Constitutional Foundations
In Brazil, privacy protection starts at constitutional level. Article 5 of the Federal Constitution of 1988 guarantees the inviolability of intimacy, private life, honour and image, and it also provides for compensation for material or moral damage arising from a breach (Article 5, X). Constitutional Amendment 115/2022 strengthened that framework by elevating personal data protection to a standalone fundamental right through Article 5, LXXIX, giving data-driven privacy claims express constitutional support.
Civil Law Protections
The Civil Code (Law 10,406/2002) reinforces those constitutional protections through the personality rights regime. Article 21 states that private life is inviolable and authorises courts, at the request of the affected person, to adopt any measures necessary to prevent or stop interference with private life. Article 20 protects the use of a person’s name and image. Taken together, these provisions form the core civil law basis for injunctions and damages where privacy has been violated or is under threat.
Data Protection Law
The General Data Protection Law (LGPD, Law 13,709/2018) adds a comprehensive statutory framework for the processing of personal data by natural or legal persons, regardless of the means used or the country in which the processing entity is based, provided the processing:
LGPD also gives data subjects a practical set of rights, which are often central in reputation management disputes, including:
What a Claimant Must Establish
In practical terms, a claimant bringing a civil privacy claim must show:
In LGPD cases, Brazilian courts generally apply an objective liability standard, so the controller’s fault is not the key issue where the damage results from unlawful personal data processing.
Injunctions
Brazilian procedural law allows urgent injunctive relief under Article 300 of the Code of Civil Procedure (CPC) where there is evidence of the probable right asserted and a risk of serious harm or irreversibility if relief is withheld. Pre-publication injunctions are legally available, but courts approach them cautiously because Article 5, IX of the Constitution prohibits censorship. In practice, prior restraint is more likely where the content is clearly unlawful and the harm is concrete; speculative or diffuse harm is usually not enough.
Damages
Both material and moral (non-pecuniary) damages are available in privacy actions. Moral damages do not depend on proof of financial loss; the breach itself may generate compensable harm where honour, private life or image has been unlawfully affected. The quantification of moral damages remains highly discretionary. In privacy cases, Brazilian courts commonly award between BRL5,000 and BRL150,000, with higher awards where the violation involves sensitive personal data, intimate imagery or high-profile individuals facing clear professional or reputational consequences. LGPD breaches may also trigger administrative fines of up to 2% of the company’s annual revenue in Brazil, capped at BRL50 million per violation, alongside civil liability.
Limitation Periods
Civil privacy claims for damages are subject to a three-year limitation period under Article 206, paragraph 3, III of the Civil Code, counted from the date on which the claimant becomes aware of the violation. LGPD administrative enforcement follows the ANPD’s (Agência Nacional de Proteção de Dados, National Data Protection Authority’s) own regulatory timetable. By way of example, security incidents may have to be reported within three business days, while internal records relating to those incidents must be retained for five years.
Defences
The main defences to privacy claims in Brazil include the following.
Privacy violations in Brazil are addressed primarily through civil proceedings. There is no standalone criminal offence of “privacy violation” as such, although specific conduct may amount to a criminal offence – for example, unauthorised access to an information system or electronic device under Law 12,737/2012 (the “Carolina Dieckmann Law”). Data-related criminal matters are typically pursued by the Public Prosecutor’s Office, whereas civil claims may be brought directly by the affected party.
Civil proceedings are public as a rule, and secrecy is the exception. Courts may, however, order sealed proceedings or anonymisation where the dispute involves:
Article 189 of the CPC provides the procedural basis for confidentiality in cases involving personal or family dignity. To establish jurisdiction in Brazil, the claimant must show:
Brazilian civil procedure adopts a form of cost-shifting through succumbing fees. Under Article 85 of the CPC, the losing party must reimburse the court costs advanced by the winner and pay the prevailing party’s legal fees, usually fixed by the court between 10% and 20% of the amount in dispute or, where there is no monetary award, assessed on an equitable basis with reference to objective fee parameters used by Brazilian Bar Associations. In practice, full recovery is uncommon in complex cases because court-awarded fees do not necessarily match the actual cost of representation. Court expenses (custas processuais) are also recoverable from the losing party.
