Brazil — LGPD for Email Marketing

Brazil has no dedicated anti-spam statute. Email marketing to Brazilian recipients is governed by the Lei Geral de Proteção de Dados (LGPD, Lei nº 13.709/2018) — a GDPR-style law — enforced by the ANPD (renamed from Autoridade to Agência Nacional de Proteção de Dados by MP 1.317/2025 and Lei 15.352/2026, gaining regulatory-agency status). Unlike CASL/PECR/Spam Act there is no per-message opt-in rule; instead every processing of an email address (a piece of personal data, Art. 5 I) needs a legal basis, transparency, and respect for data-subject rights. Sources read in the Portuguese originals.

Legal bases for marketing (Art. 7)

Art. 7 lists ten bases; the two that matter for marketing are:

Basis	Text	Marketing implications
Consent (Art. 7 I)	Free, informed, unambiguous manifestation for a determined purpose (Art. 5 XII)	Written or otherwise demonstrable (Art. 8); if written, in a clause highlighted from other contract terms (Art. 8 §1); generic authorisations are void (Art. 8 §4); controller bears the burden of proof (Art. 8 §2); revocable at any time by a free and facilitated procedure (Art. 8 §5). Sharing with other controllers requires specific consent (Art. 7 §5) — a purchased list needs consent naming the buyer.
Legitimate interest (Art. 7 IX)	Processing necessary to attend legitimate interests of controller or third party, except where the data subject's fundamental rights and freedoms prevail	Art. 10 expressly names "support and promotion of the controller's activities" (Art. 10 I) as a candidate legitimate purpose — the hook for first-party marketing. Conditions: only data strictly necessary (Art. 10 §1), transparency measures (Art. 10 §2), and the ANPD may demand a data-protection impact report (RIPD, Art. 10 §3).

Other bases (contract performance, legal obligation, credit protection…) rarely support promotional email. Public or manifestly-public data still requires purpose, good faith, and respect for the data subject's rights (Art. 7 §§3–4) — it is not a marketing free-for-all.

The ANPD legitimate-interest guide (Guia de Legítimo Interesse, Feb 2024)

The ANPD's guide sets the operating doctrine for Art. 7 IX / Art. 10:

• An interest is legitimate when it is (i) compatible with the legal order, (ii) grounded in concrete situations (not abstract/speculative), and (iii) tied to legitimate, specific and explicit purposes.
• A balancing test (teste de balanceamento) must precede reliance on legitimate interest — per specific purpose — weighing legitimacy, necessity, impacts on the data subject, and their legitimate expectations (Art. 10 II). If the test is inconclusive, or adequate safeguards can't be identified, use another legal basis.
• Legitimate-expectation factors: prior direct relationship with the controller; source and manner of collection (direct vs. third-party/public); context and timing; compatibility of the marketing purpose with the collection purpose.
• Example 5 is the marketing anchor: a private university emailing students/staff promotions for books and cultural products from its own press was accepted as legitimate interest — because there is a prior relationship, the promotion supports the controller's own activities (Art. 10 I), data is not shared with third parties, and every message carries an unsubscribe (descadastramento) mechanism as a safeguard. Translation: first-party marketing to your own customer base, with working opt-out, can rest on legitimate interest; cold email to strangers cannot (no prior relationship, no legitimate expectation).
• Third-party legitimate interest (Example 6: promoting a partner language school to employees) is possible but carries a heavier argumentative burden: prior notice, easy refusal, and a balancing test are expected.
• Legitimate interest is generally inappropriate for children's/adolescents' data used for advertising (Example 3: an educational app showing ultra-processed-food ads to children fails the test — no legitimate expectation, best-interest principle violated).
• Records duty: keep the balancing test and processing records (Art. 37 highlights records "especially when based on legitimate interest"); high-risk processing calls for a RIPD.

Data-subject rights that shape list management (Arts. 18–19)

• Confirmation of processing and access (simplified format immediately, or complete declaration within 15 days).
• Correction; anonymisation/blocking/deletion of unnecessary or non-compliant data; deletion of consent-based data (Art. 18 VI); information about sharing (Art. 18 VII); revocation of consent (Art. 18 IX); opposition to non-consent-based processing (Art. 18 §2) — an unsubscribe is, legally, a revocation/opposition and must be free of charge (Art. 18 §5).
• Upon correction/deletion/blocking, the controller must notify agents with whom it shared the data so they repeat the action (Art. 18 §6) — suppression must propagate.

Agents of treatment: controller vs. operator — where the ESP sits

Definitions (Art. 5): controlador (VI) — decides on the processing; operador (VII) — processes on behalf of the controller; together the agentes de tratamento (IX). Per the ANPD's Guia Orientativo on agents (May 2021):

