According to news reports, Brazil is pushing forward with its Fair Competition Act for Digital Markets, Bill 4675 on an expedited timeline, with the new presidential administration seeking a vote in the National Congress as soon as next week. The new rush to get this through appears to be in response to a desire to hold “big tech” accountable for accusations of political interference in the elections earlier this year. 

However, this regulatory hammer is aimed at the wrong nail. The bill would not only fail to address the concerns that the government claims it is seeking to address, but paradoxically create more opportunity and access to personal and private information – enabling actors to exploit personal data and expand Brazilian harm. 

A Renewed Impetus for Legislation

After President Lula’s historic re-election he has made technology regulation a priority, even including it as a main point in his victory speech. Of particular concern are charges that social media platforms manipulated algorithms to help Lula’s rival Flavio Bolsonaro. As Tatiana Diaz at Tech Policy Press reports, there was an explosion of complaints that the large platforms — with allegations focused on  Meta, which runs the WhatsApp and Instagram services, Brazilians’ most popular communication channels — were interfering in the election.” This included accusations that profiles were censored, content was removed, and pages were restricted. Lula’s own profile dealt with restrictions and failures that negatively affected his reach on the platforms. Meta has categorically denied political interference claiming it does not favor one candidate over another. 

This combination of events has led to new urgency to pass some form of legislation before the new, more conservative Congress is seated in January. We take no view about the facts as alleged, only outline what the impetus for taking action is, and the concern that the proposed legislation will predictably lead to less privacy and security and control for Brazilian citizens. 

A Misguided Approach

The accusations of political interference of course should be taken seriously. However, the proposed legislation of the Fair Competition Act for Digital Markets is not the proper vehicle to address it. 

The bill amends existing competition law to regulate digital markets under the purview of the Administrative Council for Economic Defense (CADE). It is largely modeled on the European Union’s Digital Markets Act (DMA) and introduces ex ante provisions which do not address content moderation issues like those at the heart of the accusations of election interference in this year’s election.

Trusted Future has been closely studying the real world implications of Europe’s Digital Markets Act and similar bills around the world. We released a comprehensive analysis, Failed Experiment exploring the DMA’s vast unintended consequences, and found these policies that aim to promote competition in the digital ecosystem, have foundational mistakes with long-lasting impacts. We’ve seen the direct consequences of DMA-like models that include weakening security, creating a less safe app store ecosystem, and even inhibiting competition and opportunities to advance a more dynamic, vibrant, innovative, and trustworthy ecosystem that can lift its economy and propel new competition. 

The impacts are felt across the board: 

• Consumers face increased security risks; 
• Businesses face an unfriendly regulatory environment, spending their tech resources on compliance;
• The country is left with less innovation, fewer and delayed features, and – ironically – less consumer choice.

In fact, in places where similar legislation has been enacted, the very same social media companies that the Brazilian government is trying to hold accountable have used this kind of digital market provisions to gain access to an even broader universe of personal and sensitive information from other digital ecosystem players. Such proposed changes can lead to the vacuuming up of even more personal data. 

In Europe, where the DMA is in effect, the mandatory smartphone interoperability requirements have resulted in an explosion of requests from social media companies like Meta for interoperability to a broad range of especially sensitive data. Meta has a long history of abuse of these smartphone permissions. For example, a CyberNews analysis found that some apps, META’s Whatapp, requested a broad range of permissions that go far beyond the minimum amount to enable the apps to function. This means apps can also access data for wide-ranging purposes, for example Meta rolled out a new feature based on access to a phone’s camera roll to automatically send all of the photos to its servers, use its facial recognition software, and train its AI models. The European Commission’s enforcement of the DMA’s smartphone interoperability rules made these permissions even more broadly allowable, without limit. 

Meta is now attempting to use these DMA’s smartphone interoperability provisions to gain access to a broad range of previously protected private information. For example they are using the law’s interoperability provisions in an effort to obtain access to third-party wearable device information including “interactive messaging, background transfers, file transfers and complication updates” and to gain access to your phone’s locked screen to obtain displayed content including “directions, incoming calls, messages, music playback”, and more. Access to this type of private information will only energize social media’s information-driven business models – not hold them accountable.  

Similarly, Google reports that frequently abused permissions, like enabling an app to read and send SMS messages or to access powerful accessibility features, are commonly used by fraudsters to intercept one-time passwords, spy on screen content to access login credentials, or see other sensitive and exploitable information. Based on Google’s analysis, over 95 percent of installations that abuse sensitive permissions came from Internet-sideloading sources, which the DMA mandated to be permitted on all devices. 

Don’t Rush Something This Important 

We are concerned that the Brazilian government is attempting to fast-track complex digital market legislation without fully considering or addressing the complex threats it creates for user privacy and security – and the impacts it has in fueling social media information enabled business models. Trusted Future has previously highlighted how the urgency of Brazil’s approach to bypass the usual committee process is incompatible with the complexity of the issues, and the critical privacy and security safeguards that Brazil needs to protect. It is a complicated piece of legislation that implicates some of the most sophisticated technologies on the planet.  And as we’ve seen elsewhere, this approach contains foundational flaws with long-lasting impacts. The European experience demonstrates that there are vast unintended consequences that can accompany this approach – especially as it relates to the privacy and security of technologies that Brazilians depend upon every day to run their businesses, protect critical infrastructure, and protect their families.

While we appreciate the government’s desire to address the concerns over election interference, the Fair Competition Act for Digital Markets will not make progress in that direction. In fact it will only make it worse. Brazil’s vibrant digital economy deserves an open, fact-based debate to assess the impact of any new digital market regulation on consumers, investment, and innovation – not a rushed process with harmful unintended consequences.