From Safe Harbor to State Oversight: How Brazil Is Redrawing the Limits of Online Free Speech

Abstract — This article analyzes the shift in Brazil’s content-moderation regime away from the judicial-order model of Article 19 of Brazil’s Internet Act (Law No. 12,965/14) toward continuous regulatory supervision, following the Federal Supreme Court’s June 2025 ruling and Decrees No. 12,975/2026 and No. 12,976/2026, which impose new obligations and liabilities on digital platforms. It argues that, despite legitimate aims, their institutional design encourages defensive, excessive content removal and raises constitutional concerns about the limits of the Executive’s rule-making power. Keywords: Brazil’s Internet Act; intermediary liability; content moderation; freedom of expression; platform regulation; ANPD. Law No. 12,965/14 (known as the “Marco Civil da Internet”, or “Brazil’s Internet Act”) was the product of a broad, intense, and democratic public consultation involving the legislature, civil society, academia, and technology companies, and over the past decade it has established itself as one of the most sophisticated legal frameworks in the world on digital governance. Its greatest merit may have been precisely the institutional balance it struck between freedom of expression, net neutrality, accountability, and legal certainty. At the center of that architecture has always stood Article 19 of Brazil’s Internet Act, which provided that internet application providers could be held civilly liable for third-party content only if they failed to comply with a specific court order requiring its removal. This principle was meant to prevent censorship from being privatized and to stop platforms from removing content preemptively for fear of being held liable later. This model reached a significant turning point with the decision of the Federal Supreme Court (Supremo Tribunal Federal - STF), in June 2025, which declared Article 19 of Brazil’s Internet Act partially unconstitutional and began to allow, in certain circumstances, platforms to be held liable even without a prior court order, particularly in cases of inaction following notices regarding unlawful content. It is true that the STF’s ruling may be understood as an institutional response to the repeated failures of large digital platforms to curb the circulation of manifestly criminal, fraudulent, or seriously harmful content. In a context of expanding disinformation, online scams, digital violence, and abusive content amplified on a large scale, it has become increasingly difficult to sustain an absolute operational neutrality on the part of technology companies. Nevertheless, by relaxing the requirement of a prior court order as the central condition for the civil liability of providers, the decision ultimately set in motion a gradual erosion of one of the structural pillars of Brazil’s Internet Act itself: the notion that restrictions on the circulation of content should, as a rule, stem from independent judicial decisions, and not from private decisions made under regulatory pressure or the risk of future liability. This is because the model originally conceived by Article 19 did not seek to protect unlawful content, but rather to prevent digital platforms from being turned into preemptive arbiters of the legality of public discourse. The logic was simple: in cases of doubt, it would fall to the Judiciary — and not to private companies — to define the boundaries between freedom of expression, abuse, unlawfulness, and liability. By weakening this mechanism, even if out of legitimate concerns, the STF significantly altered the economic and legal incentives that structured digital content moderation in Brazil. The practical consequence was the strengthening of a logic of defensive removal, in which platforms come to take down content in an increasingly broad and preemptive manner in order to avoid regulatory risks, even in situations that are legally controversial or open to interpretation. It is against this backdrop that the recent presidential decrees published by the federal government represent a new and significant step in the regulatory transformation of the Brazilian digital environment. Issued jointly and published on May 21, 2026, Decree No. 12,975/2026 (which amends Decree No. 8,771/2016 and reforms the general regime of duties and liability of internet application providers) and Decree No. 12,976/2026 (aimed specifically at the protection of women and at countering gender-based violence in the digital environment) together form a coordinated regulatory architecture rather than isolated measures. Although presented as a mere act of regulation of the STF’s decision, the decrees appear to go beyond simply giving technical effect to the Court’s ruling. In practice, they design a more continuous model of regulatory supervision over the content-moderation activities of digital platforms. Among