Brazil expands ANPD’s enforcement role

Decrees 12.975/2026 and 12.976/2026 took effect on July 20, 2026, after the 60-day transition period for companies, broadening the responsibilities of digital platforms in Brazil under tighter ANPD oversight.

What changed under the decrees

The federal government’s official summary says both rules update the Marco Civil da Internet, set new guidelines for how platforms must operate, and formally assign the ANPD responsibility for regulating, auditing and investigating possible violations tied to the digital environment. Institutional and media coverage also says the scope covers governance, risk management, content moderation, digital advertising and responses to authorities.

Decree 12.975/2026, according to local and regional reporting, changes the Marco Civil rules with a focus on sponsored ads, content boosting, digital fraud and criminal content spread through automated networks. It also requires digital advertising platforms to keep records that make it possible to identify the people responsible for campaigns and ads.

It also introduces a preventive duty. Platforms must act on their own to remove serious criminal content, including racism, terrorism, child sexual exploitation, violence against women and encouragement of suicide, without waiting for a user complaint or a court order. Compliance with these rules will be subject to ANPD oversight.

Protection for women and intimate content

Decree 12.976/2026 sets specific guidelines for protecting women online. An official note from Agencia Gov says platforms must digitally mark intimate content that has already been taken down to prevent automatic reposting, and that they may be held liable for systemic failure when they cannot prove adequate preventive measures against large-scale circulation of unlawful material targeting women.

Specialized legal analysis also highlights that the rule expressly bans the creation and sharing of fake intimate content produced by artificial intelligence, the so-called deepfakes, without consent. Under this reading, the decree strengthens the use of LGPD sanctions so the ANPD can investigate platforms, order immediate removal and apply fines of up to 2% of revenue in Brazil, capped at R$ 50 million per violation, as well as daily penalties, blocking or deletion of personal data, and partial or full suspension of activities.

ANPD’s regulatory agenda

The expansion of powers arrives on top of a broader agenda. According to an analysis by Visie, in October 2025 Congress turned Provisional Measure 1.317/25 into law and the ANPD stopped being an autarchy, becoming a regulatory agency with functional, technical, decision-making, administrative and financial autonomy, plus its own career track for regulation and inspection specialists.

According to the same consultancy, in November 2025 the ANPD launched a public oversight dashboard showing supervision and LGPD enforcement cases, and in December it published the Priority Topics Map for 2026 and 2027. That map is organized around four axes, data subject rights, with a focus on biometric, health and financial data, protection of children and adolescents in the digital environment, the public sector and artificial intelligence.

At the same time, the LGPD keeps its sanctioning framework, with fines of up to 2% of a company’s revenue in the previous fiscal year, capped at R$ 50 million per violation, and calculation criteria defined by Resolution CD/ANPD No. 4 of May 24, 2023, which takes into account the severity of the violation, the economic benefit obtained, the offender’s cooperation and whether there is a privacy governance program.

That framework was already applied in 2025 in the Tools for Humanity case, the company behind Worldcoin, when the ANPD issued a preliminary order banning the collection of iris scans in exchange for cryptocurrency in Brazil, with a daily fine of R$ 50,000 for noncompliance.

The regulatory debate also connects with the structure already established by Law 15.211 and Decree 12.622/2025, which designated the ANPD as the autonomous administrative authority for protecting the rights of children and adolescents in the digital environment. With the decrees now in force, the agency is responsible for monitoring compliance with a substantial share of the new platform obligations, not only under the LGPD, but also on content moderation and digital advertising matters linked to the Marco Civil da Internet.