In recent years, Brazilian courts have issued several high‑profile decisions requiring foreign technology companies to appoint a local representative. The most notable cases are the following: (1) in 2022, when a proposed ban on Telegram did not ultimately take effect after the platform swiftly complied with judicial orders to designate a local legal representative; (2) in 2024, when the Supreme Court ordered the blocking of X due to its failure to appoint a domestic representative, a measure later lifted once the company adhered to the Court’s ruling; and (3) in 2025, when the Supreme Court similarly ordered the blocking of Rumble on the basis that the platform had not designated a local representative.

The Consumer Protection Act and the Law on Electronic Commerce Contracts provide a comprehensive framework for consumer protection that also applies to online transactions. Decree No. 7.962 includes specific obligations that apply to e-commerce purchases of goods and services that do not apply to traditional retailing. The Decree sets out obligations for e-commerce sites, such as providing a contract before purchase, supporting consumer service, answering consumer demands within five days, and ensuring the right to regret of the consumer. The right to regret was originally established by Art. 49 of Law 8.078. It allows for the cancellation of acquisitions made outside commercial establishments within seven days from the acquisition or receipt of product/service. It is, thus, applicable to other forms of distance sales as well.

Brazil has not signed the United Nations (UN) Convention on the Use of Electronic Communications in International Contracts.

Brazil has not adopted national legislation based on or influenced by the United Nations Commission on International Trade Law (UNCITRAL) Model Law on Electronic Commerce.

Brazil has not adopted national legislation based on or influenced by the United Nations Commission on International Trade Law (UNCITRAL) Model Law on Electronic Signatures.

According to Arts. 41 and No. 42 of Ordinance 23 of July 2011 of the Secretary of Foreign Trade, the importation of used machinery, equipment, devices, instruments, moulds, and containers are prohibited unless these used goods are not produced in the country or are irreplaceable by other similar products manufactured in the country.

Brazil has joined two agreements with binding commitments to open data transfers across borders: the Chile-Brazil Bilateral Trade Agreement (Art. 10.12), and the Mercosur E-commerce Agreement (Art. 7.2).

The Personal Data Protection Law provides a framework for comprehensive data protection in Brazil. It applies to the treatment of personal data, including through digital means, by natural or juridical persons of a public or private nature. The law applies regardless of the country of origin of the person and the country where data is located provided that: data treatment is made in the national territory; or data treatment activities aims at the supply of goods or services or data treatment of individuals located in the national territory; or data has been collected in the national territory.

Art. 13 of the Civil Rights Framework for the Internet states that connection logs of Internet service providers (ISPs) should be retained for a minimum period of one year. The police, administrative authorities, or the Public Prosecutor's Office may request in a precautionary manner that the connection logs be kept for a longer period. Authorities have a period of 60 days, counting from the time of the request, to obtain a court order to access the information.

According to Art. 15 of the Civil Rights Framework for the Internet, internet application providers that are constituted as a legal entity and that carry out this activity in an organised manner professionally and with economic purposes must retain the respective records of access to the Internet applications for a period of six months. Internet applications are defined in Art. 5 (VII) as a set of functionalities that can be accessed through a terminal connected to the Internet.

According to Art. 17 of Criminal Organisation Law, concessionaires of fixed or mobile telephony must keep, for a period of five years, at the disposal of the Police Chief or the Public Prosecutor, records of identification of the terminal numbers of origin and destination of international, long distance and local phone calls.

Art. 41 of the General Personal Data Protection Law stipulates that the controller must designate a data protection officer responsible for overseeing the processing of personal data. Resolution CD/ANPD No. 18/2024 subsequently approved the regulation governing the role of the data protection officer in relation to such processing.

The Civil Rights Framework for the Internet law establishes a safe harbour regime for intermediaries for copyright infringements. Art. 18 states that “the Internet connection provider shall not be subject to civil liability for content generated by third party”. Art. 19, which addresses Internet application providers (excluding connection providers), states that “in order to ensure freedom of expression and to prevent censorship, an Internet application provider shall only be subject to civil liability for damages caused by virtue of content generated by third parties if, after specific court order, it does not take action, according to the framework and technical limits of its services and within the time-frame ordered, to make the infringing content unavailable.”
It is reported that, in 2025, the Supreme Court found aspects of Art. 19 to be unconstitutional. Consequently, responsibility now lies with the National Congress to draft comprehensive and technically robust legislation.

The Civil Rights Framework for the Internet law establishes a safe harbour regime for intermediaries beyond copyright infringements. Art. 18 states that “the Internet connection provider shall not be subject to civil liability for content generated by third party”. Art. 19, which addresses Internet application providers (excluding connection providers), states that “in order to ensure freedom of expression and to prevent censorship, an Internet application provider shall only be subject to civil liability for damages caused by virtue of content generated by third parties if, after specific court order, it does not take action, according to the framework and technical limits of its services and within the time-frame ordered, to make the infringing content unavailable.”
It is reported that, in 2025, the Supreme Court found aspects of Art. 19 to be unconstitutional. Consequently, responsibility now lies with the National Congress to draft comprehensive and technically robust legislation.

According to Art. 1 of Law 10.703, it is the responsibility of prepaid telecommunications service providers operating in the national territory to have an updated register of users. The registration, in addition to the full name and address, must contain, in the case of natural persons, the identity card number or registration number in the registry of the Ministry of Finance.