Brazil

Brazil has no general AI-transparency statute in force. The Superior Electoral Court's Resolução TSE nº 23.610/2019, as amended by Resolução TSE nº 23.732, de 27 de fevereiro de 2024, imposes a disclosure duty on AI-generated synthetic content used in electoral advertising and separately prohibits using a fabricated or manipulated deepfake to harm or benefit a candidacy, but these duties bind campaign advertising specifically and do not reach AI output generally.

Brazil's general framework bill for artificial intelligence, Projeto de Lei nº 2.338/2023 (Marco Legal da Inteligência Artificial), was approved by the Senate Federal in substitute form on 10 December 2024 and remitted to the Chamber of Deputies on 17 March 2025, where it remains pending as of this writing; it binds nobody unless and until it is enacted.

Brazil's private-sector personal-data regime is the Lei Geral de Proteção de Dados Pessoais (LGPD), Lei nº 13.709, de 14 de agosto de 2018, a comprehensive statute requiring a lawful basis for any processing, heightened rules for sensitive categories including genetic and biometric data, a set of data-subject rights including review of automated decisions, conditioned international transfer, and breach notification, enforced by the Autoridade Nacional de Proteção de Dados (ANPD).

The LGPD's general provisions took effect from 18 September 2020, when Lei nº 14.058/2020 settled a legislative dispute over a proposed postponement, and its administrative sanctions (arts. 52-54) took effect separately from 1 August 2021 under Lei nº 14.010/2020.

Publicly accessible personal data remains within the LGPD's scope; only the consent requirement is dispensed for data the data subject has manifestly made public, and the processing must still respect the purpose, good faith, and public interest that justified the data's availability.

Brazil has no scraping-specific statute, so general law governs each dimension separately.

The Penal Code's article 154-A, inserted by Lei nº 12.737/2012 and amended by Lei nº 14.155/2021, criminalizes invading a computing device, connected to a network or not, to obtain, alter, or destroy data without authorization, or to install a vulnerability, but the offense turns on invading a device rather than merely reading a page it serves, so a scraper reading a public, unauthenticated page without defeating any access control falls outside a plain reading of the provision, and no reported case has tested the point.

No Brazilian court has ruled on the enforceability of a browsewrap or clickwrap terms-of-service against a scraper.

The Copyright Law, Lei nº 9.610/1998, protects a database as a compilation where its selection, organization, or arrangement of content constitutes an intellectual creation, but article 7, § 2º expressly excludes the underlying data or materials themselves from that protection, so Brazil has no sui generis extraction-based database right and no text-and-data-mining exception distinct from the ordinary limitations of article 46.

Personal data collected by scraping, including data the data subject has made public, remains subject to the Lei Geral de Proteção de Dados Pessoais (LGPD, Lei nº 13.709/2018): only the LGPD's consent requirement is dispensed for manifestly public data, and the LGPD's other duties, together with the Marco Civil da Internet's own protection-of-records duties, still apply.

No Brazilian statute or reported case establishes a scraping-specific unfair-competition, misappropriation, or trespass doctrine distinct from the computer-misuse and copyright provisions above, and none assigns legal weight to a robots.txt directive or imposes an AI-training-specific rule.

Brazil has no enacted, comprehensive cybersecurity law comparable to the EU's Cyber Resilience Act or NIS2. Its posture instead rests on a policy-setting decree, one enacted product-security regulation reaching a narrow class of consumer networking hardware, several sector-specific cybersecurity regimes that each bind a licensed or government-designated role this corpus's activity vocabulary cannot express, and a still-pending general cybersecurity bill.

Decreto nº 11.856, de 26 de dezembro de 2023 instituted the Política Nacional de Cibersegurança (PNCiber) and the Comitê Nacional de Cibersegurança (CNCiber), a public-private coordinating body chaired by the Gabinete de Segurança Institucional da Presidência da República with 19 government, business, civil-society, and scientific seats; its articles state principles and objectives for national cybersecurity activity and create a committee that recommends further policy, but the decree's own text imposes no requirement, duty, or penalty on a private business.

Decreto nº 12.573, de 4 de agosto de 2025 instituted the Estratégia Nacional de Cibersegurança (E-Ciber) that implements PNCiber's guidelines; its provisions are written throughout in the vocabulary of incentive (incentivo, estímulo) toward the private sector, including encouraging Brazilian companies to procure products and services that adopt minimum cybersecurity standards rather than requiring anyone to meet one, so it likewise creates no enforceable duty.

Brazil's one enacted, in-force product-security requirement is Ato nº 2.436, de 7 de março de 2023 of Anatel's Superintendência de Outorga e Recursos à Prestação, which sets mandatory minimum cybersecurity requirements for the conformity assessment (homologação) of consumer-facing customer-premises equipment: cable modems, xDSL modems, ONU/ONT units, fixed-wireless-access and satellite-broadband routers and modems, and wireless routers and access points. Its Annex became mandatory on 10 March 2024 and is researched as the instrument row below.

