- Digital economy companies regulation continues to be a hot topic in Brazil in 2025, with recent judicial and legislative developments.
- There have been substantial developments in data privacy and data centers, including new rules and incentives.
- Major pending legislative items include the new AI and cybersecurity legal frameworks as well as a series of other digital policy-related issues.
2025 continues to be a key year for digital policymaking in Brazil, with substantial developments in the second and third quarters. With one year left before the next general election, in October 2026, policymakers are using the increasingly short policy window to approve new legislation and regulation in a number of areas.
President Luiz Inácio Lula da Silva’s administration continues to pursue regulation of digital economy companies, with a particular focus on social media. In 2023 and 2024, the Lula administration failed to get the controversial, so-called “Fake News Bill” approved in Congress.
This year, the administration changed its strategy and nudged Brazil’s Supreme Court to act. In June, the Court struck down the country’s internet governance safe harbor clause, and adopted a new set of content moderation and civil liability rules. The Supreme Court decision goes beyond the Fake News Bill scope and impacts all digital economy companies that provide internet applications, including e-commerce marketplaces and entertainment software.
The Supreme Court also urged Congress to act, opening the way for new legislation to regulate digital economy companies. The Lula administration seized this opportunity and publicly announced it would introduce two new bills: one to regulate digital economy companies; and another to amend Brazil’s Antitrust Act of 2011 and establish new rules for digital markets, based on the results of a public consultation initiated in February 2024. The administration has only introduced the latter, and it is not clear when and if it is going to introduce the former.
Finally, the Trump administration criticized the Court’s safe harbor decision and identified it as one of the reasons for imposing U.S. tariffs against Brazil. The 40 percent Brazil-specific tariff took effect on August 6.
In early August, a Brazilian digital influencer published a series of online videos documenting what he called the “adultization” of Brazilian children and adolescents on the internet. These videos went viral, generated social outrage, and prompted Brazil’s Congress to act.
In a matter of weeks, Congress approved and President Lula signed into law the so-called “Adultization Bill,” formally called the Digital Statute for Children and Adolescents (“ECA Digital”). ECA Digital sets rules for safeguarding children and adolescents in the digital environment. The new law establishes: (i) principles and rules for the use of IT products and services; (ii) certain prohibitions on access to content deemed inappropriate or unlawful; (iii) mandatory age verification mechanisms; (iv) mandatory parental supervision measures; (v) specific rules for monitoring products, electronic games, digital marketing, and social media; (vi) additional rules on safeguarding, reporting, and transparency; and (vii) governance and administrative sanctions provisions. The law also has an anti-censorship clause, as well as a prohibition on mass surveillance.
President Lula used the law approval to issue a provisional measure and a presidential decree converting the existing digital privacy regulator into a full-fledged, fully autonomous new National Data Privacy Agency (“ANPD”). He also expanded its mandate beyond that established in the General Personal Data Protection Act of 2018 (“LGPD”) by granting ANPD authority to enforce ECA Digital.
Considering ECA Digital includes new social media rules, ANPD is set to become the main regulator of digital economy companies in Brazil. The agency now has a dual mandate to protect data privacy and protect minors in the digital environment. Moreover, the current draft of the new artificial intelligence (AI) legal framework bill also designates ANPD as the AI regulator. If passed into law, the framework would significantly expand the mandate of ANPD.
A final relevant update is an European Commission announcement on the launch of a process to adopt an adequacy decision determining that Brazil ensures an adequate level of personal data protection comparable to that in the European Union. ANPD also announced it is progressing on adopting an equivalent adequacy decision.
In July and September, President Lula issued two additional provisional measures establishing new incentives to attract foreign investment and develop data centers in Brazil. The first of these measures establishes incentives for data centers in free trade zones. The other creates a special tax regime that waives three indirect taxes and the import tariff on certain products used by data centers.
These provisional measures create law “ad referendum” of Congress, which has up to 120 days to accept, amend, or reject them.
Congress continues to debate the new AI legal framework bill. The Senate approved the bill in December 2024 and is currently in the House. The Speaker set up a special committee to debate and report the bill. It is expected that the rapporteur will issue his report in October or November, and the Speaker will put the bill to a House floor vote before the end of the year. It is likely that the House amends the bill, thus triggering the need for a new Senate vote before Congress can send it to President Lula. Executive branch-linked agencies continue to implement AI-related initiatives despite the lack of a clear legal framework. A recent example are proposed new AI-related patent application rules.
In parallel to the AI legislative debate and related regulatory initiatives, the Lula administration seems to be in the final steps of preparing a new cybersecurity legal framework bill to introduce to Congress. The goal of this new bill is to empower the federal government and private sector to develop and implement cybersecurity measures beyond those already established by the country’s 2020 National Cybersecurity Strategy, updated by President Lula in August. The bill will potentially include the creation of a new regulator, although it is not yet clear if the administration wants to establish a fully autonomous cybersecurity regulatory agency.
Congress continues to debate other digital policy-related issues, including the taxation of digital services; new third party civil liability rules for e-commerce marketplaces, including cross-border e-commerce; anti-digital censorship rules; labor and pension rules for digital platform workers; cloud computing regulation through new financial market infrastructures rules; the extension of Internet of Things-related tax relief; and a cybersecurity-related constitutional amendment.
Digital policy will continue to be an area of active policymaking in Brazil in 2025 and 2026. The Trump administration has expressed concerns over some of these policies, which it views as detrimental to American technology companies. Brazil’s digital policy decisions may continue to impact the U.S.-Brazil bilateral relationship.
If you have any questions concerning the material discussed in this client alert, please contact the members of our Latin America Initiative.
Back