One of the most distinctive features of Brazilian privacy law is the strength of the personality rights regime embedded in the Civil Code. These rights are inalienable, non-transferable and non-waivable, which means contractual clauses purporting to waive them entirely will generally not hold up. Consent to the use of image or personal data must be specific and may be withdrawn.
The right to be forgotten (direito ao esquecimento) has had a particularly uneven path in Brazil. After the Superior Tribunal de Justiça (STJ, National High Court of Brazil) initially recognised a qualified version of the concept, the Supremo Tribunal Federal (STF, Federal Supreme Court) held in 2021 (RE 1,010,606) that there is no absolute right to suppress true and lawfully obtained historical information, balancing privacy against freedom of expression and collective memory. Even so, LGPD-based takedown, deletion and rectification requests remain available where data is no longer necessary, is inaccurate, or was processed without a proper legal basis. Strategically, the distinction between a civil law right-to-be-forgotten claim and an LGPD deletion request matters.
A Dual System: Criminal and Civil
Brazilian law offers two parallel and independent routes for addressing reputational harm: criminal prosecution under the Penal Code and civil liability under the Civil Code. They may be pursued together or separately, and each serves a different purpose. Criminal proceedings are mainly about accountability and deterrence; civil proceedings are focused on compensation, takedown relief and, where appropriate, rectification.
Criminal framework
The Brazilian Penal Code (Decree-Law 2,848/1940) defines three separate crimes against honour, which remain central to Brazilian reputation law.
Penalties may be increased by one third under Article 141 when the offence is committed:
The penalty is doubled where the offence is committed for payment or promise of reward.
Civil framework
Civil defamation claims are grounded in Articles 186 and 927 of the Civil Code, which establish the general duty not to cause unlawful harm and the obligation to compensate for it. Those provisions are read together with the personality rights regime in Articles 20 and 21 and the constitutional protection of honour, image and dignity. A civil claim does not depend on a prior or parallel criminal complaint. That said, if a criminal court has already established that the offending conduct occurred, that finding can materially narrow the dispute in the civil action for damages.
Criminal Remedies
Criminal proceedings may lead to detention sentences, which are often converted into alternative penalties such as community service or fines, together with mandatory fines. The defendant may avoid criminal punishment if they fully retract the offence before judgment (Article 143). Where the statement was published through the media, the retraction must be issued through the same medium and remain available for at least the same period as the original publication.
Civil Remedies
Civil courts may order:
The level of moral damages in Brazilian defamation cases is discretionary and usually turns on:
Awards have ranged from roughly BRL5,000 in minor online cases to BRL200,000 or more where there has been widespread media dissemination or substantial professional harm, particularly for high-profile claimants. Brazilian civil law does not recognise exemplary or punitive damages as a separate head of loss, but courts may take the defendant’s conduct into account when fixing the amount of moral damages.
Platform Liability and Content Removal
Following the STF’s June 2025 ruling, digital platforms remain shielded from civil liability for honour-related content unless they fail to comply with a specific court order requiring removal. In practice, claimants seeking urgent takedown relief should pursue interim injunctions in the civil courts against both the primary author of the content and the platform hosting it.
Other categories work differently. For most forms of unlawful content, the current framework follows a notice-and-takedown model under which platforms may incur liability upon receipt of an adequate extrajudicial notice. Where the notice concerns criminal offences, other unlawful acts, copyright violations or inauthentic accounts, the platform is expected to act promptly or risk civil liability, without first waiting for non-compliance with a court order.
Limitation Periods
For criminal complaints (“private criminal complaint”), crimes against honour are privately prosecuted in Brazil: only the victim or their authorised representative may initiate proceedings. The victim has six months from the date on which they become aware of the offender’s identity to file the queixa-crime (Article 38 of the Code of Criminal Procedure). Missing that deadline extinguishes criminal liability. Civil defamation claims are subject to the three-year limitation period in Article 206, paragraph 3, V of the Civil Code, and the victim may bring the action directly.
