Lula Signs Decrees Making Big Tech Liable Without a Court Order
Brazil · Tech Regulation
Key Facts
—Two decrees signed. President Lula signed two decrees on May 20 setting new rules for digital platforms, to be published in the official gazette on May 21.
—Liability without a court order. The first decree updates Brazil’s internet law so platforms can be held responsible for harmful content even without a specific judicial removal order.
—It enforces a court ruling. The move operationalizes a Supreme Court decision from last year that found the old liability shield partly unconstitutional.
—Seven serious crimes. Platforms must proactively remove content tied to seven categories, including terrorism, incitement to suicide, attacks on democracy, racism and crimes against women and children.
—A second decree on women. The other decree targets online violence against women, requiring deletion of reported nude images within two hours and banning AI tools that create fake nudes.
—A new regulator. The data-protection authority, the ANPD, is set to oversee whether platforms comply, becoming a broader regulator of digital networks.
For years, Brazil’s rule was simple: a platform was only liable for a user’s post if it ignored a court order to remove it. That era is ending. With two decrees, Lula is enforcing a Supreme Court ruling that flips the logic, making Meta, Google and others answerable for what they fail to take down, a shift that puts Brazil among the world’s more assertive regulators and on a collision course with Silicon Valley.
What do the new Brazil big tech rules do?
The Rio Times, the Latin American financial news outlet, reports that the new Brazil big tech rules come in two decrees Lula signed on May 20, to be published the next day. The first updates the country’s internet law, the Marco Civil, in line with the Supreme Court’s reading of the constitution. The government says the goal is to better protect women, consumers and families amid rising fraud, scams and digital violence.
The key change is liability. Under the new approach, platforms can be held responsible and ordered to pay damages if, after an out-of-court notification, they fail to remove content later deemed illegal. Previously, they were liable only if they ignored a specific judicial order, a far narrower exposure.
What did the Supreme Court rule?
It rewrote the liability standard. Last year, the Supreme Court found partly unconstitutional the article of the internet law that shielded platforms from responsibility for third-party content absent a court order. The decision created a duty of proactive moderation and exposed companies to punishment for systemic failures in that duty.
The court named seven categories requiring direct removal: terrorism, incitement to self-harm or suicide, coup attempts and attacks on democracy, racism, homophobia, and crimes against women and children. The decrees give that ruling administrative force, since the court itself had urged Congress to legislate and the government argues the decision lacked operational detail.
What does the second decree require?
It hardens protections against online violence aimed at women. Platforms must create dedicated channels to report nude images, whether real or AI-generated, and delete flagged content within two hours of notification, while directing victims to the government’s official 180 hotline. Algorithms must be programmed to reduce the reach of attacks on women, such as female journalists.
The decree also bars companies from offering AI tools that create fake nudes. First lady Janja Lula da Silva framed it as a response to a digital environment she said had become fertile ground for misogyny and so-called red-pill content, arguing it turns sexism into entertainment and monetizes hatred of women.
Who enforces the rules, and who objects?
A repurposed agency takes the lead. The data-protection authority, the ANPD, tied to the Justice Ministry, is set to oversee compliance, expanding from data privacy into a broader role policing digital networks, much as it now monitors Brazil’s child-protection digital law. Because these are decrees, they do not need congressional approval to take effect.
The politics are fraught. The government frames the move as overdue protection against scams and abuse, while critics, including the opposition, are expected to attack it as government overreach on speech, echoing the fight over the stalled fake-news bill once branded a censorship law. The relationship with US platforms and Washington adds a diplomatic edge, with Meta, Google, X, TikTok and Discord all asked to respond.
What should investors and analysts watch next?
- The compliance deadline: the government still has to set how long platforms get to adapt, a key cost signal.
- The ANPD’s powers: how far the agency’s mandate expands will define the regulatory burden on platforms.
- Platform response: reactions from Meta, Google, X, TikTok and Discord will signal whether legal challenges are coming.
- The US-Brazil angle: Washington’s stance on rules targeting American platforms could feed into trade tensions.
- Legal durability: whether decrees can carry rules this sweeping, or whether Congress must act, is the open constitutional question.
Frequently Asked Questions
What are the new Brazil big tech rules?
They are two decrees Lula signed on May 20, 2026. One updates Brazil’s internet law so platforms can be liable for harmful content without a court order, enforcing a Supreme Court ruling; the other targets online violence against women, with two-hour deletion rules and a ban on AI fake-nude tools.
How does platform liability change?
Previously, platforms were only liable if they ignored a specific court order to remove content. Now, after an out-of-court notification, they can be held responsible and ordered to pay damages if they fail to take down content later deemed illegal, and must proactively remove seven categories of serious crime.
Which crimes require proactive removal?
The Supreme Court named seven: terrorism, incitement to self-harm or suicide, coup attempts and attacks on democracy, racism, homophobia, and crimes against women and children. Platforms face punishment for systemic failures to remove this content, even without a judicial order.
Who will enforce the rules?
The ANPD, Brazil’s data-protection authority under the Justice Ministry, is set to oversee compliance, expanding into a broader digital-network regulator. It already monitors Brazil’s child-protection digital law. Because the measures are decrees, they do not require congressional approval to take effect.
Why is the move controversial?
The government calls it overdue protection against scams and abuse, but critics and the opposition are expected to frame it as overreach on free speech, recalling the stalled fake-news bill dubbed a censorship law. Targeting US platforms also adds a diplomatic dimension to the already tense Brazil-US relationship.
Connected Coverage
The child-protection law the ANPD already enforces is detailed in our reporting on Brazil’s ECA Digital and its limits on platforms. The wider accountability wave is covered in our piece on the US verdict finding Meta and Google liable for social-media harm, and the diplomatic backdrop in our coverage of Lula’s push against “digital colonialism” with Spain.
Reported by Sofia Gabriela Martinez for The Rio Times — Latin American financial news. Filed May 20, 2026 — 20:00 BRT.
Read More from The Rio Times