New challenges in the liability of internet application providers

Credits

Project team
Francisco Brito Cruz (coordinator), Fernando Gallo, Helena Maluf and Vinicius Harada

Support
Mercado Livre

How to cite this document?
BRITO CRUZ, Francisco (coord.); MALUF, Helena; and HARADA, Vinicius. New challenges in the liability of internet application providers. Input, São Paulo: 2026.

Executive summary

This document summarizes the discussions of two workshops on the liability of internet application providers following the Federal Supreme Court (STF) decision on Article 19 of the Marco Civil da Internet (Brazil’s Internet Civil Rights Framework), held in São Paulo on April 27, 2026 and August 10, 2026 under the Chatham House Rule, each with around 35 participants from the private sector, the public sector, academia and civil society.

The cross-cutting diagnosis is that the new regime has significantly expanded the duties assigned to providers, but has left open a relevant share of the parameters needed to guide compliance with them. Concepts such as duty of care, diligent conduct, systemic failure, systemic risks and reasonable doubt now occupy a central position in platform liability, without it yet being sufficiently defined what each of them requires in practice. The result is an environment in which providers, administrative authorities and the Judiciary may adopt different metrics and expectations regarding the same obligation, increasing legal uncertainty and creating incentives for the preventive removal of legitimate content and listings, which may in turn lead to an increase in litigation.

A first axis of discussions therefore examined the duties of care and diligence. The discussions point to the need to treat them predominantly as duties to adopt adequate processes, mechanisms and safeguards, rather than as a guarantee of the complete elimination of unlawful content. In this context, the document explores alternatives for bringing greater objectivity to oversight, such as anchoring the duty of care in the principle of objective good faith (boa-fé objetiva), using prevalence indicators and qualitative parameters on moderation architecture, as well as taking into account technical limitations, the scale of services and different business models. It also discusses problems specific to e-commerce, especially the need to distinguish consumer harms, subject to the specific regime of the Consumer Defense Code (CDC), from harms related to content and the circulation of speech, governed by the Marco Civil.

The second axis addresses the new role of extrajudicial notices. The main issue is preventing the regime from turning, in practice, into an automatic removal obligation. “Reasonable doubt” emerges as an essential mechanism for preserving a notice and action model, in which a notice triggers a duty to analyze and respond, but not necessarily to take content down. The workshops identified, however, significant risks of notices being weaponized by competitors, associations or other actors, as well as difficulties caused by mass requests that are poorly individualized or based solely on keywords, hashtags and hashes. In this scenario, the workshops emphasized the importance of precisely identifying content, preserving its contextual analysis and appropriately allocating duties among those who formulate the request, those who order the measure and those who must carry it out. The goal is to prevent the platform from being turned simultaneously into investigator, technical authority and adjudicator of disputes whose resolution depends on information or jurisdiction held by the State itself, effectively transferring to it the exercise of police powers assigned to state authorities.

A third axis discusses the institutional governance of the new regime. Assigning new competences to the National Data Protection Agency (ANPD) may help form a regulatory hub capable of producing more stable technical parameters, but its work takes place in an environment already marked by a multiplicity of administrative authorities. The challenge, therefore, is not merely to allocate powers, but to build coordination and some form of deference to technically grounded regulatory parameters. This discussion also shows that compliance with the new duties does not depend on platforms alone: when automated verification of public licenses, registrations or authorizations is required, for example, the State itself must make available structured, up-to-date and technically consumable databases.

Based on these assessments, the document proposes an agenda aimed at giving the new regime greater density and predictability. Taken together, these proposals share the same premise: the effectiveness of the new liability regime depends less on the abstract expansion of obligations and more on building institutional, technical and procedural parameters capable of making them enforceable. The challenge opened by the STF’s decision is thus to turn broad legal categories into a predictable system of incentives and responsibilities, capable of tackling unlawful content and activities without producing, as a side effect, over-removal, uncertainty for legitimate economic activities or fragmentation of Brazilian digital governance.