Defences
The main defences to defamation claims under Brazilian law are as follows.
Criminal proceedings for slander, defamation and insult are initiated by the victim or their legal representative through a private criminal complaint filed directly with the competent court. These are privately prosecuted offences; the Public Prosecutor’s Office does not ordinarily have standing to bring them, except in cases of racially aggravated insult under Article 140, paragraph 3, which STF case law now treats as a public prosecution offence.
Civil proceedings are independent of any criminal complaint and may run in parallel. São Paulo and Rio de Janeiro hear a large share of significant defamation cases because media and corporate activity is heavily concentrated in those jurisdictions. For internet publications, claims may generally be filed in the claimant’s domicile, the defendant’s domicile or the location of the server, and Brazilian courts tend to apply relatively flexible jurisdictional rules in online defamation matters.
Proceedings are generally public. Courts may, however, grant confidentiality or anonymisation where the subject matter involves:
Applications for secrecy should be made at the outset and remain subject to the court’s discretion under Article 189 of the CPC.
Cost recovery in Brazilian defamation proceedings follows the general succumbing fees rules of the CPC. The losing party must pay the prevailing party’s legal fees, fixed by the court at 10–20% of the judgment value where there is a monetary award, or on an equitable basis in other cases. Court costs and expert costs are also recoverable from the losing party. In criminal proceedings, court costs are usually less significant because the private prosecution is conducted by the victim’s own legal counsel and does not ordinarily involve court fees of the same kind.
Several features of the Brazilian system deserve particular attention for practitioners and clients with cross-border exposure. First, legal entities cannot claim moral damages for honour-related offences under criminal law because Brazil does not recognise corporate criminal liability for crimes against honour. They may, however, pursue civil claims for moral damages where reputational harm affects their good name and economic standing, which the STJ has consistently recognised provided there is concrete evidence of reputational damage.
Second, the interaction between defamation law and the platform liability regime after the STF’s June 2025 ruling requires strategic planning. Given that crimes against honour remain subject to a judicial notice-and-takedown model, claimants need a specific court order to force platform action on honour-related content. That extra procedural step has no real equivalent in many other jurisdictions. In practice, experienced counsel often run two tracks at once: a civil interim injunction for removal and a criminal queixa-crime for accountability and deterrence.
Third, retraction plays an important tactical role. A well-timed and adequately prominent retraction by the defendant can eliminate criminal liability and materially reduce civil damages, which is why early settlement discussions are often preferable to full litigation, particularly in disputes involving media defendants.
Brazil does not have a single consolidated harassment statute comparable to the UK Protection from Harassment Act. Protection against harassment-type conduct instead comes from a combination of overlapping criminal and civil provisions.
Criminal Protections
The main criminal provisions used in harassment-type cases are as follows.
Civil Protections
Under the Civil Code, persistent harassment that causes moral harm – whether in the workplace or in a broader personal context – entitles the victim to moral and material damages under Articles 186 and 927. Workplace moral harassment is also addressed by Article 483 of the Consolidated Labour Laws (CLT), which may amount to just cause for resignation and entitle the employee to full severance benefits.
Criminal remedies for harassment include detention sentences, which may be converted into community service or other alternative penalties, as well as restraining orders. Under the Maria da Penha Law, courts may impose protective measures including:
Civil remedies include moral and material damages together with injunctive relief. Awards for workplace moral harassment in Brazilian labour courts commonly range from BRL5,000 to BRL50,000, depending on severity and duration. For personal harassment causing psychological harm or public exposure, civil courts have awarded amounts in a similar range, with higher awards in aggravated cases.