the main points of these decrees, the following stand out: <ul> <li>the assignment to the ANPD (National Data Protection Authority) of powers to regulate, oversee, and investigate infractions relating to platforms’ compliance with their duties, particularly as regards the management of systemic risks and the mass circulation of unlawful content;</li> <li>the expansion of the circumstances in which platforms may be held liable, especially in cases of systemic failure in preventing and mitigating the circulation of criminal content;</li> <li>the imposition of ongoing duties of prevention, monitoring, transparency, and risk mitigation in the operation of digital services;</li> <li>the creation of specific obligations for boosted (sponsored) content, paid advertisements, and the retention of records that may assist in identifying fraud and unlawful acts; and</li> <li>the requirement of prompt removal of certain especially sensitive content, such as non- consensual intimate images and sexual deepfakes.</li> </ul> Undoubtedly, several of the objectives pursued by the decrees are legitimate and socially relevant, particularly tackling digital violence against women, fraud, child sexual exploitation, and other manifestly unlawful content. The central problem, however, may lie not only in the purpose of the rules, but in the institutional design adopted for their implementation. From the moment platforms begin to operate under constant regulatory risk, faced with broad legal concepts that are often open to interpretation, a structural incentive is created for preemptive and excessive content removal. In other words: when the legal cost of keeping certain content online becomes significantly higher than the cost of removing it, the market’s natural tendency is to adopt a logic of “defensive removal.” This effect may be particularly acute in matters involving political speech, institutional criticism, public debate, or content whose unlawfulness turns on complex contextual interpretation. In addition, there is an inevitable constitutional and institutional discussion about the limits of the Executive’s rule-making power. Defining the scope of freedom of expression, the civil liability of intermediaries, and content moderation has always been a sensitive matter, traditionally reserved for legislative debate and parliamentary deliberation. For this reason, a significant portion of the technology sector, industry associations, and members of Congress have argued that the decrees would go beyond mere administrative regulation, encroaching on matters still under discussion at the STF and in the National Congress. At its core, the current debate is not only about how to tackle unlawful content on the internet. What is really being discussed is what model of control over the digital environment Brazil will adopt in the coming years. On one side, a model emerges in which digital platforms come to be constantly supervised and pressured to monitor and remove content preemptively, under the oversight of State bodies. On the other, there is the view that decisions on content removal and limits to freedom of expression should continue to be made primarily by the Judiciary, on a case-by-case basis, with greater legal safeguards and a lower risk of excessive censorship. The discussion, therefore, involves a question central to any democracy: how to balance the fight against digital abuses and crimes without compromising freedom of expression and legal certainty in the online environment. In the end, that is what is at stake: whether Brazil’s Internet Act will remain a landmark for the protection of fundamental rights in the digital environment, or whether it will end up paving the way for a broader and more permanent model of control over what circulates online. Nevertheless, by relaxing the requirement of a prior court order as the central condition for the civil liability of providers, the decision ultimately set in motion a gradual erosion of one of the structural pillars of Brazil’s Internet Act itself: the notion that restrictions on the circulation of content should, as a rule, stem from independent judicial decisions, and not from private decisions made under regulatory pressure or the risk of future liability. This is because the model originally conceived by Article 19 did not seek to protect unlawful content, but rather to prevent digital platforms from being turned into preemptive arbiters of the legality of public discourse. The logic was simple: in cases of doubt, it would fall to the Judiciary — and not to private companies — to define the boundaries between freedom of expression, abuse, unlawfulness, and liability. By weakening this mechanism, even if out of legitimate concerns, the STF significantly altered the economic and legal incentives that structured digital content moderation in Brazil. The practical consequence was the strengthening of a logic