Union sues Discord: ECA Digital faces its first real test

On August 25, 2026, the Advocacia-Geral da União, through the Procuradoria Nacional da União de Defesa da Democracia, signed the initial complaint in a public civil action against Discord Inc. before the Seção Judiciária do Distrito Federal. The complaint seeks emergency relief imposing fourteen obligations to act, a daily fine of R$500,000, and a collective moral damages award of R$500 million.

The action follows the July 22, 2026 event documented in Technical Note No. 23/2026/GAB-SEDIGI/MJ and Technical Report No. 158/2026/CIBERLAB/DIOPI/SENASP/MJSP: a livestream on a closed Discord server, previously announced in messaging groups, in which two teenage girls were coerced into self-harm and suicide. One of them, aged 13, died during the broadcast. There are indications that a seven-year-old child had been groomed by the same group. The case gave rise to Operação Lívia, launched on August 4 with warrants in five states.

The Union relies on three circumstances:

• The event was announced in advance, with invitation links circulating, without any detection mechanism identifying it.
• The activity took place entirely through the product's core features — an invite-only closed server, DMs and streaming — not through peripheral loopholes or anomalous use.
• The platform did not report the facts to Brazilian authorities. Detection, evidence preservation and identification of those involved came entirely from the police.

The complaint classifies the pattern as Violent Extremist Nihilism, equivalent to the modus operandi of the COM/764 network, active on Discord since at least 2021. It adds data from SaferNet Brasil — 2,059 Discord URLs processed between January 2017 and July 2026, including 520 records in 2025 alone and 406 in the first seven months of 2026 — as well as a national history extending from the Cambé school attack (2023) to Operação Dark Room, including the case of the homeless man set on fire live in Rio in 2025.

Four grounds of liability

The legally relevant point is the architecture of the legal argument. The Union is not litigating liability for third-party content — it is litigating the breach of the provider's own duties, doing so across four distinct areas:

1. ECA Digital (Law 15.211/2025) and its regulations, for prevention from the design stage (Article 6), age verification (Articles 10, 14 and 24), protective defaults and parental supervision (Articles 7, 17 and 18), and duties of detection, removal, preservation and reporting (Articles 27 and 28).
2. Article 16-B of Decree 8.771/2016, added by Decree 12.975/2026 — the duty of care regarding criminal content and systemic moderation failures, regulating STF Themes 987 and 533.
3. Article 16-A of the same decree, requiring a headquarters and legal representative in the country with authority to respond administratively and judicially, combined with Article 40 of Law 15.211/2025 — used, among other things, as the basis for serving the defendant through its representative office.
4. Decree 12.976/2026, which establishes a specific duty of care regarding crimes against girls and female adolescents. The three identified victims are female, activating this area.

The classification of Discord as a social network under Article 2(III) of Law 15.211/2025 is supported by a factual argument: the existence of connection-recommendation mechanisms (Suggestions, Find Your Friends, Nearby Friends) and interest-based server discovery weighs against viewing the service as mere interpersonal communication. The point is well developed and is probably the most predictable axis of the defense's challenge.

The controls sought in emergency relief

For those working in security, the most interesting part of the complaint is the request for emergency relief. It describes, with a 15-day deadline, a set of concrete controls:

• Anti-ban-evasion through device identification, using "proportionate analysis of technical, behavioral and relational signals" — in practice, court-ordered fingerprinting.
• Hashing recordings of the event and incitement material, with automatic blocking of reuploads, invoking the replication rule in Article 16-J of Decree 8.771/2016, without requiring a new order for each replica. This is notice-and-staydown through an automated filter.
• Real-time detection and interruption of broadcasts, voice channels and video that carry self-harm, suicide or extreme violence, with automatic activation of emotional support.
• Age verification with accuracy proportionate to the risk and explicitly independent of app stores and operating systems, going beyond self-declaration — which Article 2(VII) of the regulations classifies as lacking evidence of truthfulness. For NSFW channels, self-declaration would be expressly prohibited.
• Mandatory linking of accounts belonging to minors under 16 to a legal guardian's account, with access suspended when there are well-founded indications.
• Invitation restrictions: accounts less than 120 days old, repeat-offender accounts and accounts associated with removed servers could not create or distribute invitation links to private servers, with tracking of the origin of invitations that result in minors joining.
• Trust & Safety teams proficient in Portuguese, in numbers proportionate to the Brazilian user base.

Three technical tensions stand out. First, real-time detection in voice and video channels implies inspection of content in transit, with significant computing costs and privacy implications that the complaint does not address. Second, court-ordered device fingerprinting sits uneasily with the LGPD's necessity principle: the complaint seeks expanded collection of signals while, in the same section, invoking privacy protection. Third, hash-based replication works reasonably well for identical files and degrades quickly in the face of re-encoding, cropping or rewrapping — a problem familiar from any content matching implementation.

The case is the first major litigation to test ECA Digital as the basis for an obligation to act, rather than merely as a statement of principles. Three fronts are worth watching: whether the court grants the measures inaudita altera pars; how the defense develops the technical impossibility argument, especially regarding real-time detection; and whether the methodology for calculating collective damages survives the first ruling on the merits. There is also a parallel public civil action before the TJMG (1145542-15.2026.8.13.0024), putting jurisdiction at issue — the complaint already anticipates this by invoking Article 93(II) of the CDC, STF Theme 1075 and STJ Precedent 489.

---

Source: initial complaint by the Union against Discord Inc., signed on August 25, 2026. Coverage at Consultor Jurídico.