Stalking under Article 147-A is a public prosecution offence, so proceedings are initiated by the Public Prosecutor’s Office and do not depend on a private complaint. Civil harassment claims are subject to the three-year limitation period in Article 206, paragraph 3, V of the Civil Code. The main defences are:
Stalking is a public prosecution offence, so the Public Prosecutor has standing to bring proceedings, although in practice the victim’s complaint often triggers the investigation. Domestic violence cases under the Maria da Penha Law are heard in specialised criminal courts or specialised units within existing courts (Juizados de Violência Doméstica e Familiar). Civil harassment claims proceed in the ordinary civil courts. Proceedings may be anonymised or evidence sealed where the victim’s safety requires it, particularly in domestic violence cases and under Article 189 of the CPC.
The same succumbing fees rules that apply to civil proceedings generally apply to civil harassment claims. In criminal proceedings, the victim may act as an assistant to the prosecution and, if there is a conviction, seek compensation through the civil reparation mechanism established in Article 91, I of the Penal Code. Legal costs in criminal proceedings are usually borne by each party, with only very limited scope for recovery.
Data protection in Brazil is anchored at constitutional level through Article 5, LXXIX, inserted by Constitutional Amendment 115/2022, which recognises the protection of personal data, including in digital media, as a fundamental right. The primary statute is the General Data Protection Law (LGPD, Law 13,709/2018), which entered into force in September 2020, with administrative penalties enforceable from August 2021. Inspired by the EU GDPR, the LGPD establishes a comprehensive framework for the processing of personal data by natural or legal persons, in both the public and private sectors, regardless of processing medium or where the controller is located.
LGPD applies to any processing operation involving personal data carried out in Brazil, directed at individuals located in Brazil, or involving data collected in Brazil. The National Data Protection Authority (ANPD) is the competent regulator for LGPD enforcement and has powers to investigate, impose sanctions, and issue regulations and guidance.
The ANPD may impose the following administrative sanctions for LGPD violations:
In parallel, individuals harmed by unlawful data processing may bring civil claims for moral and material damages under the Civil Code and Article 42 of the LGPD. The LGPD adopts a strict liability regime for controllers where damage arises from unlawful processing, so the claimant does not need to prove fault. Operators (processors) may be jointly liable where they cause damage by breaching LGPD duties or the controller’s lawful instructions. Civil damages in LGPD cases are assessed on the same discretionary basis as other moral damages claims, with courts considering:
Civil data protection claims are subject to the general three-year limitation period under Article 206, paragraph 3, V of the Civil Code. ANPD administrative proceedings follow the authority’s own investigative timetable rather than a fixed statutory limitation period comparable to civil claims.
Key exemptions under Article 4 of the LGPD cover processing carried out:
These exemptions are interpreted narrowly. In practice, the journalism and academic carve-out requires the processing to be exclusively directed to those purposes.
Data protection matters may arise in three forums:
Criminal liability for specific data-related crimes is established chiefly under Law 12,737/2012, which criminalises unauthorised access to information systems. The Carolina Dieckmann Law, as it is commonly known, has since been amended to increase penalties, particularly where cyber intrusions cause financial loss.
Civil proceedings may be brought in any jurisdiction connected to the dispute, typically the defendant’s domicile or the place of processing. ANPD proceedings are administrative and may begin by complaint or ex officio. Where the case involves sensitive personal data or the identity of the data subject requires protection, courts may order confidentiality under Article 189 of the CPC.
Cost recovery in civil data protection proceedings follows the standard succumbing fees rules: the losing party bears the prevailing party’s legal fees, usually fixed at 10–20% of the judgment amount, together with other procedural costs. ANPD administrative proceedings do not generate costs in the civil procedural sense, but non-compliance with ANPD orders and the conduct of enforcement proceedings can create significant unrecoverable legal spend.
Brazil has a large and highly fragmented media landscape, and journalistic standards vary materially across outlets. Five providers remain especially influential:
Standards vary considerably. Globo and the major broadsheets generally maintain internal editorial codes and have visible compliance routines around accuracy and corrections. At the same time, Brazil’s media landscape includes tabloid and celebrity-focused outlets where ethical standards are applied less consistently. The growth of digital-native news sites and individual influencers with very large audiences has also expanded the volume of content in circulation without an equivalent expansion in verification or editorial oversight.