• The distinguishing element is decision power: the controller sets the purpose and "essential elements" (data types, duration); the operator may decide only non-essential elements (software, technical security measures). An advertising/marketing agency running a campaign to the brand's spec is an operator; the brand is the controller (guide ¶¶10–11, Example 5).
• An ESP is an operator for its customers' lists: it must process only per the controller's instructions (Art. 39), and should contract the regime in writing (object, duration, nature/purpose, data types, responsibilities — recommended, not mandated, by the guide ¶¶53–54).
• Suboperator: a party engaged by the operator to help process for the controller (the guide's construct — e.g., the ESP's cloud/storage vendor, or a delivery subcontractor). The operator should obtain the controller's (generic or specific) formal authorisation to subcontract; the suboperator is equated to an operator vis-à-vis the ANPD (¶¶61–66, Examples 11–12).
• Joint controllership exists when two or more controllers make common or convergent decisions on purposes and essential elements (Example 5: two brands sharing customer bases for a co-branded campaign are joint controllers; their marketing agency remains operator). Liability of directly-involved controllers is solidary (Art. 42 §1 II).
• Liability (Art. 42): controller or operator causing damage must repair it. The operator answers solidarily — equated to the controller — when it breaches the LGPD's obligations or fails to follow the controller's lawful instructions (Art. 42 §1 I). Courts may reverse the burden of proof in the data subject's favour (Art. 42 §2). Practical ESP consequence: sending beyond the customer's instructions (or ignoring suppression) converts the ESP into a co-liable controller-equivalent.
• Both agents must keep records of processing operations (Art. 37). The controller (and operator) must appoint an encarregado (DPO, Art. 41) with published contact details; the ANPD may waive it for small agents (Resolução CD/ANPD 2/2022 also classes use of children's data as "high risk" even for small agents).

International transfers (Arts. 33–36, Resolução CD/ANPD nº 19/2024)

Art. 33 permits transfers to: (I) countries/organisations with an adequate level of protection; (II) controller-provided guarantees — specific contractual clauses, standard contractual clauses (SCCs), global corporate norms, seals/certificates/codes of conduct; (V) ANPD authorisation; (VIII) specific and highlighted consent with prior information on the international character of the operation; plus narrow public-interest/vital-interest/legal-obligation cases (IX).

Current state per the ANPD international-affairs page (fetched Jul 2026):

• Regulation: Resolução CD/ANPD nº 19 of 23 Aug 2024 approved the transfer regulation including Brazilian SCCs, with a 12-month deadline from publication to incorporate the SCCs into existing contracts (i.e., by Aug 2025).
• Adequacy decisions: European Union recognised as adequate by the ANPD (Resolução CD/ANPD nº 32 of 26 Jan 2026). None other listed. This is distinct from the transfer regulation above: Resolução 19/2024 is the domestic transfer framework (Brazilian SCCs); Resolução 32/2026 is the ANPD's inbound-adequacy recognition of the EU. It is the Brazilian half of a mutual recognition — on the same date (26 Jan 2026) the European Commission adopted its own Art. 45 adequacy decision for Brazil (Implementing Decision (EU) 2026/179), so EU↔Brazil transfers now flow both ways without SCCs (see ESP Processor Obligations).
• Equivalent foreign SCCs, specific clauses, BCRs (global corporate norms): mechanism exists but none approved to date; requests go through the ANPD's SEI system.
• ESP consequence: a non-Brazilian ESP processing Brazilian lists abroad should have the Brazilian SCCs in its DPA with Brazilian customers (or fit another Art. 33 mechanism).

Children and adolescents (Art. 14 + ANPD interpretation)

• Art. 14: processing of children's/adolescents' data must serve their best interest. Art. 14 §1 requires specific, highlighted consent by at least one parent/legal guardian for children's data; the controller must make reasonable efforts to verify the consenting adult (§5), must not condition participation in games/apps on excess data (§4), and must publish what it collects and how (§2). Collection without consent is allowed only to contact the parents (single use, no storage) or to protect the child (§3) — never onward transfer (§3).
• The assigned ANPD PDF is the 2022 normative process (Nota Técnica nº 34/2022/CGN + Estudo Preliminar) that examined whether parental consent is the only basis. Its conclusion — interpretation 3 — became Enunciado CD/ANPD nº 1 (22 May 2023): children's/adolescents' data may be processed on any Art. 7 (or Art. 11 for sensitive data) legal basis, provided the best interest of the child prevails, assessed case by case under Art. 14 caput.
• But per the legitimate-interest guide, advertising to children on a legitimate-interest basis will normally fail the balancing test; children's-data processing is a designated high-risk criterion requiring a RIPD. For email marketing: treat under-18 lists as requiring parental consent in practice.

Sanctions (Art. 52)

Applied by the ANPD after administrative proceedings, gradually, singly or cumulatively:

Sanction	Detail
Warning	With deadline for corrective measures
Fine	Up to 2% of the private entity's/group's revenue in Brazil in the last fiscal year (net of taxes), capped at R$ 50,000,000 per infraction
Daily fine	Within the same R$50M cap
Publicising the infraction	After confirmation
Blocking / deletion	Of the personal data involved
Partial suspension of the database	Up to 6 months, extendable once
Suspension of the processing activity	Up to 6 months, extendable once
Partial or total prohibition of data-processing activities	Most severe; suspension/prohibition only after a prior fine/blocking/deletion sanction for the same case (§6)

Dosimetry factors (§1) include gravity, good faith, advantage obtained, economic condition, recidivism, degree of damage, cooperation, adoption of good-practice/governance policies, and prompt correction. Civil liability (Art. 42) and consumer-law sanctions apply in parallel (§2).

ESP checklist for Brazilian traffic

• Map each list to a legal basis: consent records (who/when/how, purpose-specific) or a documented legitimate-interest balancing test with prior-relationship evidence.
• Ship a working, free unsubscribe in every message — it is both the Art. 8 §5 revocation route and the safeguard the ANPD's own marketing example relies on.
• Propagate suppression/deletion to all sharing partners (Art. 18 §6) and answer access requests within 15 days.
• Contract as operator: written DPA, instruction-bound processing, controller authorisation for subprocessors, Brazilian SCCs for offshore processing.
• Refuse third-party lists without purchaser-specific consent (Art. 7 §5).

Not legal advice — see compliance/README.md. Cross-jurisdiction consent comparison: CASL, UK PECR, Australia.