The Brazilian Government charges a flat 60% duty for all express shipments imported through the Simplified Customs Clearance process. Moreover, Brazilian Customs have established express services maximum per-shipment value limits of USD 3,000 for imports, according to Art. 1 of Ministerial Ordinance 156/1999. This is reported to affect particularly online sales.

In June 2025, Decree No. 12,499/2025 amended Decree No. 6,306/2007 and imposed a 3.5% Tax on Financial Operations (IOF, Imposto sobre Operações Financeiras) on purchases of foreign goods and services made through cross-border payment arrangements, including credit, debit, and prepaid cards issued in Brazil. The same rate applied to cash withdrawals abroad through these payment arrangements.

The Interpretative Act No. 7 of August 2014, issued by the Brazilian Federal Revenue Secretariat (Receita Federal do Brasil – RFB), deals with the taxation of cross-border payments for data centres outside Brazil. It applies to all amounts paid, credited, delivered or remitted by individuals or legal entities resident or domiciled in Brazil to companies headquartered abroad that are identified as offshore data centres.
According to the Act, when the Brazilian source of payment hires offshore data centres for the use of infrastructure for storage and remote high-performance data processing systems, the transactions are deemed to be typical provision of services and cannot be characterised as rental of movable assets for tax purposes. The consequence of this interpretation is that the use of offshore data centres triggers the following federal taxes in Brazil:
- Withholding income tax (Imposto sobre a Renda Retido na Fonte – IRFF) at the rate of 15% or 25% whenever the recipient is located in a tax haven jurisdiction;
- Cide-royalties contribution (Contribuição de Intervenção no Domínio Econômico destinada a financiar o Programa de Estímulo à Interação Universidade-Empresa para o Apoio à Inovação – Cide-royalties), at the rate of 10%;
- PIS-importation contribution (Contribuição para o PIS/Pasep-Importação) at the rate of 1.65%;
- Cofins-importation contribution (Contribuição para o Cofins-Importação) at the rate of 7.6%; and
- IOF (Imposto sobre Operações de Câmbio), which is the financial tax levied on the foreign exchange transaction, at the rate of 0.38%.

In August 2024, Ministry of Finance Ordinance No. 1,086/2024 repealed the USD 50 customs exemption for international postal consignments exchanged between individuals. Art. 2 expressly repealed Art. 1(2) of Ministry of Finance Ordinance No. 156/1999, which had established the exemption. Therefore, Brazil does not implement any de minimis threshold.

Foreign companies can register a domain ".br" after the conclusion of a special registration, which requires a local legal representative and a declaration that the company will establish activities in Brazil within 12 months from the registration, according to Art. 6 of the Resolution of the Internet Steering Committee 2008/008/P.

Online pharmacies must have "com.br" or "far.br" domains. Moreover, according to Art. 53.2 of Resolution of the Director's Board of the National Agency for Health Surveillance 44/2009, Internet pharmacies are permitted in Brazil only if the Internet pharmacy is the website component of a licensed Brazilian brick-and-mortar pharmacy,

In recent years, Brazilian courts have issued several high‑profile decisions requiring foreign technology companies to appoint a local representative. The most notable cases are the following: (1) in 2022, when a proposed ban on Telegram did not ultimately take effect after the platform swiftly complied with judicial orders to designate a local legal representative; (2) in 2024, when the Supreme Court ordered the blocking of X due to its failure to appoint a domestic representative, a measure later lifted once the company adhered to the Court’s ruling; and (3) in 2025, when the Supreme Court similarly ordered the blocking of Rumble on the basis that the platform had not designated a local representative.

