Thousands of Brazilian business deals close every day over WhatsApp — a voice note, a "confirmed," a PDF photo sent from someone's phone. The question lawyers have debated for years got a clearer answer in 2026: a WhatsApp-facilitated agreement can be legally valid in Brazil. Whether it survives a challenge depends almost entirely on the quality of your evidence.
Brazil's two-track signature system
Medida Provisória 2.200-2/2001 created ICP-Brasil, Brazil's public key infrastructure managed by the ITI. A document signed with an ICP-Brasil certificate (A1 through A4) carries a legal presumption of validity — courts accept it on its face.
Law 14.063/2020 formalized what courts had already been deciding case by case: electronic signatures without an ICP-Brasil certificate are still valid for private-sector transactions. The catch is that without the presumption, the burden of proof falls on you. If the counterparty disputes the agreement, you must demonstrate authenticity, integrity, and non-repudiation.
What the STJ ruled in early 2026
In a cluster of Q1 2026 decisions, the STJ reinforced a consistent line of jurisprudence: the absence of an ICP-Brasil certificate does not invalidate a contract. What determines validity is the totality of evidence proving that an identifiable person agreed to a specific, unaltered document.
The standard that emerged from those decisions requires:
- A timestamp tied to a certified time authority — not the device clock
- IP address and geolocation at the moment of signing
- A document hash recorded at the time of signing (any post-signature alteration produces a different hash)
- A verifiable chain of custody showing how the document was transmitted and accessed
- Identity verification linked to a government-issued credential where possible
A WhatsApp screenshot provides none of these reliably.
Why WhatsApp alone doesn't hold up
WhatsApp is end-to-end encrypted — a privacy feature and an evidentiary liability. The platform retains no metadata that courts can subpoena to verify message authenticity. Backup files can be manipulated before being submitted as evidence. Phone number ownership does not equal identity.
In several cases reviewed by the STJ, the central problem wasn't that the parties used an electronic signature — it was the absence of any independent record of the signing event. The entire evidentiary chain depended on one party's word against another's.
What "extra proof" means in practice
The 2026 jurisprudence crystallizes what Law 14.063/2020 always implied: non-ICP-Brasil signatures need a documented, independently verifiable record to survive a contested dispute. A robust evidentiary record should contain:
| Evidence element | Why it matters |
|---|---|
| Verified email + access log | Links the signing event to a specific person's credential |
| Timestamp from a certified authority | Proves when the document was signed, not when a screenshot was taken |
| SHA-256 document hash | Any alteration produces a different hash — fraud becomes mathematically detectable |
| IP address + geolocation at signing | Creates a second layer of identity corroboration |
| Device fingerprint | Ties the signing to a specific hardware profile |
| Immutable, downloadable audit log | Provides the chain of custody courts look for under art. 10, §2 of MP 2.200-2 |
| Notification to all parties at signing | Starts the clock on any future dispute — no one can claim ignorance |
Where DottSign fits in
DottSign was built around this evidentiary problem. Every document signed through the platform automatically generates a tamper-evident audit trail capturing each element above — no extra steps, no specialist knowledge required.
The trail is sealed with a cryptographic hash at the moment of signing, exportable as a PDF, and linked to signer identity verification: email link, CPF validation, or facial biometrics depending on the security level required. When a counterparty claims they never signed, you have an independent, cryptographically sealed record of every action, timestamp, and identity token — not a screenshot.
Under the 2026 STJ standard, that's the difference between a contract that survives challenge and one that doesn't.
When ICP-Brasil is still required
Law 14.063/2020 keeps the ICP-Brasil certificate as a hard requirement for interactions with the federal public administration, notarial acts, and certain financial instruments. For the vast majority of private-sector contracts — service agreements, NDAs, employment amendments, commercial contracts — ICP-Brasil is sufficient but not mandatory.
For those cases, an electronic signature with a full audit trail meets the reinforced-evidence standard and is dramatically faster and cheaper than issuing ICP-Brasil certificates to every counterparty.
This post is informational and does not constitute legal advice. For guidance on specific transactions, consult a qualified Brazilian attorney.