Counterfeit Goods in E-commerce: Why the Manager, Not Just the Company, Can Be Held Personally Liable

E-commerce has changed so fast that most companies still haven't updated their legal risk radar at the same pace. A retail chain that today runs its own marketplace, lets third-party sellers list products on its app, and ships everything with its own brand stamped on the box and on the consumer's screen is no longer, for legal purposes, just a seller. It has become a host, inside its own digital environment, for merchandise it doesn't manufacture, doesn't physically inspect, and in many cases knows only by the supplier's name registered in the system.

Compliance departments in these operations are usually well calibrated for payment fraud, product expiration, and inventory loss. They are rarely designed to check whether the item listed under the platform's own brand actually carries a legitimate trademark itself. It's exactly in this gap that counterfeiting stops being an abstract risk buried in a compliance manual and becomes a concrete possibility, with two fronts of exposure that move together but follow different logics: one civil, falling on the company, and one criminal, falling on the manager as an individual.

The crime few managers know exists

Law 9,279/96, Brazil's Industrial Property Law, criminalizes in Article 190 the conduct of anyone who imports, exports, sells, offers, displays for sale, hides, or keeps in stock a product bearing a trademark unlawfully reproduced from a third party. Notice that the offense does not require the agent to have manufactured the counterfeit. Simply selling the counterfeit product with knowledge of that condition is enough. Scholars specializing in industrial property call this behavior indirect counterfeiting, as distinct from direct counterfeiting committed by whoever actually reproduces someone else's trademark. In practice, this means that the retailer, the marketplace, and the e-commerce operator that sell the fake product are just as liable as whoever made it, even without ever having had contact with the production line.

What sets this exposure apart from any other discussion about digital platform liability is structural: in Brazil there is no criminal liability for legal entities in crimes against industrial property, unlike what happens, for instance, in environmental crimes. Whoever answers for Article 190 of the Industrial Property Law is always an individual, typically the manager, director, or officer who had knowledge of the conduct and decision-making power over it. This shifts the risk from a patrimonial abstraction, diluted by corporate insurance and by the corporate structure, to a personal and non-transferable exposure for whoever sits in the decision-making chair.

The penalty is small, the problem isn't

The penalty set out in Article 190 is detention of one to three months or a fine, which classifies the offense as a minor offense subject to the de-penalization mechanisms of Law 9,099/95, such as plea agreements and conditional suspension of proceedings. But reducing the analysis to the severity of the sentence is a misreading. The real cost isn't in the sentence, it's in the entire path leading up to it: being personally named as a defendant in a criminal action, having inventory seized under Articles 527 to 530 of the Code of Criminal Procedure, and carrying the reputational wear that a criminal case, even a minor one, inflicts on the executive's personal image and on the brand of the company they represent.

There's also a procedural detail that changes who controls the litigation. Article 199 of the Industrial Property Law establishes that the crime under Article 190 is prosecuted upon private complaint, meaning the initiative for the criminal action does not belong to the public prosecutor's office, but to the trademark holder who was harmed. It is that holder, with its own resources and its own intellectual property legal department, who decides whether to turn an ignored notice into a criminal case against the platform's manager.

Good faith until notice, risk after it

The crime requires intent, that is, actual knowledge that the product being sold is counterfeit. Before any formal warning, the manager has a solid good-faith argument: it isn't reasonable to expect them to know, on their own, that a registered supplier is selling an unauthorized replica. The picture changes radically from the moment the trademark holder notifies the platform about the existence of the counterfeit product in its catalog. If, even after the notice, the listing stays up and the inventory keeps circulating, the failure to act dangerously approaches what criminal law doctrine calls dolo eventual (eventual intent), when the agent accepts the risk of producing the unlawful outcome even without directly wanting it.

This creates a pretty clear practical incentive for any e-commerce or marketplace company: the absence of a structured authenticity screening protocol for third-party products, combined with continuing the sale after receiving a notice, builds on its own much of the evidence the trademark holder would need to demonstrate the knowledge required by the offense. A poorly monitored notification channel, an inbox nobody answers, an internal process with no defined deadline for reviewing a counterfeiting complaint, none of that is a mere operational flaw anymore, it becomes evidence of deliberate negligence.

