Understanding Brazil’s Marco Civil da Internet and Free Software
Marco Civil sets clear rules on privacy, net neutrality, and data handling for services in Brazil. When you build or run free software projects that touch Brazilian users or servers, these rules shape how you collect, store, and share data.
Quick orientation for free software teams
Start here if your project accepts Brazilian users or runs servers inside the country. The law requires you to publish clear terms on data use, respect net neutrality when routing traffic, and hand data to authorities only under specific court orders.
- Publish terms in Portuguese when your service targets Brazil.
- Log only what you need and delete it once the legal window closes.
- Never throttle or prioritize traffic on your own network.
Core rules that matter for open source projects
Marco Civil protects users’ privacy and requires companies to keep connection logs for one year and access logs for six months. Free software projects that act as intermediaries fall under these duties once they reach a certain scale.
Article 15 and Article 17 spell out when a judge can request logs. You stay safe by keeping logs minimal and storing them in Brazil if the service is aimed at local users.
Steps to check your project
- Map where user data is stored and who can access it.
- Review your license text for any clauses that conflict with Brazilian data requests.
- Add a privacy section to your README that names the legal basis for each data point you collect.
- Test your log deletion routine against the six-month and one-year limits.
- Ask a Brazilian lawyer to review the final terms before you launch to local users.
Real situations and how teams handled them
| Scenario | What changed |
|---|---|
| A Brazilian university runs a Mastodon instance | They added a clear log retention notice and stopped collecting IP addresses after 30 days. |
| An open source chat app gains Brazilian users | Developers moved the main server to São Paulo and published terms in Portuguese. |
| A Git hosting platform receives a court order | They released only the court-ordered logs and notified affected users within the required time. |
Where to look next
Read the full text of Law 12.965 on the Planalto site. Check the CGI.br guidelines for intermediaries. Join the Brazilian free software mailing lists to see how other maintainers updated their infrastructure after the 2016 regulations came out.