of defensive removal, in which platforms come to take down content in an increasingly broad and preemptive manner in order to avoid regulatory risks, even in situations that are legally controversial or open to interpretation. It is against this backdrop that the recent presidential decrees published by the federal government represent a new and significant step in the regulatory transformation of the Brazilian digital environment. Issued jointly and published on May 21, 2026, Decree No. 12,975/2026 (which amends Decree No. 8,771/2016 and reforms the general regime of duties and liability of internet application providers) and Decree No. 12,976/2026 (aimed specifically at the protection of women and at countering gender-based violence in the digital environment) together form a coordinated regulatory architecture rather than isolated measures. Although presented as a mere act of regulation of the STF’s decision, the decrees appear to go beyond simply giving technical effect to the Court’s ruling. In practice, they design a more continuous model of regulatory supervision over the content-moderation activities of digital platforms. Among the main points of these decrees, the following stand out: • the assignment to the ANPD (National Data Protection Authority) of powers to regulate, oversee, and investigate infractions relating to platforms’ compliance with their duties, particularly as regards the management of systemic risks and the mass circulation of unlawful content; • the expansion of the circumstances in which platforms may be held liable, especially in cases of systemic failure in preventing and mitigating the circulation of criminal content; • the imposition of ongoing duties of prevention, monitoring, transparency, and risk mitigation in the operation of digital services; • the creation of specific obligations for boosted (sponsored) content, paid advertisements, and the retention of records that may assist in identifying fraud and unlawful acts; and • the requirement of prompt removal of certain especially sensitive content, such as non- consensual intimate images and sexual deepfakes. Undoubtedly, several of the objectives pursued by the decrees are legitimate and socially relevant, particularly tackling digital violence against women, fraud, child sexual exploitation, and other manifestly unlawful content. The central problem, however, may lie not only in the purpose of the rules, but in the institutional design adopted for their implementation. From the moment platforms begin to operate under constant regulatory risk, faced with broad legal concepts that are often open to interpretation, a structural incentive is created for preemptive and excessive content removal. In other words: when the legal cost of keeping certain content online becomes significantly higher than the cost of removing it, the market’s natural tendency is to adopt a logic of “defensive removal.” This effect may be particularly acute in matters involving political speech, institutional criticism, public debate, or content whose unlawfulness turns on complex contextual interpretation. In addition, there is an inevitable constitutional and institutional discussion about the limits of the Executive’s rule-making power. Defining the scope of freedom of expression, the civil liability of intermediaries, and content moderation has always been a sensitive matter, traditionally reserved for legislative debate and parliamentary deliberation. For this reason, a significant portion of the technology sector, industry associations, and members of Congress have argued that the decrees would go beyond mere administrative regulation, encroaching on matters still under discussion at the STF and in the National Congress. At its core, the current debate is not only about how to tackle unlawful content on the internet. What is really being discussed is what model of control over the digital environment Brazil will adopt in the coming years. On one side, a model emerges in which digital platforms come to be constantly supervised and pressured to monitor and remove content preemptively, under the oversight of State bodies. On the other, there is the view that decisions on content removal and limits to freedom of expression should continue to be made primarily by the Judiciary, on a case-by-case basis, with greater legal safeguards and a lower risk of excessive censorship. The discussion, therefore, involves a question central to any democracy: how to balance the fight against digital abuses and crimes without compromising freedom of expression and legal certainty in the online environment. In the end, that is what is at stake: whether Brazil’s Internet Act will remain a landmark for the protection of fundamental rights in the digital environment, or whether it will end up paving the way for a broader and more permanent model of control over what circulates online. Fernando F. Stacchini