Three further sector regimes each bind a role this corpus's declared activities cannot identify, so each is named here and none is filed as an instrument, the treatment this profile gives DORA's financial entities and NY DFS Part 500's covered entities.

Anatel's own Regulamento de Segurança Cibernética Aplicada ao Setor de Telecomunicações, approved by Resolução nº 740, de 21 de dezembro de 2020, requires a "prestadora" (a Brazilian telecommunications service provider) to adopt and maintain a board-approved Cybersecurity Policy, source equipment only from suppliers whose own cybersecurity policy is compatible with the Regulation and independently and periodically audited, run cybersecurity vulnerability-assessment cycles, report on its critical telecommunications infrastructure, and notify Anatel of relevant incidents; that duty binds the carrier, not an app or a SaaS product that merely rides the carrier's network, and it is the same Resolução that gives Anatel's product-conformity procedures their cybersecurity mandate, so the two regimes share one legal source without sharing a bound party.

The Banco Central do Brasil's Resolução Conjunta CMN/BCB nº 4.893, de 26 de fevereiro de 2021 requires every institution the Central Bank authorizes to operate, meaning banks and other regulated financial institutions, to implement and maintain a board-approved cybersecurity policy addressing incident response, vulnerability management, and the security of contracted cloud and data-processing services; the bound party is a licensed financial institution, not a declared LexLint activity.

Aneel's Resolução Normativa nº 964, de 28 de setembro de 2021 imposes an analogous cybersecurity policy duty on the electric-power sector; it does not reach a digital-service provider of the kind this corpus's activities identify and is named here for completeness only.

A general cybersecurity statute is pending, not enacted. Projeto de Lei nº 4.752, de 2025, authored by Senator Esperidião Amin and others, would institute a "Marco Legal da Cibersegurança" and a national digital security and resilience program.

As of its most recent Senate committee action the bill remains with a rapporteur in the Comissão de Ciência, Tecnologia, Inovação e Informática, having received further amendments in September 2026, and it has not been enacted, so nothing about its eventual content is asserted here.

Brazil's General Data Protection Law (LGPD, Lei nº 13.709/2018) carries its own security-of-processing duty (Arts. 46 to 49) and its own personal-data breach-notification duty (Art. 48); both are this jurisdiction's privacy-topic findings and are not restated here, the treatment this profile gives a comprehensive regime's own security article.

The Marco Civil da Internet (Lei nº 12.965/2014) likewise requires an internet connection or application provider to keep connection and application-access records under confidentiality in a controlled, secure environment; that duty attaches to the records themselves and is researched with this jurisdiction's other Marco Civil provisions rather than repeated here.

No published enforcement record specific to Anatel's CPE cybersecurity requirements is confirmed in the primary text; Anatel states only that it monitors homologated products in the market on an ongoing basis and can suspend a product's homologação, which bars its distribution in Brazil, if a security flaw is found.

Brazil's age-appropriate design duties for digital services sit in Lei nº 15.211, de 17 de setembro de 2025 (the Estatuto Digital da Criança e do Adolescente, or ECA Digital), which applies to any information-technology product or service directed at children and adolescents, or likely to be accessed by them, wherever the provider is located, and enters into force on 17 March 2026.

The Estatuto da Criança e do Adolescente (ECA, Lei nº 8.069/1990), including as amended by Lei nº 14.811/2024, sets Brazil's general child-protection framework and criminalizes online exhibition or transmission of child sexual abuse material, but its own text imposes no age-verification or age-gating duty on a digital service provider; that duty arrives only with Lei nº 15.211/2025.

Brazil has no press-publisher neighbouring right and no mandatory platform-to-publisher bargaining code; the general copyright framework of the Copyright Law, Lei nº 9.610/1998, is the only law reaching an aggregator's reproduction of news content.

Article 46, I, a) permits reproducing, in the daily or periodical press, a news item or informative article published in a newspaper or periodical, naming the author if signed and the publication it was transcribed from, and article 46, III separately permits quoting passages of any work in a book, newspaper, magazine, or other communication medium for study, criticism, or controversy, to the extent justified for that purpose, naming the author and the origin of the work.

Neither provision carries a headline-length or short-extract cap distinct from these tests, and no reported Brazilian decision applies either to a systematic news aggregator as opposed to a single periodical reproducing another's item or an individual quoting a published work.

The Act's neighbouring rights protect performers, phonogram producers, and broadcasting organizations, not print or online news publishers, so there is no publisher-side neighbouring right of the kind the European Union's Digital Single Market Directive article 15 creates.

No statute or reported case addresses whether a hyperlink is itself a communication to the public, or whether framing or inline display changes the answer, and no hot-news or misappropriation doctrine distinct from ordinary copyright law has been located.

The Act predates the concept of a machine-readable text-and-data-mining reservation, so no opt-out mechanism of that kind exists; a text-and-data-mining exception has been proposed only within Projeto de Lei nº 2.338/2023, Brazil's pending general framework bill for artificial intelligence, approved by the Senate in substitute form on 10 December 2024 and, as of this writing, before the Chamber of Deputies.