Executive Summary
- Artificial intelligence (AI), social media, and instant messaging regulation will be a hot topic in Brazil in 2025, with substantial activity in Congress and the Supreme Court.
- Cloud, cybersecurity, data centers, and data privacy are topics that could also see legislative or regulatory action throughout the year at different policymaking stages.
- Technology companies will also be affected by horizontal and sector-specific tax policy-related measures, and Brazil’s digital policy might be impacted by U.S.-Brazil relations under the new Trump administration.
Analysis
2025 is shaping up to be a key year for digital policymaking in Brazil. It is the last year for President Luiz Inácio Lula da Silva’s administration to pursue substantial policy change before the 2026 general elections. It is also the first year for the new congressional leadership, in particular the new Speaker of the House and President of the Senate, to put their stamp on key legislation before their own reelection campaigns next year.
Existing Legal Framework: LGT, MCI and LGPD
Brazil’s current approach to digital policy is based on three key federal statutes. The first one is the General Telecommunications Act of 1997 (“LGT”). LGT established the rules for the country’s transition from a state-owned monopoly to a competitive, private sector-led telecommunications market. It is the bedrock of Brazil’s digital economy infrastructure regulation as, among other aspects, it sets rules for radio spectrum and orbit uses.
The second key statute is the Civil Rights Framework for the Internet Act of 2014 (“MCI”). MCI sets the principles, rights and obligations for internet use, including the net neutrality principle and a safe harbor clause protecting internet service providers from liability for user-generated content absent a court order to remove the content. The statute also established the first layer of data privacy provisions as well as rules for the federal, state, and local governments internet-related policies and actions.
The third key federal statute is the General Personal Data Protection Act of 2018 (“LGPD”). LGPD sets rules for the treatment of personal data by individuals, companies, state-owned and state-supported enterprises, and governments. It slightly amends MCI and adds a more robust layer of data privacy protection.
Each statute has its own regulator, respectively the National Telecommunications Agency (“ANATEL”), Brazil’s Internet Management Committee (“CGI.br”), and the National Data Protection Authority (“ANPD”).
Hot Topics in 2025: AI, Social Media, and Instant Messaging
Two agenda items will likely dominate the policy debate in Brazil in 2025. The first one is the creation of a new legal framework for AI. After years of intense debate, the Senate approved its AI bill in December 2024. The bill sets rights and obligations for developers, deployers, and distributors of AI systems, and takes a human rights, risk management, and transparency approach to regulating AI-related activity. It also contains contentious provisions establishing AI-related copyright obligations. In 2025, the House will likely debate and try to approve the bill, which is also a priority for the Lula administration.
The second agenda item is the regulation of social media and instant messaging in Brazil. Twice—in 2023 and 2024—, the Lula administration, with the support of the former Speaker of the House, tried unsuccessfully to vote a controversial, so-called “Fake News Bill.” The administration might try again this year, either by reviving the bill, inserting its key provisions into the AI legal framework legislation, or using another legislative vehicle. It is unclear at this point if the new Speaker, elected on February 1, 2025, supports it.
In addition, the Lula administration plans to introduce a bill to amend the Antitrust Act of 2011 to create new policy and oversight instruments targeting technology companies, including owners of social media and instant messaging applications. The bill is largely a result of a Ministry of Finance push initiated with a public consultation in February 2024.
Finally, the Supreme Court is due to issue a legal opinion on MCI’s long-standing safe harbor provision. It is likely that it will find the provision to be unconstitutional, but it is not yet clear if the Court will establish new obligations for content moderation and removal by the technology companies, or if it will leave this decision to Congress.
Cloud, Cybersecurity, Data Centers, Data Privacy, Streaming, and E-Commerce
While AI, social media, and instant messaging are likely to dominate digital policy debates in Brazil, there might be movement in other topics that are currently in different stages of the policymaking process.
In November 2024, the House approved a bill introduced by the Lula administration to codify and expand financial regulators’ oversight of financial market infrastructures (“FMIs”). The bill provides a legal framework for regulators continue to indirectly regulate cloud computing through obligations imposed on financial institutions and their cloud services providers. The Senate is due to debate and may approve the bill this year.
The administration will also continue its internal debate on the scope and timing for the introduction of a new cybersecurity framework bill in Congress. Several Brazilian federal government agencies have been involved in discussions about the draft bill, and the Office of Institutional Safety—a cabinet-level position within the Executive Office of the President typically controlled by the military—has been pushing both for the framework’s introduction and the creation of a new federal cybersecurity agency. In addition, in December 2024, the Senate approved a draft constitutional amendment to centralize cybersecurity policy at the federal government level. The House may debate and vote on the amendment this year.
Within the Lula administration and among private sector players, there have also been discussions about legislative and regulatory initiatives to foster the development of data centers in Brazil. The sector has seen increased investment in the past several years and private sector players claim they need a new data center legal framework to lock-in existing investments and boost new ventures. The Lula administration has voiced its willingness to discuss and implement a data center promotion policy, but it is not yet clear if it would support congressional action. A recent technical study conducted by ANATEL concluded that new legislation and regulation are not necessary. There are at least two bills in Congress on this issue.
Data privacy will continue to be a relevant agenda item and, despite a growing number of bills in Congress to amend LGPD, most of the action throughout the year will be conducted by ANPD. The agency has an ambitious regulatory agenda to implement, which includes new resolutions on issues that were the object of public consultations, such as the connection between data privacy and AI.
Finally, taxation will continue to be a relevant area of legislative activity for technology companies. While they will be impacted by the implementation of the 2023 consumption tax system reform and upcoming income tax reform, there are bills in Congress specifically targeting technology companies. This is the case, for instance, of legislation to tax streaming services. Another example is legislation focused on creating a legal framework for cross-border e-commerce platforms.
Digital policy will continue to be an active area of policymaking in Brazil in 2025. Some of these Brazilian policies may be seen by President Donald Trump’s administration as particularly detrimental to American technology companies and may become part of the evolving U.S.-Brazil bilateral relationship.
If you have any questions concerning the material discussed in this client alert, please contact the members of our Latin America Public Policy group.
Back