Brazil’s media framework is shaped more by constitutional principles than by a single consolidated media statute. The Federal Constitution:
Brazil has no dedicated press regulator. Although the federal government has operated a press secretariat (SECOM) for communications policy, day-to-day editorial oversight rests with the media companies themselves.
Broadcasting is regulated by the Ministry of Communications and Anatel (the National Telecommunications Agency), which grants and renews broadcasting concessions. How effective that oversight is remains open to debate, particularly because concession renewals have at times been affected by political considerations. CONAR (Conselho Nacional de Autorregulamentação Publicitária) is the advertising industry’s self-regulatory body; it issues and enforces advertising standards but has no authority over editorial content. The ANPD regulates data processing by media and technology companies within the scope of the LGPD.
Online platforms are regulated primarily through the Marco Civil da Internet (Federal Law 12,965/2014), as reshaped by the STF’s June 2025 ruling. Platforms operating in Brazil must maintain a local legal representative and are subject to Brazilian jurisdiction for takedown orders and enforcement of Brazilian judgments.
There is no independent press complaints commission or press ombudsman with formal authority over Brazilian editorial content. Complaints about broadcast content may be addressed to the Ministry of Communications or Anatel, which may in principle initiate proceedings for breaches of licence conditions, although regulatory intervention in editorial content is rare and legally sensitive given the constitutional prohibition on censorship. The right of reply (direito de resposta), guaranteed by the Constitution and regulated by Law 13,188/2015, allows individuals or legal entities defamed or injured by broadcast or published content to demand a response of equivalent prominence and duration. Courts enforce that right, and non-compliance may lead to damages and, in some cases, fines. CONAR handles advertising-specific complaints through a self-regulatory panel process, with sanctions including suspension or withdrawal of the offending advertisement.
Before the STF’s June 2025 ruling, digital platforms benefited from broad civil immunity for user-generated content under Article 19 of the Marco Civil da Internet, which required a specific court order and subsequent non-compliance before liability could arise. The STF replaced that model with a hybrid approach: protection was reduced for most categories of unlawful content, but preserved for crimes against honour. The following apply under the current framework.
All platforms operating in Brazil must designate a legal representative with authority to receive and respond to legal proceedings.
Brazil does not have dedicated anti-SLAPP legislation at federal level. Courts instead address abusive litigation through the general principles of procedural bad faith and abuse of rights. Under Articles 79–81 of the CPC, a party acting in bad faith or for dilatory purposes may be sanctioned with payment of the opposing party’s legal fees and a fine of up to 10% of the value of the claim. Article 187 of the Civil Code treats abuse of rights as an unlawful act, which in theory can support a civil damages claim against a party using litigation primarily as a tool of intimidation rather than for legitimate vindication of rights.
In practice, obtaining sanctions for SLAPP-type behaviour requires clear evidence of bad faith, which is difficult to prove at an early stage. Civil society organisations, including Artigo 19 Brasil, have advocated for dedicated anti-SLAPP legislation, and bills have been introduced in Congress, but none has yet been enacted. Practitioners defending suspected SLAPPs should focus on early jurisdiction and standing challenges, proportionality arguments, and, where the facts allow, counterclaims for procedural abuse.
Brazil does not have legislation equivalent to the US SPEECH Act specifically designed to prevent enforcement of foreign defamation judgments. Recognition and enforcement of foreign judgments in Brazil are governed by Articles 961–965 of the CPC and require homologation by the Superior Court of Justice (STJ). The STJ will refuse homologation if the foreign judgment:
Public order is the main ground on which a foreign defamation judgment might be refused enforcement in Brazil. In principle, courts may apply that exception where the foreign judgment was rendered under a legal regime materially incompatible with Brazil’s constitutional protection of freedom of expression – for example, a judgment issued in a jurisdiction with criminal defamation penalties far more severe than those accepted under Brazil’s international human rights commitments. However, there is limited case law directly on this point in the defamation context, so each case still turns on its own facts.
