Brazil's Ministry of Justice is preparing an ordinance that would require digital platforms to notify the Federal Police within 12 hours whenever they detect posts showing evidence of "credible, imminent or ongoing" risk to the life and physical integrity of children and teenagers. The terms are laid out in a technical note completed on August 24 by the ministry's National Secretariat of Digital Rights, which the newspaper O Estado de S. Paulo gained access to on Friday (18); Folha de S.Paulo confirmed the details on Saturday (19).

The deadlines work like an emergency-room triage. The 12-hour window covers what the note defines as situations in which available information indicates a "concrete and temporally close" probability of harm to the life, physical or psychological integrity, liberty or security of a child or adolescent. Cases with evidence of sexual violence must be reported within 72 hours, when the material was recently produced, had not been previously identified or was captured using a tool supplied by the platform itself. All other cases of exposure and online violence can be reported within seven days.

The ordinance implements the so-called ECA Digital, a law signed a year ago by President Luiz Inácio Lula da Silva and in force since September 2025, which updated Brazil's main child-protection statute for the internet era and already requires platforms to remove and report content showing apparent sexual exploitation, kidnapping and grooming. The new text creates a National Center for the Protection of Children and Adolescents inside the Federal Police, roughly Brazil's FBI, to receive and screen the reports. The note was sent to Federal Police director-general Andrei Rodrigues and to the head of Brazil's data protection authority, the ANPD, Waldemar Gonçalves.

There is also a quieter change in the system's plumbing. Today, platforms send these reports to the NCMEC, a U.S. private nonprofit that then passes the cases on to authorities in each country. Brazil's model draws on the UK's National Crime Agency, and the European Union is debating a similar center. According to Estado, the draft also requires companies to preserve removed content and its data until the Federal Police validates the platform's report, and to provide dedicated profiles for bodies such as the public defender's office and state prosecutors.

What is at stake for the companies

For the big techs, the rule changes the cost of operating in Brazil. Answering within 12 hours requires moderation staff on call around the clock in Portuguese, while the companies prefer to funnel this work through a single global channel, the NCMEC. Their revenue comes from advertising tied to how long users stay online, and the ordinance does not touch that model; the friction lies in the compliance bill and the risk of liability.

What we still do not know

The ordinance has not been published in the federal gazette, it has no start date, and the reports do not detail penalties for companies that miss the deadlines. It is also unclear whether there will be a public consultation before the final version. Watch for the official publication and how the platforms react to the final text. One practical reminder: the clock starts when the platform itself detects the risk, so the reporting tools inside the apps remain the first line of defense for parents.