Brazilian Digital Platform Regulation | 2026 Guide
Does your app serve users in Brazil while your company operates from the United States, Europe, or another country?
Brazilian digital-platform rules may require a local legal representative, specific regulatory contacts, and additional compliance measures—even without a Brazilian subsidiary.
The requirements depend on what your service does and how Brazilian law applies to it.
By Willian Nunes | Brazilian Attorney, OAB/PR 80.473
Updated November 5, 2026
Does a foreign digital platform need a legal representative in Brazil?
Some do, but there is no reliable one-size-fits-all answer.
A foreign company’s obligation depends on its products, audience, operations, and the legal framework that applies to the service.
Three sets of requirements deserve particular attention:
- ECA Digital (Law No. 15,211/2025): Article 40 requires an in-country legal representative for suppliers covered by the statute, which addresses products and services directed at children or adolescents or likely to be accessed by them.
- Brazil’s Internet Civil Framework and its 2026 regulation: Decree No. 12,975/2026 added duties concerning Brazilian headquarters and legal representation for internet application providers within its applicable scope.
- The Federal Police’s NIDUS system: Certain suppliers must register for a reporting system involving serious crimes against children and adolescents, under separate rules and criteria.
These are related but not interchangeable obligations.
A NIDUS registration does not by itself resolve all representation, corporate-presence, or data-protection requirements.
Unsure whether your app is covered?
We can review your platform’s activities and the relevant Brazilian legal requirements before your company makes a formal appointment.
What is ECA Digital, and why should foreign tech companies pay attention?
Brazil’s Estatuto Digital da Criança e do Adolescente (ECA Digital), Law No. 15,211/2025, establishes protections for children and teenagers in digital environments.
Its applicability is not limited to apps that openly market themselves to minors. It can also extend to services likely to be accessed by children and adolescents.
The Brazilian Data Protection Authority (ANPD) published guidance on October 28, 2026, explaining how to assess likely access through factors such as product attractiveness, ease of access, and significant risks to minors.
A statement that an app is “18+” does not, on its own, settle this assessment.
For covered foreign suppliers, Article 40 requires a legal representative in Brazil with authority to receive service of process, official notices and communications; act in administrative and judicial proceedings; and respond to Brazilian public authorities on behalf of the foreign company.
This issue may arise for social networks, user-content platforms, games, app stores, and other interactive digital products.
The legal analysis must consider each product’s actual features and exposure to Brazilian users.
What changed under Brazil’s 2026 Internet Civil Framework rules?
Decree No. 12,975/2026 updated the regulation of Brazil’s Marco Civil da Internet (Internet Civil Framework).
Article 16-A, introduced into Decree No. 8,771/2016, addresses the duties of internet application providers, including maintaining headquarters and a legal representative in Brazil within the rule’s applicable scope.
Its wording provides that the legal representative must be constituted as a legal entity and grants powers extending beyond basic receipt of correspondence.
The listed powers include interactions with authorities, compliance with court orders, and matters involving financial penalties or obligations incurred by the represented provider.
Important distinction: Hiring a third-party representative, using a Brazilian mailing address, and establishing legally sufficient headquarters in Brazil are not necessarily the same thing.
Companies should not assume that an external provider’s CNPJ (Brazilian corporate taxpayer registration) automatically satisfies every local-presence requirement.
The ANPD also notes that the decree generally treats private messaging, email, and virtual meeting services differently, in view of constitutional protections for private communications.
Public channels, groups, or other product features may require a different analysis.
For these reasons, an engagement should start with a review of the provider’s business model, the scope of the law, and the representative’s powers—not with a standard power of attorney alone.
NIDUS registration: an additional issue for dating and adult-oriented platforms
On October 20, 2026, Brazil’s Federal Police issued Ordinance DG/PF No. 19,107/2026, setting up the first stage of registration in the NIDUS system.
The Ministry of Justice explained that mandatory registration applies to qualifying services aimed at, or likely to be accessed by, minors where online sexual-violence risks exist.
It also expressly covers suppliers of pornography, escort services, and services arranging sexual encounters or relationships—even when those services are not directed at minors.
The first registration period is 60 days from publication of the ordinance.
Companies must provide identifying details, relevant applications and domains, representative or attorney-in-fact contact details, and technical and law-enforcement contacts.
Further rules govern subsequent reporting implementation.
Not every dating app is automatically classified in the same way.
Companies should evaluate the precise nature of their services, user interactions, content policies and statutory category before determining whether registration is mandatory.
The Federal Police clarifies that naming a contact person in NIDUS does not, by itself, make that person personally liable for the reports’ content.
This does not remove the need to assess the broader legal representative’s duties under other legislation.
What does a local legal representative actually do?
The representative’s specific powers depend on the applicable law and the appointment documents.