The Consumer Protection Act and the Law on Electronic Commerce Contracts provide a comprehensive framework for consumer protection that also applies to online transactions. Decree No. 7.962 includes specific obligations that apply to e-commerce purchases of goods and services that do not apply to traditional retailing. The Decree sets out obligations for e-commerce sites, such as providing a contract before purchase, supporting consumer service, answering consumer demands within five days, and ensuring the right to regret of the consumer. The right to regret was originally established by Art. 49 of Law 8.078. It allows for the cancellation of acquisitions made outside commercial establishments within seven days from the acquisition or receipt of product/service. It is, thus, applicable to other forms of distance sales as well.

Brazil has not signed the United Nations (UN) Convention on the Use of Electronic Communications in International Contracts.

Brazil has not adopted national legislation based on or influenced by the United Nations Commission on International Trade Law (UNCITRAL) Model Law on Electronic Commerce.

In February 2025, the Supreme Court ordered the blocking of the social media platform Rumble, citing the platform’s failure to appoint a local representative and its refusal to restrict certain accounts.

Under Art. 35 of Portaria SECEX No. 249/2023, imports of used consumer goods and their components, parts and accessories are not authorised. This includes ordinary used smartphones classified under NCM 8517.13.00, as they are not covered by the special regime applicable to used capital goods. Annex V identifies certain laptops, computers, peripherals and storage devices that are generally classified as consumer goods but may be treated as capital goods where their specific technical characteristics justify that classification. In such cases, the goods are subject to non-automatic import licensing rather than the prohibition.

Under Arts. 21(III), 29 and 30 of Portaria SECEX No. 249/2023, imports of used capital goods and their parts, components and accessories listed in Annex V require a non-automatic import licence. Covered ICT goods include automatic data-processing systems, medium-, large- and very-large-capacity digital processing units, automated teller machines, cellular and satellite base-station equipment, switches, routers, network hubs, modems and gateways under the specified NCM classifications. Annex V also allows certain laptops, computers, peripherals and storage devices that are generally classified as consumer goods to be treated as capital goods where their specific technical characteristics justify that classification. In such cases, they are subject to non-automatic licensing rather than the restriction applicable to used consumer goods. A licence is generally granted only where no identical domestically produced good, or domestic alternative capable of serving the intended purpose, is available.

According to Section 5.3 of Ordinance No. 9/2018, data, metadata, information and knowledge produced or stored by Federal Public Administration (FPA) bodies and its backups shall reside in the Brazilian territory. In addition, Section 5.4 stipulates that the data, metadata, information and knowledge generated or held by a FPA entity or body relating to personal data (relating to intimacy, privacy, honour and image), information with restricted access under current legislation and preparatory documents may be processed in a cloud computing environment at the discretion of the FPA entity or body, taking into account current legislation, but must reside exclusively on Brazilian territory.

Under Art. 33 of the General Personal Data Protection Law (LGPD), the international transfer of personal data is permitted only in specific situations: when directed to countries or international organisations recognised as providing an adequate level of protection; where the controller demonstrates compliance with LGPD principles through safeguards such as standard contractual clauses (SCCs), binding corporate rules (BCRs), or approved codes of conduct; when required for international legal cooperation between public authorities; to protect the life or physical integrity of the data subject or a third party; when authorised by the National Data Protection Authority (ANPD); when arising from international cooperation agreements; when necessary for implementing public policies or fulfilling legal mandates of public administration; when the data subject provides explicit and informed consent, clearly distinguished from other purposes; when required to comply with legal or regulatory obligations; when necessary for the performance of a contract or pre-contractual measures requested by the data subject; or when essential for the exercise of rights in judicial, administrative, or arbitral proceedings.
Resolution No. 19/2024 of the ANPD governs transfers based on adequacy decisions and appropriate safeguards. The ANPD may designate jurisdictions as adequate following an assessment of their legal frameworks, enforcement mechanisms, and redress options. The Resolution introduces ANPD-approved SCCs, which must be adopted without modification, and permits BCRs for intra-group transfers subject to prior approval. In exceptional cases where SCCs cannot be applied, controllers may seek ANPD authorisation for specific contractual clauses, provided these ensure an equivalent level of protection.