Limited Liability, Unlimited Differences: A Comparative Look at the U.S. LLC and the Maltese Ltd

This below article was written by Alexia Bonnici from our Maltese member firm David Zahra & Associates Advocates. Alexia participated in the ABL Secondment Programme in Washington DC, spending her placement at member firm Ruddy Gregory PLLC. Her experience working directly with U.S. corporate procedures shaped this comparative analysis between the American LLC and the Maltese Ltd. <hr /> <h2 align="center" style="text-align: center;">Limited Liability, Unlimited Differences: A Comparative Look at the U.S. LLC and the Maltese Ltd</h2> <h2 align="center" style="text-align: center;"> </h2> During my secondment in Washington, I assisted in the incorporation of a Limited Liability Company (“LLC”) for a client based in Virginia and was intrigued by how different the process was compared to Malta. The filing was completed online within minutes, with minimal information required and no pre-approval or supporting documentation. The U.S. system emphasizes accessibility and speed, while Malta’s approach - though more formal and structured - has traditionally placed greater focus on regulatory diligence and legal certainty from the outset. In recent years, Malta has increasingly integrated digital tools into its company formation process, streamlining submissions and improving efficiency. That being said, Malta’s company law framework, largely modeled on the UK Companies Act, adopts a common law–inspired approach that balances accessibility with sound governance. Like the UK, Malta’s process is far less rigid than that of many continental European jurisdictions, where company formation often requires notarial deeds and lengthy formalities. It is particularly interesting to explore how two entities sharing the same name - a “Limited Liability Company” - can operate under such distinct formation processes and requirements, reflecting the different legal and regulatory philosophies that underpin each system.   The U.S. Model: Administrative Simplicity and Contractual Freedom In the United States, company formation is handled at the state level, and the process is designed to be quick and accessible. Under the Virginia Limited Liability Company Act, an LLC is created by submitting a simple online filing that includes only the company’s name, registered agent, and principal address, along with a nominal fee. The company’s internal rules are set out in an LLC Agreement, which is not required to be filed with the state. There is no requirement to appoint a company secretary or directors, no disclosure of beneficial owners, and no minimum capital requirement. Once the online filing is submitted and accepted, the LLC is incorporated almost instantly, with the certificate of formation immediately available for download. This reflects the U.S. philosophy that business owners should have maximum freedom to structure their affairs by agreement. The state’s role is limited to recording the company’s existence, not regulating how it operates. This efficiency and flexibility have made the U.S. an attractive environment for entrepreneurs, particularly those seeking a fast and straightforward path to starting a business. In the United States, the LLC derives its legal personality from statute but functions primarily as a product of private ordering. Incorporation is an administrative act rather than a grant of status.   The Maltese Model: A Regulated and Governance-Focused Framework In Malta, incorporating a company is a regulated process carried out through the Malta Business Registry (MBR) in line with the Companies Act (Cap. 386 of the Laws of Malta). To register a private limited liability company (“Ltd”), the incorporation process requires the submission of various documents and declarations to the Malta Business Registry, such as: <ol start="1"> <li>a Memorandum and Articles of Association, setting out the company’s share capital, structure, objects and governance;</li> <li>a covering letter with directors’ contact details;</li> <li>a registered office consent letter;</li> <li>Form K(1)s appointing the directors and company secretary; and</li> <li>Form BO1, which identifies the company’s beneficial owners.</li> <li>Proof of the deposit of the initial share capital in a bank account</li> </ol> A private limited liability company must appoint at least one director and one company secretary, both of whom have defined legal responsibilities. The beneficial owners must also be disclosed at incorporation and kept up to date. A Maltese Ltd must have an authorized share capital of at least €1,164.69, with at least 20 per cent paid up on formation. The company must be formed by at least two members, unless incorporated as a single-member company, in which case it must comply with the additional obligations that apply to such structures. The MBR undertakes a thorough due-diligence review on all persons involved in the incorporation from its end. Once satisfied that all requirements have been met, the Registry issues the certificate of incorporation, generally within a couple of working days, provided the submission is complete and free of issues. Thereafter, the company must maintain records - such as a register of members and share certificates - all of which must remain current. Malta’s approach prioritizes reliability, investor protection, and the integrity of the financial system. The checks performed by the Malta Business Registry are not hurdles but safeguards - designed to ensure that every company formed in Malta meets high standards of transparency and due diligence. This thorough yet efficient process gives confidence to investors, financial institutions, and international partners that Maltese companies are credible and well-regulated. Malta’s framework provides a structured and dependable environment where legitimate enterprise can thrive with clarity and certainty. Its balance between accessibility and oversight has helped establish Malta as a trusted and internationally respected jurisdiction - one that combines efficiency with the assurance of strong governance and reputational integrity.   