A properly defined arrangement may involve:
- Receiving valid official notices, service of process, and regulatory communications in Brazil.
- Communicating with competent authorities within the authority granted by the foreign company.
- Coordinating deadlines and responses with the company’s legal, trust-and-safety, technical and compliance teams.
- Supporting relevant formalities involving powers of attorney and agency registrations.
- Maintaining reliable contact and escalation procedures for urgent requests.
A legal representative is not automatically the company’s director, data protection officer, moderator, or technical incident-response team.
These roles may overlap in particular structures, but they should not be confused in contracts or communications with authorities.
The appointment is also not risk-free: powers related to court orders, financial penalties, and regulatory responses demand careful contractual and operational safeguards.
Can a foreign company appoint a representative without opening a Brazilian subsidiary?
In certain legal contexts, a foreign company can appoint a representative through a properly executed power of attorney without first incorporating a subsidiary in Brazil.
However, this does not mean every local-establishment requirement is automatically fulfilled.
The correct structure depends on the relevant regulation, the company’s activities, the legal identity of the proposed representative, and any corporate, tax, filing or licensing obligations.
A legal assessment should distinguish representation for notices from the establishment of an actual corporate presence in Brazil.
What information should foreign tech companies prepare?
Before requesting a legal assessment, it is helpful to organize:
- The company’s legal name, country of incorporation and proof of authority of its signatory.
- The application’s name, website, app-store listings and domains available in Brazil.
- A description of its Brazilian operations and available information about Brazilian users.
- Age restrictions, age-assurance measures, community guidelines and moderation processes.
- Any Brazilian notices, regulatory inquiries, pending deadlines or enforcement communications.
- The technical, compliance and legal contacts who can implement urgent requests.
- The specific service sought: legal review, NIDUS registration guidance, formal representation structuring, or ongoing Brazilian counsel.
Initial discussions do not require sending unnecessary user-level personal data or sensitive platform records.
Relevant documents can be identified during a confidential legal review.
Questions about Brazilian platform compliance?
Tell us where your company is incorporated, what your app does, and whether you have received any communication from Brazilian authorities.
How WN Advogados can assist foreign companies
Willian Nunes Advogados is a Brazilian law firm based in Curitiba, Brazil, providing Brazilian legal assistance to local and international clients, including communication in English.
For foreign digital businesses, the firm’s legal work may include assessing Brazilian law’s applicability, reviewing regulatory obligations, preparing and evaluating representation documents, advising on the legal structure of an appointment, and coordinating with relevant professionals and authorities within the scope of an agreed engagement.
Any formal operational representation, if appropriate, requires separate assessment of the representative’s legal status, powers, responsibilities and contractual arrangements.
The firm does not suggest that every platform requires the same solution.
Frequently asked questions
Does every foreign app with users in Brazil need a legal representative?
No. Whether an appointment is legally required depends on the relevant statutory and regulatory provisions and the facts of the service. Accessibility from Brazil alone is not a sufficient legal assessment.
Does an adults-only dating app fall outside ECA Digital?
Not necessarily. The applicability of ECA Digital depends on statutory criteria, including likely access by minors. Separately, certain sexual-encounter or relationship services may face mandatory NIDUS registration rules even when they are intended for adults.
Is a legal representative the same as a data protection officer?
No. The local representative and a data protection officer (DPO, or encarregado under Brazilian data-protection law) perform legally distinct functions, although particular arrangements may involve more than one responsibility.
Does a Brazilian representative eliminate the need for a CNPJ or local headquarters?
Not automatically. Representation and local establishment are separate questions. The relevant rules and the company’s business structure must be assessed before reaching a conclusion.
Can the appointment be organized remotely?
Often, legal documents and an initial assessment can be handled remotely. Execution, authentication, translation, registration and platform-specific requirements depend on the documents and the relevant authority.
What should our company do after receiving a notice from a Brazilian authority?
Preserve the communication, identify its issuing authority and deadline, and seek Brazilian legal review without assuming that forwarding the notice to a third party satisfies the company’s obligations.
Need Brazilian legal guidance for your platform?
If your company operates a digital service accessible to Brazilian users, a case-specific legal review can clarify whether representation, NIDUS registration, or other compliance steps apply.
Official legal references
- Law No. 15,211/2025 — ECA Digital, especially Articles 1 and 40.
- Decree No. 12,975/2026, including Article 16-A added to Decree No. 8,771/2016.
- ANPD guidance on ECA Digital applicability — October 28, 2026.
- ANPD guidance on the Internet Civil Framework.
- Ministry of Justice guidance on NIDUS registration.
Legal information as of November 5, 2026. This article provides general information on Brazilian law and does not constitute legal advice for a particular company or substitute for review of its specific services, contracts, and regulatory exposure.