Brazil: Bill establishing liability of internet application providers for false or fraudulent accounts (PL 322/2026) was introduced to the Chamber of Deputies

On 5 February 2026, the Bill establishing liability of internet application providers for false or fraudulent accounts (PL 322/2026) was introduced to the Chamber of Deputies. The Bill would amend Law No. 12.965, of 23 April 2014 (Internet Civil Framework), to insert Article 19-A establishing the liability of internet application providers for material and moral damages arising from scams or fraud carried out via false accounts or fraudulent profiles maintained in their services, where there is a failure to fulfil legal duties of prevention, minimum identity verification, or timely response to reports. A false account or fraudulent profile is defined as one created or used to assume, simulate, or conceal third-party identities to deceive users, induce victims into error for illicit gain, or enable, facilitate, or conceal scams, fraud, or digital swindles. Strict liability arises from structural failure in service provision, including absence of proportionate identity verification mechanisms, ineffective fraud-detection procedures, unjustified omission following a substantiated report, or maintenance of a fraudulent account after unequivocal awareness of relevant fraud indicators. A provider may be exempt by demonstrating, cumulatively, prior adoption of reasonable technical and organisational fraud-prevention measures, existence of an accessible and functional reporting procedure including extrajudicial notification, and prompt action to cease fraudulent activity upon becoming aware of the facts. Obligations under Article 19-A apply proportionately, having regard to the nature of the service, degree of systemic risk to user security, economic scale of the provider, and the provider's level of involvement in the creation, maintenance, and circulation of accounts. Upon enactment, the law enters into force 180 days after publication.