Rua Castilho, 392
14th floor
Brooklin
São Paulo – SP
Brazil
+55 11 9 8272 0339
www.jorgeadvogados.com
Brazil’s Digital Reputation Landscape: Platform Liability, AI-Generated Harm and the New Regulatory Frontier
Introduction
Brazil is in the middle of a material shift in how it regulates online communication, protects individual reputation and assigns legal responsibility for digital harm. In the space of a single year, the Supreme Federal Court (Supremo Tribunal Federal, STF) handed down one of the most important platform liability decisions in the country’s history, Congress enacted landmark legislation aimed at protecting children and adolescents in digital environments, and the National Data Protection Authority (Autoridade Nacional de Proteção de Dados, ANPD) materially expanded its enforcement activity. At the same time, artificial intelligence tools capable of generating realistic but entirely false content – from deepfake videos to synthetic text – have opened a category of reputational harm that the existing legal framework was not built to handle.
This chapter of the guide looks at the legal developments shaping reputation management in Brazil in 2025 and, more importantly, what they mean in practice for individuals, companies and the professionals advising them. The analysis focuses on three connected themes:
The STF’s June 2025 ruling: rewriting platform liability
The old regime and its limitations
For more than a decade, Article 19 of the Marco Civil da Internet (Law 12,965/2014) gave digital platforms broad immunity from civil liability for third-party content unless they failed to comply with a specific court order requiring removal. The model, often described as a judicial notice-and-takedown regime, was adopted deliberately to encourage the growth of Brazil’s internet economy and to avoid over-moderation of lawful speech. In practice, however, it created a clear asymmetry: victims of online defamation, harassment and hate speech had to bear the time, cost and uncertainty of obtaining a court order before a platform was required to act.
That tension became especially visible in high-profile matters involving political disinformation, hate speech directed at minorities and co-ordinated attacks on private individuals. The debate intensified after the events of 8 January 2023, when social media was used extensively to organise and incite attacks on Brazil’s governmental institutions, and again when the STF ordered X (formerly Twitter) to suspend operations in Brazil in 2024 after the platform repeatedly ignored judicial orders to remove content and failed to meet local legal representation requirements.
A landmark decision: hybrid liability
On 26 June 2025, the STF decided Themes 533 and 987 and held Article 19 of the Marco Civil da Internet partially unconstitutional. The ruling established a hybrid liability model that materially reshapes the obligations of digital platforms operating in Brazil. In practical terms, any company running an online platform, hosting user-generated content or managing corporate reputation in Brazilian digital spaces now needs to revisit its risk map.
Under the new framework, notice-and-takedown – under which platforms may face liability upon receipt of extrajudicial notice – becomes the general rule for most categories of harmful content. Where a platform receives notice of content involving criminal offences, illegal acts or inauthentic accounts, it must act promptly to remove the material or face civil liability, without the need for a court order.
At the same time, in an important safeguard for free expression, the STF preserved the original Article 19 regime for one specific category: crimes against honour (calúnia, difamação and injúria under Articles 138–140 of the Penal Code). In these cases, platforms remain shielded from civil liability unless they fail to comply with a specific judicial order to remove the content. The Court justified that carve-out on the basis that a notice-and-takedown regime for honour claims would create an unacceptable risk of suppressing legitimate criticism and investigative journalism – a concern practitioners and press freedom advocates had raised throughout the proceedings.
What this means in practice
The ruling creates a two-speed enforcement environment for reputation-related matters. Claims based on privacy violations, data protection breaches, hate speech or the unlawful dissemination of intimate images can now trigger platform liability through extrajudicial notice alone. Claims based on honour – still the most common route for reputation protection under Brazilian law – continue to require a court order. Strategically, that distinction changes the playbook.
For claimants, the immediate question is whether a reputation-related dispute can be framed more effectively as a privacy violation or LGPD breach, offering a faster and potentially more cost-effective path to removal than a traditional criminal complaint for difamação. For platforms, the pressure point is different: they now need internal notification systems and moderation protocols capable of distinguishing between these legal categories in real time, which is operationally complex and hard to improvise.
