Justices Cristiano Zanin and Dias Toffoli of Brazil's Supreme Court (STF) voted on Thursday (27) to keep the rule in the Marco Civil da Internet, the country's 2014 internet rights law, that requires a court order before internet providers can share user data with authorities. They were the only two to vote before the trial was suspended with no date set to resume, according to Folha de S.Paulo and the telecom outlet TeleSíntese. The 2-0 score is provisional.

The case under review is ADC 91, a constitutional action filed by Abrint, the association that represents Brazilian internet providers. The group wants the court to confirm that identifying a person by cross-referencing an IP address, date, time and time zone with registration data requires judicial authorization. Think of it this way: asking a carrier who lives at a given address is one thing; tracing an IP is something else entirely, because an IP works like the plate of a rental car. The plate alone says little, but matched against records of everywhere the car has been, it maps out a large part of your digital life.

In his vote, rapporteur Zanin split the issue in two. Basic registration data, such as name, parentage and address, can be requested directly by authorities in cases defined by law. Connection records, which under the Marco Civil include the IP address itself, require a court order. "The direct requisition of registration data presupposes prior identification of the user. It cannot be the instrument of the identification itself," Zanin said, according to TeleSíntese. Toffoli followed the rapporteur, including after adjustments to the wording of the thesis.

Zanin carved out an exception for imminent danger involving high-value legal interests that would amount to a state of necessity. In those cases, police or prosecutors could request the data directly, provided the procedure is documented and later submitted to the judiciary. He summed up his position in one line:

"The rule is the court order, because that is what the legislator wanted. The exception is justified urgency."

The incentives on each side are worth watching. Abrint argued in oral arguments for an even stricter rule, without the emergency exception. Its members have spent more than a decade fielding requests from authorities that treat IP-linked information as simple registration data, and every provider that complies or refuses exposes itself to lawsuits. A uniform ruling from the STF lifts that legal risk off companies whose business depends on customers trusting that their data does not circulate without oversight. On the other side, police forces and prosecutors want speed, because every judicial step adds time to investigations that often race the clock and the short retention windows of connection logs.

What we still do not know

The trial was suspended after the two votes and, according to TeleSíntese, the court's president said the analysis will not continue next week. Nine justices have yet to vote, and the final wording of the urgency exception may still change: Toffoli himself said he had initially proposed a different formula before joining the rapporteur. Nothing is settled.

For now, nothing changes for users: the rule requiring a judge to trace an IP remains in force. What to watch is when the case returns to the docket and, above all, how wide the urgency exception ends up. If "justified urgency" is defined too broadly, the judicial gate the Marco Civil built in 2014 could turn into a revolving door.