Different Structures, Different Purposes Both the U.S. LLC and the Maltese Ltd provide limited liability but serve distinct functions within their systems. In the United States, the LLC was developed to bridge the gap between partnerships and corporations - combining the flexibility of the former with the liability protection of the latter. As U.S. law provides a wide range of entity types - including corporations, S-corporations, limited partnerships, and professional corporations - the LLC occupies the least formal and most flexible position in that spectrum. It is intended for private ownership and small enterprises, with minimal statutory formality and freedom of contract at its core. In Malta, the Ltd serves as the default corporate structure for most commercial and holding activities, from small family-owned businesses to larger groups. It coexists with the Plc, which faces higher capital and disclosure thresholds due to its public role. <div> As Malta’s corporate framework is modeled on the UK’s system, it offers a pragmatic balance between structure and flexibility - a middle ground between the highly liberal U.S. approach and the more formal, notarial processes typical of continental Europe. Malta’s model ensures that incorporation remains simple, yet its built-in compliance checks protect legitimate operators and preserve Malta’s reputation as a safe and transparent jurisdiction for doing business. Since Malta’s corporate framework offers fewer entity types, both the Ltd and the Plc carry broader regulatory and economic responsibilities than their U.S. counterparts. Even at the private-company level, Maltese law embeds greater formality into the formation process. In both systems, limited liability derives from the principle of separate legal personality, but the route to achieving that status differs. In Malta, a company comes into existence only once the MBR has reviewed and approved the incorporation documents and issued the certificate of registration. In the U.S., the LLC is formed almost instantly upon filing a short online notice with minimal details. This highlights how U.S. law treats incorporation as an administrative right, whereas Maltese law treats it as a regulated privilege. Tax treatment also shows how the two systems differ. In the United States, an LLC is usually taxed on a “pass-through” basis, meaning profits are taxed in the hands of its members unless it chooses to be taxed as a corporation. In Malta, a limited liability company is taxed separately from its owners. This shows that the U.S. LLC shares features of both partnerships and companies, while the Maltese company operates as a distinct legal and tax entity. Although both systems enshrine limited liability, protection is not absolute. In Malta, the corporate veil may be lifted in cases of fraud or abuse; in the U.S., courts may pierce the LLC veil when members misuse the entity. The shared rationale - that limited liability is a privilege contingent on good faith - unites the two despite their procedural divergence. Ultimately, the LLC is a contract-based instrument of flexibility, while the Maltese Ltd - and, at a higher level, the plc - are statutory vehicles of accountability. Each reflects its jurisdiction’s broader legal culture: one grounded in private ordering, the other in regulatory assurance.   </div> The comparison between the U.S. LLC and the Maltese Ltd shows how the same legal concept can take very different forms across jurisdictions. Each reflects the legal and commercial priorities of its own system while ultimately pursuing the same goal - enabling enterprise through limited liability. It is fascinating to see how two entities sharing the same name can operate so differently in practice, from how they are formed to how they are regulated and governed. Experiencing these contrasts firsthand also highlights how Malta’s model - rooted in UK legal tradition yet modern, transparent, and internationally aligned - offers an effective balance between ease of doing business and the credibility that comes with strong regulatory standards.

Insights

Article See All

From Safe Harbor to State Oversight: How Brazil Is Redrawing the Limits of Online Free Speech

Venezuela’s Oil & Gas: Legal Reforms and New Investment Opportunities

Limited Liability, Unlimited Differences: A Comparative Look at the U.S. LLC and the Maltese Ltd

Events See All

51st Conference - Mexico City

50th Conference - Vienna, Austria

49th Conference - Istanbul, Turkey

News See All

ABL Elects Board for the 2026-2029 Term

ABL Celebrates Its 50th Conference in Vienna

Jacobsen + Confurius Strengthens Hamburg Team with Three New Partners

Alliance of Business Lawyers