AI-generated defamatory content: legal gaps and emerging responses
The scale of the problem
Artificial intelligence is rapidly becoming one of the most effective tools for generating and amplifying reputational harm. Deepfake video, synthetic voice generation and large language model outputs capable of producing highly convincing false statements are no longer theoretical risks. Brazilian courts and regulators are already dealing with cases involving AI-generated content:
CONAR, Brazil’s advertising self-regulatory authority, handled multiple cases in 2024 and 2025 involving deepfakes and AI-generated misleading content. Although those matters arose in the advertising context, they expose a broader problem: the existing legal categories were built around human-authored statements and do not fit neatly with machine-generated content. Under current Brazilian law, the question of who answers for defamatory AI output – the developer, the operator, the user or the hosting platform – remains unresolved.
The AI bill and its implications for reputation law
In December 2024, the Brazilian Senate approved Bill 2338/2023, which would create a national regulatory framework for artificial intelligence. The bill, later sent to the Chamber of Deputies for further review, classifies AI systems by risk level and imposes corresponding obligations on developers and deployers. High-risk systems – including those capable of generating synthetic media – would be subject to the strictest requirements, including transparency duties, human oversight mechanisms and civil liability provisions linked either to the Consumer Defence Code or the Civil Code, depending on context.
For reputation management practitioners, the bill’s main problem is straightforward: it still does not set out clear rules on who bears liability for AI-generated defamatory content outside the advertising context. That gap matters. Until the bill is enacted and implementing regulations are issued, clients facing reputational damage caused by AI-generated content will need to rely on a combination of existing civil claims (under Articles 186 and 927 of the Civil Code), criminal complaints where the content amounts to calúnia or injúria, and LGPD claims where the content involves unlawful processing of personal data.
Digital ECA: protecting minors from AI-driven harm
Law 15,211/2025 – known as the Digital ECA or Digital Children and Adolescents Statute – is Brazil’s clearest legislative response so far to the harms digital environments create for young people. Among other provisions, it addresses the use of AI to generate and disseminate content that harms the dignity of children and adolescents, including synthetic intimate imagery. The law therefore has direct relevance for reputation management practitioners advising clients whose children, or who themselves as minors, have been targeted by AI-generated harmful content.
LGPD and reputation management: a growing intersection
Data protection as a reputation shield
Brazil’s General Data Protection Law (LGPD, Law 13,709/2018) was elevated to the status of a fundamental right in 2022, when Constitutional Amendment 115 inserted the protection of personal data into Article 5 of the Federal Constitution. For reputation management, that matters because claims based on the unauthorised processing or disclosure of personal data now carry constitutional weight and can be pursued alongside, or in some cases instead of, traditional defamation claims.
The LGPD’s enforcement architecture has matured significantly. ANPD Resolution 15/2024 established a mandatory three-business-day notification window for data breaches involving sensitive personal data or large-scale processing, with penalties of up to 2% of Brazilian annual revenue, capped at BRL50 million per violation. From a reputation management perspective, this gives claimants another lever: where a harmful publication or disclosure can be characterised as unauthorised data processing – for example, the publication of sensitive health or financial information – the LGPD complaint route may deliver faster regulatory relief than civil litigation.
The right to be forgotten: where things stand
The so-called right to be forgotten (direito ao esquecimento) has had a complicated trajectory in Brazilian jurisprudence. The Superior Court of Justice (STJ) initially recognised a qualified version of the right in the landmark Aida Curi case. The STF, however, stepped back from that position in 2021 (RE 1,010,606), holding that there is no absolute right to suppress true, lawfully obtained historical information from public records, because such a right would be incompatible with freedom of expression and the collective interest in historical memory.
