Marco Civil da Internet, Liability of Internet Application Providers for Third-Party Content (arts. 19 to 21, partly struck down in 2025)

Article 19 provides that, to ensure freedom of expression and prevent censorship, an internet application provider may be held civilly liable for damages arising from third-party content only if, after a specific court order, it does not take the steps, within the technical limits of its service and within the period set, to make the content identified as infringing unavailable, subject to legal provisions to the contrary.

The court order must identify the infringing content clearly and specifically so as to allow its unequivocal location, on pain of nullity. Applying article 19 to infringements of copyright or related rights depends on a specific legal provision. Article 20 requires a provider that holds contact information for the user responsible for content made unavailable to tell that user the reasons for the removal, unless a legal provision or a reasoned court decision provides otherwise.

Article 21 makes a provider that makes third-party content available subsidiarily liable for the violation of privacy caused by the unauthorised disclosure of images, videos or other material containing nudity or private sexual acts if, after notice from a participant or the participant's legal representative, it fails to diligently make that content unavailable within the technical limits of its service.

Article 18 provides that an internet connection provider is not civilly liable for damages arising from content generated by third parties. On 26 June 2025 the Supremo Tribunal Federal, deciding Theme 987 in Extraordinary Appeal 1,037,396, held article 19 partially unconstitutional because its general rule gives insufficient protection to constitutional legal goods of high relevance, namely the protection of fundamental rights and democracy.

Until new legislation is enacted, the Court's thesis directs that article 19 be interpreted so that internet application providers are subject to civil liability, without prejudice to the specific provisions of electoral legislation and the acts issued by the Superior Electoral Court.

Under the thesis as clarified, a provider is jointly and severally liable under article 21 for damages from third-party content in cases of crime or unlawful acts, without prejudice to the duty to remove the content, unless reasonable doubt about unlawfulness is shown after the provider's qualified diligence analysis. The same rule applies to accounts reported as inauthentic. For crimes and civil wrongs against honour, article 19 applies, without prejudice to removal on extrajudicial notice.

Where an offensive fact already recognised by a court decision is replicated successively, all social network providers must remove publications with identical content on judicial or extrajudicial notice, without new court decisions.

Article 19 still applies to email service providers for interpersonal communications, to providers of applications whose primary purpose is closed video or voice meetings, to instant messaging providers for interpersonal communications, and to other internet application providers that have no interference in the communicative and informational flow.

The thesis presumes fault, rebuttably, where unlawful content is a paid advertisement or boost or is spread by artificial mechanisms of inorganic dissemination, allows liability without notice in those cases, and excludes liability if the provider proves it acted diligently and within a reasonable time to make the content unavailable.

A provider is responsible when it does not promote the immediate unavailability of content constituting serious crimes on a closed list, which begins with anti-democratic conduct and terrorism offences.

The Court's own account of its ruling of 17 June 2026 states that providers may be held liable when, through systemic failure, they do not adopt adequate measures to prevent or immediately remove content constituting those crimes, such as attempted coup d'état, terrorism, instigation to mutilation or suicide, racism, homophobia and crimes against women and children.

The thesis as first fixed on 26 June 2025 also required internet application providers to issue self-regulation covering a notification system, due process and annual transparency reports on extrajudicial notifications, advertisements and boosts. The thesis as first fixed also required providers operating in Brazil to establish and maintain a headquarters and a representative in the country.

The thesis as first fixed also provided that providers that operate as marketplaces answer civilly under the Consumer Defence Code. On 17 June 2026 the Court concluded its judgment of the motions for clarification and decreed the end of the period for appeals. Platforms have 60 days from the end of that judgment to implement the structural changes of the thesis relating to the duty of care.

The Court clarified that its understanding applies from the publication of the minutes of the merits judgment on 5 August 2025, except for continuing or permanent acts.