Client Alerts

Supreme Court widens scope of liability for digital platforms and ASPs

November 7th, 2025

In June 2025, the Brazilian Federal Supreme Court (STF) expanded the parameters of liability for application service providers (ASPs) and other digital platforms, particularly regarding content published by third parties.

In ruling on General Repercussion Topics 533 and 987, the STF established binding precedents reinterpreting Article 19 of the Brazilian Civil Rights Framework for the Internet (Law 12,965/2014). The STF found that Article 19 contained a regulatory loophole, given that it did not effectively protect certain fundamental rights and democracy.

Below is a comparative chart of the original Brazilian Civil Rights Framework for the Internet (Article 19) and the STF’s amendments.

STATUS	Before amendments (original interpretation of Article 19)	After amendments (General Repercussion Topics 533 and 987 – STF)
LEGAL BASIS	Article 19 of Law 12,965/2014 (Brazilian Civil Rights Framework for the Internet)	Article 19 reinterpreted according to the Brazilian Constitution
GENERAL RULE	Digital platforms were only held liable if they failed to comply with a specific and advanced court order requiring content removal. There was no liability for omission prior to receiving the court order.	Expanded civil liability: Platforms can be held liable even without a court order (an out-of-court notification suffices) for damage resulting from their failure to remove certain content, such as crimes or civil wrongs. The former rule still applies in cases of disparagement (honor crimes), as well as to providers of: · Email services; · Private video or voice meeting applications; and · Instant messaging services, exclusively for interpersonal communications. Strict liability, however, does not apply to any of these cases.
DUTY OF CARE	There was no duty to monitor actively.	Providers must now monitor content proactively, responsibly, transparently, and cautiously, particularly to prevent the widespread dissemination of content that constitutes serious crimes, as outlined in the exhaustive list. The provider will be held liable in the event of a systemic failure, that is, when they fail to take action to prevent or remove such content.
PRESUMED LIABILITY	There was no presumed liability on the part of the platforms, which were held liable if they failed to comply with a specific court order.	There is presumed liability in cases involving illegal content related to sponsored advertisements and boosted posts, as well as the dissemination of such content through chatbots or robots. In such cases, providers may be held liable regardless of prior notification, unless they can prove that they acted diligently and within a reasonable time frame to remove the content.
RESPONSIBILITIES	Platforms could be passive and reactive, as the law provided only for compliance with content removal court orders.	Platforms must be diligent, proactive, and take preventive action. They must implement internal moderation systems, establish reporting channels, and manage systemic risks.
REGULATORY IMPACT	The previous interpretation of Article 19 of the Brazilian Civil Rights Framework for the Internet reflected a more static regime, aligned with the regulatory and technological logic in force in 2014, without considering subsequent developments in the digital and regulatory landscape.	In addition to expanding the subjective civil liability of ASPs, the STF introduced a mandatory self-regulation model.
BINDING PRECEDENT	Subjective civil liability, requiring fault and without the obligation to remove content without a court order, except in specific legal cases.	Partial and progressive unconstitutionality of Article 19, in addition to the joint and vicarious liability of platforms.

The ruling orders Internet application providers operating in Brazil to maintain a headquarters and a legal representative in the country. Such representative must be a legal entity with powers to:

Represent the provider before administrative and judicial authorities;
Provide requested information, including content moderation procedures;
Comply with court orders; and
Assume liability for sanctions, fines, and financial impacts resulting from non-compliance with regulations or court orders.

Additionally, the contact information for this representative must be readily available and easily accessible on the provider’s website.

To ensure legal certainty, the effects of this decision are prospective, meaning they will take effect from now on, without impacting cases that have already been concluded.

Despite the progress brought about by the decision, it is essential to acknowledge that specific matters still lack interpretative and regulatory clarity. Given the circumstances, it is foreseeable that motions for clarification may be submitted to resolve any omissions, inconsistencies, or ambiguities in the ruling.

Demarest’s Privacy, Technology and Cybersecurity, Dispute Resolution, and Technology, Media, and Telecommunications (TMT) teams are available to provide further clarification.