That does not mean LGPD-based erasure requests or the right to rectification under Article 18 of the LGPD are off the table. In practice, the distinction is important: a claim framed broadly as a right to be forgotten under general civil law is unlikely to succeed before Brazilian courts, whereas a request grounded in data subject rights – particularly where the data being processed is outdated, inaccurate or no longer necessary for its original purpose – stands a better chance before the ANPD or the civil courts. The practical lesson is that digital reputation management should be built holistically, combining civil, criminal and data protection tools instead of relying on a single theory.
SLAPPs and the strategic use of defamation law
Strategic Lawsuits Against Public Participation – or SLAPPs – remain one of the most persistent structural threats to press freedom and legitimate public-interest speech in Brazil. Brazil still has no specific anti-SLAPP legislation, so courts must rely on general principles of procedural abuse (abuse of rights under Article 187 of the Civil Code and procedural bad faith under Articles 79–81 of the Code of Civil Procedure) to deal with claims brought primarily to silence criticism rather than to vindicate genuine reputational harm.
The Brazilian Bar Association (OAB) and civil society organisations have pushed for dedicated anti-SLAPP legislation, but no federal bill has yet been enacted. In the meantime, practitioners advising journalists, whistle-blowers and civil society actors should keep in mind that Brazil’s criminal honour regime is frequently used as a SLAPP tool: even a weak criminal complaint for difamação or injúria can impose serious practical burdens on defendants and their families.
Courts have shown some openness to abuse-of-process arguments where the SLAPP character of a claim is particularly clear, but the law still lags behind the practical reality. Clients in the crosshairs of SLAPP actions should focus on early procedural defences, public-interest and truth exceptions and, where the complaint crosses into bad-faith litigation, counterclaims for material and moral damages based on procedural abuse.
Cross-border reputation management: Brazil’s international dimension
Brazil has no legislation equivalent to the US SPEECH Act specifically designed to prevent enforcement of foreign defamation judgments. Instead, the general rules of the Law of Introduction to the Rules of Brazilian Law (LINDB) and Articles 961–965 of the Code of Civil Procedure govern recognition of foreign judgments, subject to STJ homologation. A foreign defamation judgment will not be recognised in Brazil if it violates Brazilian public order – a standard that could, at least in principle, be invoked where the judgment was obtained in a jurisdiction with lower protections for freedom of expression.
From a practical standpoint, Brazil’s weight as a digital market – with over 150 million internet users and one of the world’s highest rates of social media use – means reputation damage originating abroad is quickly felt domestically, and the reverse is equally true. International companies entering the Brazilian market, as well as Brazilian businesses expanding internationally, increasingly need cross-border reputation management strategies that account for different legal standards on truth defences, public figure doctrine, platform obligations and limitation periods.
Looking ahead
The Brazilian reputation management landscape in 2026 will be shaped by three dynamics that practitioners should watch closely. First, implementation of the STF’s June 2025 ruling will generate substantial litigation as courts work through the new hybrid liability standard across different fact patterns. Cases involving AI-generated content, co-ordinated inauthentic behaviour and cross-platform harm will test the limits of the framework.
Second, once the Chamber of Deputies concludes its review, the AI bill will begin to define civil liability rules for AI-generated harm that will directly affect reputation law practice. Practitioners who build expertise now at the intersection of AI regulation and reputation management will be in a stronger position when that framework takes effect.
Third, the continuing expansion of ANPD enforcement and the deepening jurisprudence around LGPD rights will create new routes for addressing reputation damage through data protection channels – particularly for clients whose cases do not fit neatly within traditional honour-crime categories. Integrating data protection strategy into reputation management advice is no longer optional; it is part of competent practice.
Brazil’s legal system has always had to balance a strong constitutional commitment to freedom of expression with equally strong protection for personality rights. The digital age has not altered that tension; it has intensified it and moved much of it online. For practitioners and their clients, navigating this environment now requires more than technical legal knowledge. It requires strategic judgement, commercial awareness and the ability to connect litigation, regulation and risk in a single plan. That is where reputation management practice in Brazil is now headed.
Rua Castilho, 392
14th floor
Brooklin
São Paulo – SP
Brazil
+55 11 9 8272 0339
www.jorgeadvogados.com