Brazil's Supreme Court Justices Vote to Uphold Internet Law Requiring Judicial Orders for User Data

Brazil's Supreme Federal Tribunal (STF) is currently reviewing a key aspect of the Marco Civil da Internet, specifically the requirement for judicial orders before internet providers can share user data with authorities. Justice Cristiano Zanin cast a pivotal vote on Thursday, August 27, 2026, supporting the necessity of a court order for data sharing, except in rare, exceptional circumstances.

Zanin, serving as the rapporteur for one of the cases, argued that individuals have a fundamental right to control the extent to which information about their personal lives can be accessed. He stated, "With the consecration of the broad right to personal data protection, we must ensure, alongside the secrecy of telecommunications, other areas of protection, such as the right to informational self-determination."

While advocating for the general rule of judicial oversight, Zanin acknowledged that police authorities or the Public Prosecutor's Office might, in exceptional cases, request user identification data associated with traffic information directly. However, he proposed that such actions must be documented and subsequently submitted for judicial review. He also suggested that the decision's application should commence from the conclusion of the judgment, with ongoing investigations and legal actions only being affected if the defense has referenced the STF's discussion prior to the final ruling.

Justice Dias Toffoli concurred with Zanin's stance on the necessity of a judicial order. The court is considering three consolidated actions related to accessing sensitive and protected data. The judgment was suspended without a set date for its resumption. The Association of Brazilian Internet and Telecommunications Providers (Abrint) has petitioned the court to declare the constitutionality of the relevant section of the Marco Civil da Internet, which mandates judicial orders for accessing connection data, such as IP addresses used for user identification.

“

With the consecration of the broad right to personal data protection, we must ensure, alongside the secrecy of telecommunications, other areas of protection, such as the right to informational self-determination.