ANPD creates a complaint channel to oversee compliance with the new Internet Civil Rights Framework rules

Vitoria Faggiani

2 days ago

The National Data Protection Agency (ANPD) took a new step last week to strengthen its oversight role in the digital environment

On October 5, 2026, the ANPD launched a dedicated channel for receiving complaints about possible noncompliance with the new obligations established by Decrees No. 12,975/2026 and No. 12,976/2026, which updated the regulation of Brazil’s Internet Civil Framework (Marco Civil da Internet). Any individual or legal entity may report noncompliance and submit information to guide the monitoring and oversight of internet application providers.

For companies that operate internet applications, the practical consequence is greater exposure, since failures visible to users will now reach the regulator directly.

The initiative is part of a movement to consolidate the ANPD’s new powers and signals an increasingly structured approach by the Agency in monitoring compliance and identifying possible violations in the digital environment.

Regulatory background

Decrees No. 12,975/2026 and No. 12,976/2026 were published on May 21, 2026, and have been in force since July 20, 2026. They update the regulation of the Marco Civil da Internet (Law No. 12,965/2014) in light of the Federal Supreme Court’s (STF) ruling on Article 19 (Topics 987 and 533 of general repercussion), and grant the ANPD regulatory and oversight powers over the new regime.

– Decree No. 12,975/2026: amends Decree No. 8,771/2016 and details platforms’ duties, including: a duty of care and systemic risk management, with removal of an exhaustive list of criminal content; permanent and accessible notification channels, with acknowledgment of receipt, a reasoned decision and a means of appeal; a registered office and legal representative in Brazil; mechanisms to prevent ads and paid boosting of unlawful content, with ad records kept for at least one year; updated terms of use and periodic transparency reports; and measures to combat online fraud and scams.

– Decree No. 12,976/2026: creates a specific regime for protecting women in the digital environment. Intimate content disclosed without consent must be removed within two hours of notification, with re-upload blocking. The decree also prohibits the generation or alteration of third parties’ intimate content by artificial intelligence and requires technical safeguards from those who offer such features

What can be reported and how the channel works

The ANPD indicates that, among others, the following conduct may be reported:

absence of adequate channels to receive notifications about criminal or unlawful content;
failures in the mechanisms meant to prevent ads or paid boosting of such content;
absence of a legal representative in Brazil;
failure to meet content removal deadlines;
failures in measures to protect against the disclosure or generation of intimate content.

The new channel is available at: https://www.gov.br/anpd/pt-br/assuntos/marco-civil-da-internet/denuncias-marco-civil-da-internet

Access Complaints are submitted with a gov.br account, using the “Denúncia Marco Civil” option. The ANPD advises clearly identifying the company, describing specific facts, and providing a name or corporate name and an email address. No identification document is required, but evidence may be attached.

Anonymity. Anonymous complaints are accepted as long as they contain enough information to substantiate or allow verification of the facts.

Handling. As a rule, complaints will be analyzed in aggregate and systemically, to identify patterns and assess the need for inspection or investigation. Serious cases with the potential to affect many people may, exceptionally, receive individual treatment. The information will also support the Agency’s regulatory improvement and educational efforts.

Feedback to complainants. The ANPD does not send individual responses, but the progress of a request can be tracked in the “Minhas Solicitações” (My Requests) section of the system.

The measure reinforces that the ANPD’s role is not limited to personal data protection in the strict sense. With the new powers granted by Decrees No. 12,975/2026 and No. 12,976/2026, the Agency now also carries out regulation, oversight and investigation of violations related to the duties imposed on internet application providers and digital platforms.

⚠️ The Agency’s action is administrative and systemic. It verifies whether platforms have adequate mechanisms, processes, governance, and technical and organizational measures to comply with the decrees. In other words, the ANPD does not investigate crimes or order the removal of specific posts. For companies, this means that the risk before the Agency lies not in an isolated piece of content, but in evidence of repeated or structural failures in their processes.

What changes for companies?

The recent initiative indicates that the ANPD is moving toward an increasingly structured approach, not only in issuing rules but also in monitoring and overseeing compliance with the obligations applicable to the digital environment.

For companies that operate digital platforms, social networks, internet services or artificial intelligence tools, the scenario reinforces the need to review governance mechanisms, reporting channels, procedures for responding to notifications, risk prevention and mitigation measures, and internal structures designed to comply with the new obligations

In addition, the ANPD itself reports that it has been monitoring digital platforms, app stores and generative AI tools since August to verify the adoption of the measures set out in the new decrees. The monitoring covers 22 selected agents, chosen considering, among other factors, their reach in the Brazilian market, the services they offer and the risks associated with the circulation of third-party content.

In this context, the creation of a dedicated complaint channel, together with the monitoring already under way, shows a strengthening of the ANPD’s enforcement tools. For companies subject to the new rules, the moment calls not only for tracking regulatory developments but also for a preventive assessment of internal processes and controls related to digital compliance.

Practical Recommendations

Test the notification channel as a user would. Check whether it is accessible, whether it acknowledges receipt, whether it communicates the decision with reasons, and whether it states the means of appeal. These are precisely the failures the ANPD channel invites people to report;
Map deadlines and evidence. Record response times by type of notification, paying attention to the short deadlines in Decree No. 12,976/2026 for intimate content and violence against women;
Confirm the legal representative in Brazil, with powers to respond to administrative and judicial authorities;
Review ads and paid boosting, filters against unlawful content, and retention of advertiser records for at least one year;
Implement safeguards in AI features capable of generating or altering images or voice, to block the creation of third parties’ intimate content;
Update terms of use and transparency reports to reflect the new regime of six hours for manifestly unlawful content and 24 hours for other cases of violence against women;
Prepare a response protocol for the ANPD.

Companies that are not platforms can also use the channel, which is open to legal entities, for example to report platform failures in the mechanisms meant to prevent fraudulent ads.

Our Data Protection Team at Araújo e Policastro Advogados is available for questions and clarifications.