoning behind them to both the reporting party and the user responsible for the content.

Right to due process and free speech

Content moderation decisions must be well-founded and subject to disputes. Assessments should consider context and whether the content has an informational, educational, critical, satirical, or parodic purpose.

Violence against women

Reports involving non-consensual sharing of intimate content must be addressed promptly. In certain cases, platforms must take action within two hours.

Paid advertisements and promoted content

Platforms offering paid advertising or boosting tools must prevent the dissemination of unlawful content. The decree establishes a specific liability framework for unlawful content publicized through paid advertising, promoted content, or artificial content distribution networks.

These platforms must also keep records of each ad or boost and its respective advertiser for one year after the campaign ends.

Transparency and self-regulation

The platforms’ terms of use and other self-regulatory instruments must address notification systems, due process safeguards, annual transparency reporting covering extrajudicial notices, advertisements, and promoted content.

Obligations tailored to platform size and risk

Obligations may be adjusted based on the provider’s economic size, its degree of involvement in the circulation of third-party content, and the risks associated with the service. Additional criteria should be established in future regulations.

Legal representation in Brazil

Platforms operating in Brazil must maintain a registered office and a legal representative in the country, with the authority to respond to administrative and judicial proceedings, provide information to competent authorities, and comply with applicable orders.

Immediate compliance measures

Given that the decrees are already in force, platforms should prioritize the following measures:

Confirming representation in Brazil

• • Verify that the platform maintains legal representation in Brazil and that its legal representative holds the powers required under the new regime.
  • Review the representative’s authority, internal escalation procedures, and capacity to respond promptly to Brazilian regulators and courts.

Conducting a regulatory gap assessment

Compare new obligations to existing Trust & Safety, Legal, Public Policy, Advertising Integrity, and Law Enforcement Response procedures.

Reviewing systemic risk controls

Assess how the platform identifies risks related to unlawful content, coordinated conduct, recommendation systems, viral content, paid promotion, and other product features that can exacerbate harm.

Strengthening notice and action workflows

Review reporting channels, required notification information, acknowledgment procedures, decision-making criteria, response times, and appeal mechanisms.

Documenting moderation decisions

Ensure that removal and non-removal decisions have a strong rationale and that affected users and reporting parties are consistently notified.

Reviewing safeguards against abusive reporting

Implement safeguards to prevent the misuse of notification mechanisms to suppress lawful speech, criticism, journalism, satire, or political expression.

Assessing serious content escalation protocols

Review procedures regarding content potentially involving terrorism, crimes against children and adolescents, racism, encouragement of suicide or self-harm, violence against women, and other categories covered by the new duty of care framework.

Strengthening digital violence safeguards

Review tools designed to combat harassment, threats, coordinated attacks, non-consensual disclosure of intimate content, and AI-generated or manipulated intimate material, including measures to mitigate repeated reposting and comply with applicable removal deadlines.

Reviewing advertising integrity controls

Evaluate advertiser onboarding, identity and payment verification, ad review, scam and fraud detection, political or sensitive advertising controls, and procedures for suspending unlawful campaigns.

Assessing artificial amplification mechanisms

Review controls relating to bots, coordinated inauthentic behavior, fake engagement, and other artificial distribution networks that may increase the platform’s exposure under the new liability framework.

Implementing advertising recordkeeping mechanisms

Establish processes for storing and retrieving advertising records in compliance with the retention periods established by the decrees.

Updating public-facing documentation

Review terms of use, privacy notices, community standards, reporting policies, appeal procedures, and transparency disclosures.

Preparing for ANPD systemic supervision

Organize evidence of risk assessments, governance decisions, internal policies, metrics, testing procedures, audits, mitigation measures, and internal controls that may be requested in future regulatory proceedings.

Monitoring the ANPD’s public consultation

Track developments in the consultation process and assess the relevance of submitting contributions on issues affecting the platform’s operations.

Establishing clear regulatory governance

Define responsibilities and coordination mechanisms among the Public Policy, Legal, Trust & Safety, Privacy, Security, and Product teams to ensure compliance with the new framework.

Demarest’s Privacy, Technology, and Cybersecurity team is available to provide further clarification on the matter.