What Brazilian case law already suggests, even without an identical case

There is still no ruling from the Superior Court of Justice or from state courts applying Article 190 of the Industrial Property Law specifically to a marketplace or delivery app operator. It's legally unexplored territory for this type of business. But the courts have already applied equivalent reasoning to traditional retailers, and that logic tends to transfer to the digital environment without much interpretive difficulty. In a case involving a different offense, Article 273 of the Criminal Code, which deals with crimes against public health, the São Paulo Court of Appeals upheld the conviction of partners in a business who kept selling and stocking counterfeit cosmetics even after having already been cited by health inspectors. The precedent illustrates the weight the judiciary gives to continued conduct after formal notice, exactly the scenario that repeats itself when an e-commerce platform ignores a counterfeiting notice.

On the civil side, the same São Paulo court has already dismissed joint liability for a third-party manufacturer operating in a distinct market, far removed from the end consumer, while upholding the conviction solely against the company that actually sold the counterfeit product. The ruling highlighted that the Industrial Property Law admits a presumption of market knowledge for anyone operating in the same line of business as the reference brand, under Article 124, item twenty-three. An e-commerce platform or marketplace selling products in a category related to the counterfeited brand is in exactly that position: in the same line of business, closer to the end consumer than any third-party manufacturer, and without any established precedent today that would shield it from this presumption.

The company's civil liability, running alongside the manager's criminal exposure

While criminal exposure falls on the individual, civil exposure falls on the company, grounded in provisions of the Consumer Protection Code that have been in force for over three decades. Article 7, sole paragraph, establishes joint liability among all parties responsible for harming the consumer. Article 18 imposes joint liability on suppliers for product defects. And Article 34 holds the supplier liable for the acts of its independent representatives, a classification that consumer law scholars have been extending to the third-party seller operating under the trust umbrella of the host e-commerce platform's brand.

Over more than a decade of precedents, the Superior Court of Justice has built the criteria that define when a platform becomes part of the supply chain and therefore bears joint liability: when it acts as a genuine intermediary, paid by commission and actively participating in the sales operation, payment processing, and delivery organization. It does not bear liability when it functions merely as a classifieds space, without interfering in the negotiation or the logistics. An e-commerce platform that processes payment, organizes its own delivery, and delivers the end-to-end experience under its own brand can hardly escape this classification.

The regulatory movement underway in Brazil

The legislative debate has also started moving. Bill 3,001/24, currently before the Chamber of Deputies with a favorable opinion from the rapporteur in the Consumer Protection Committee, proposes express joint liability for e-commerce platforms that directly participate in sales and earn financial gain from counterfeit products. Minas Gerais's consumer protection agency, Procon, has also taken a position through a technical note on marketplaces' joint liability for defects in products sold by business partners. These movements reinforce, in practice, something the Industrial Property Law and the Consumer Protection Code have supported for years: a platform's inaction in the face of a counterfeit product tends to stop being tolerated, both by the judiciary and by lawmakers.

What this means for day-to-day management of an e-commerce platform or marketplace

For anyone managing an e-commerce operation, the practical takeaway is direct. First, the channel for receiving notices from trademark holders needs an owner, a defined response deadline, and formal record-keeping of every complaint received, because it's exactly this history that will determine, down the road, whether there was good faith or conscious omission. Second, the registration process for third-party sellers should include, from the moment they join the marketplace, some level of documentary verification of trademark authenticity, not just the tax and banking validation that today tends to be the only filter applied. Third, the absence of a screening protocol isn't just a process failure, it's a factor that weighs directly on the analysis of eventual intent if a notice ends up being ignored.

None of these measures fully eliminates the risk that a third-party seller might slip a counterfeit product into its catalog without the platform's knowledge. But the difference between a company that had a protocol and acted quickly after receiving notice and a company that had no protocol at all is, legally speaking, the difference between credibly claiming good faith and being treated as someone who accepted the risk of counterfeiting. That distinction isn't built after the problem shows up, it's built beforehand, in the operation's governance structure.

There is still no public record of a trademark counterfeiting case involving an internal marketplace or a quick delivery app that has led to a criminal case under Article 190 of the Industrial Property Law in Brazil. That shouldn't be read as a sign of calm, but rather as the warning itself. All the conditions for this to happen are already in place: mature internal marketplaces, e-commerce expanding at full speed, case law from related sectors already settled against whoever occupies the position of digital retailer, and a specific criminal statute that, to this day, has simply never been tested against a platform operator because no trademark holder has yet filed a criminal complaint on these terms. When the first case arrives, and the natural tendency of any maturing area of law is that it will, the reflection should be about how the company failed to pay close enough attention to a risk that had already been written into law for almost thirty years. Periodically reviewing contracts with third-party sellers, notification workflows, and internal brand compliance protocols tends to be, in this context, far cheaper than discovering these gaps in the middle of a lawsuit.