The Brazilian Government charges a flat 60% duty for all express shipments imported through the Simplified Customs Clearance process. Moreover, Brazilian Customs have established express services maximum per-shipment value limits of USD 3,000 for imports, according to Art. 1 of Ministerial Ordinance 156/1999. This is reported to affect particularly online sales.

The Interpretative Act No. 7 of August 2014, issued by the Brazilian Federal Revenue Secretariat (Receita Federal do Brasil – RFB), deals with the taxation of cross-border payments for data centres outside Brazil. It applies to all amounts paid, credited, delivered or remitted by individuals or legal entities resident or domiciled in Brazil to companies headquartered abroad that are identified as offshore data centres.
According to the Act, when the Brazilian source of payment hires offshore data centres for the use of infrastructure for storage and remote high-performance data processing systems, the transactions are deemed to be typical provision of services and cannot be characterised as rental of movable assets for tax purposes. The consequence of this interpretation is that the use of offshore data centres triggers the following federal taxes in Brazil:
- Withholding income tax (Imposto sobre a Renda Retido na Fonte – IRFF) at the rate of 15% or 25% whenever the recipient is located in a tax haven jurisdiction;
- Cide-royalties contribution (Contribuição de Intervenção no Domínio Econômico destinada a financiar o Programa de Estímulo à Interação Universidade-Empresa para o Apoio à Inovação – Cide-royalties), at the rate of 10%;
- PIS-importation contribution (Contribuição para o PIS/Pasep-Importação) at the rate of 1.65%;
- Cofins-importation contribution (Contribuição para o Cofins-Importação) at the rate of 7.6%; and
- IOF (Imposto sobre Operações de Câmbio), which is the financial tax levied on the foreign exchange transaction, at the rate of 0.38%.

Brazil does not implement any de minimis threshold, which is the minimum value of goods below which customs do not charge duties.

Foreign companies can register a domain ".br" after the conclusion of a special registration, which requires a local legal representative and a declaration that the company will establish activities in Brazil within 12 months from the registration, according to Art. 6 of the Resolution of the Internet Steering Committee 2008/008/P.

Online pharmacies must have "com.br" or "far.br" domains. Moreover, according to Art. 53.2 of Resolution of the Director's Board of the National Agency for Health Surveillance 44/2009, Internet pharmacies are permitted in Brazil only if the Internet pharmacy is the website component of a licensed Brazilian brick-and-mortar pharmacy,

In recent years, Brazilian courts have issued several high‑profile decisions requiring foreign technology companies to appoint a local representative. The most notable cases are the following: (1) in 2022, when a proposed ban on Telegram did not ultimately take effect after the platform swiftly complied with judicial orders to designate a local legal representative; (2) in 2024, when the Supreme Court ordered the blocking of X due to its failure to appoint a domestic representative, a measure later lifted once the company adhered to the Court’s ruling; and (3) in 2025, when the Supreme Court similarly ordered the blocking of Rumble on the basis that the platform had not designated a local representative.

The Consumer Protection Act and the Law on Electronic Commerce Contracts provide a comprehensive framework for consumer protection that also applies to online transactions. Decree No. 7.962 includes specific obligations that apply to e-commerce purchases of goods and services that do not apply to traditional retailing. The Decree sets out obligations for e-commerce sites, such as providing a contract before purchase, supporting consumer service, answering consumer demands within five days, and ensuring the right to regret of the consumer. The right to regret was originally established by Art. 49 of Law 8.078. It allows for the cancellation of acquisitions made outside commercial establishments within seven days from the acquisition or receipt of product/service. It is, thus, applicable to other forms of distance sales as well.

The Civil Rights Framework for the Internet law establishes a safe harbour regime for intermediaries for copyright infringements. Art. 18 states that “the Internet connection provider shall not be subject to civil liability for content generated by third party”. Art. 19, which addresses Internet application providers (excluding connection providers), states that “in order to ensure freedom of expression and to prevent censorship, an Internet application provider shall only be subject to civil liability for damages caused by virtue of content generated by third parties if, after specific court order, it does not take action, according to the framework and technical limits of its services and within the time-frame ordered, to make the infringing content unavailable.”
It is reported that, in 2025, the Supreme Court found aspects of Art. 19 to be unconstitutional. Consequently, responsibility now lies with the National Congress to draft comprehensive and technically robust legislation.

The Civil Rights Framework for the Internet law establishes a safe harbour regime for intermediaries beyond copyright infringements. Art. 18 states that “the Internet connection provider shall not be subject to civil liability for content generated by third party”. Art. 19, which addresses Internet application providers (excluding connection providers), states that “in order to ensure freedom of expression and to prevent censorship, an Internet application provider shall only be subject to civil liability for damages caused by virtue of content generated by third parties if, after specific court order, it does not take action, according to the framework and technical limits of its services and within the time-frame ordered, to make the infringing content unavailable.”
It is reported that, in 2025, the Supreme Court found aspects of Art. 19 to be unconstitutional. Consequently, responsibility now lies with the National Congress to draft comprehensive and technically robust legislation.

According to Art. 1 of Law 10.703, it is the responsibility of prepaid telecommunications service providers operating in the national territory to have an updated register of users. The registration, in addition to the full name and address, must contain, in the case of natural persons, the identity card number or registration number in the registry of the Ministry of Finance.

In February 2025, the Supreme Court ordered the blocking of the social media platform Rumble, citing the platform’s failure to appoint a local representative and its refusal to restrict certain accounts.

Brazil generally prohibits the importation of used consumer goods, including information and communications technology (ICT) products. However, Ordinance No. 23/2011 of the Secretariat of Foreign Trade (SECEX) provides a list of exceptions, covering more than 25 categories of used goods that may be authorised for importation under specific conditions.

According to Arts. 41 and No. 42 of Ordinance 23 of July 2011 of the Secretary of Foreign Trade, the importation of used machinery, equipment, devices, instruments, moulds, and containers are prohibited unless these used goods are not produced in the country or are irreplaceable by other similar products manufactured in the country.

Brazil has joined two agreements with binding commitments to open data transfers across borders: the Chile-Brazil Bilateral Trade Agreement (Art. 10.12), and the Mercosur E-commerce Agreement (Art. 7.2).

The Personal Data Protection Law provides a framework for comprehensive data protection in Brazil. It applies to the treatment of personal data, including through digital means, by natural or juridical persons of a public or private nature. The law applies regardless of the country of origin of the person and the country where data is located provided that: data treatment is made in the national territory; or data treatment activities aims at the supply of goods or services or data treatment of individuals located in the national territory; or data has been collected in the national territory.