By Cesar Augusto Taborda Lima
When a fake profile is used to deceive your customers in Brazil, the sound order is to preserve the evidence, ask the platform to remove the account and, to learn who is behind it, ask a court for the records that lead to the author. Under the final ruling of the STF, Brazil’s Supreme Federal Court, on article 19 of the Marco Civil da Internet (Law 12,965/2014, Brazil’s internet statute), a platform notified of an inauthentic account that fails to remove it is, as a rule, jointly liable for the damage, with no prior court order required. Identifying the author still requires a judge, and delay works against the victim: platforms need only keep access records for six months.
Art. 22. The interested party may, for the purpose of gathering evidence in civil or criminal court proceedings, incidentally or in autonomous proceedings, ask the court to order whoever is responsible for keeping them to provide connection records or records of access to internet applications.
Sole paragraph. Without prejudice to other legal requirements, the request must contain, on pain of inadmissibility:
I. well-founded indications that the unlawful act occurred;
II. a reasoned justification of the usefulness of the records requested for purposes of investigation or evidence; and
III. the period to which the records refer.
Law 12,965/2014 (Marco Civil da Internet), art. 22, caput and sole paragraph. Free translation.
Preserving the evidence before the profile disappears
Fake profiles tend to vanish once the victim reacts, and a successful report will itself take the page down. Evidence comes first:
- the address (URL) of the profile and of each post, with the username;
- screenshots of the profile, posts and messages, showing date and time;
- conversations with customers who were approached, and accounts from those who paid;
- payment receipts, Pix keys (Brazil’s instant payment system), bank accounts and phone numbers used by the scammer;
- proof that the brand, name or image belongs to the victim.
Screenshots prove the images they show but, if challenged, require electronic authentication or expert examination (Code of Civil Procedure, CPC, art. 422, § 1). The ata notarial (CPC, art. 384) works differently: a notary, whose statements carry public faith, opens the profile and records what was observed, and the public document proves the facts the notary declares to have occurred in his or her presence (CPC, art. 405). Technical captures by private services, with a hash code and metadata, are an alternative without public faith, weighed according to their technical reliability. In criminal matters the STJ, Brazil’s Superior Court of Justice, requires expert examination where there is reasonable doubt about the integrity of digital evidence (AgRg no HC 1.014.212/ES, 2026).
Removal, and what the STF changed
The main platforms run forms for reporting accounts that impersonate a person or business; Instagram’s, for instance, accepts reports only from the person impersonated or an authorised representative and asks for an identity document. Where that fails, an extrajudicial notice should give the exact address of the account, explain why it is not authentic and enclose proof of identity or of trademark ownership.
Article 19 of the Marco Civil made platforms liable for third-party content only after they disregarded a specific court order. On 26 June 2025 the STF held it partially unconstitutional in extraordinary appeals RE 1.037.396 (Theme 987) and RE 1.057.258 (Theme 533); the first concerned a fake Facebook profile. On 17 June 2026, ruling on motions for clarification in RE 1.037.396, the Court settled the final wording of the Theme 987 thesis and declared the decision final.
Under the thesis, a platform is jointly liable, on the terms of article 21 of the Marco Civil, for damage from third-party content amounting to a crime or unlawful act, unless it shows reasonable doubt as to unlawfulness after qualified diligence; and “the same rule of joint liability applies to accounts reported as not authentic” (free translation).
There are limits. For offences against honour article 19 still governs, although removal may be requested by extrajudicial notice; article 19 also governs instant messaging services as regards interpersonal communications. For paid advertising and boosted posts, the platform’s fault is presumed even without notice, unless it proves it acted diligently and within a reasonable time. The thesis applies from 5 August 2025 and also reaches continuing or permanent acts.
The records that lead to the author
Platforms must keep access records for six months (art. 15) and internet access providers must keep connection records for one year (art. 13); disclosure requires a court order (art. 10, § 1). The usual route starts with the platform, ordered to provide IP addresses, dates, times and source port; with that data, the access provider is ordered to identify its subscriber. The STJ holds that both kinds of provider must keep and disclose the source port (REsp 1.777.769/SP, 2019) and ruled in 2025 that the access provider must identify the user from the IP address and approximate time, even without a source port supplied by the platform (REsp 2.170.872/SP).
The request may be filed as a standalone action, before the victim knows whom to sue, or within existing proceedings. It is prudent to seek an urgent order preserving the records (CPC, art. 301). The police, administrative authorities and the Public Prosecutor’s Office may also ask providers to retain records as a precaution, even beyond the statutory periods, and then have sixty days to seek court authorisation for access (arts. 13, §§ 2 and 3, and 15, § 2). The subscriber identified is not always the author, since connections are shared; the data guides the investigation without closing it.
The criminal side
A police report (boletim de ocorrência) records the facts and opens the investigative tools of the police. Depending on the facts, the conduct may amount to false identity (Penal Code, art. 307), where it is not an element of a more serious crime, or to electronic fraud (art. 171, § 2-A, added by Law 14,155/2021 and rewritten by Law 15,397/2026), punishable by four to eight years’ imprisonment where the fraud uses information supplied by the victim or by a third party misled through social networks, phone contacts, duplication of an internet application or similar means. The 2026 law also repealed art. 171, § 5, under which prosecution for fraud generally depended on a formal request by the victim. Classification is for the authorities, and criminal proceedings do not replace a civil claim.
The trademark as proof of ownership
For a business, registration with the INPI (Brazil’s National Institute of Industrial Property) simplifies proof. Ownership of a mark is acquired by registration, which secures exclusive use throughout Brazil, and the owner may protect its material integrity or reputation (Law 9,279/1996, arts. 129 and 130, III).
As I see it, timing matters more in these cases than any legal thesis. Evidence preserved on the first day and a precise notice put the platform before a duty the STF has made clear; waiting may erase both the evidence and the records that would point to the author. Litigation is most justified where there is a loss to recover or a risk that the scam will resume under a new account.