September 17, 2026. Brazil looks hard on paper. The LGPD is modelled on the GDPR, fines reach R$50 million, and most write ups tell you to collect consent first. The statute does not say that, and the enforcement record points somewhere more specific: Brazil's first ever LGPD fine was issued over a contact list.
Brazil has no anti-spam statute
The words spam, e-mail and marketing appear zero times in the LGPD, zero times in the Marco Civil da Internet and zero times in the Consumer Defence Code. Decreto 11.034/2022 governs inbound customer service and says expressly that it does not apply to the offer of products and services.
The only instrument specifying email marketing mechanics is CAPEM, a self regulatory code signed by fourteen Brazilian industry bodies in 2009. It requires removal within two business days of an unsubscribe click, your own sending domain, SPF on the return path, and reverse DNS matching forward DNS. It is not law, its worst sanction is a recommendation that members block your domain, and its own website is now dead. Treat it as a deliverability standard, not a legal one.
Legitimate interest is available, with work
Article 7 lists ten legal bases with no hierarchy between them. Consent is item I. Legitimate interest is item IX, permitting processing "when necessary to serve the legitimate interests of the controller or of a third party, except where the fundamental rights and freedoms of the data subject which require protection of personal data prevail."
Article 10 names the hook for marketing directly, allowing legitimate interest for the support and promotion of the controller's activities, but attaches two conditions. Only data strictly necessary for the purpose may be processed, tighter than ordinary minimisation, and the regulator may request a data protection impact report wherever processing rests on legitimate interest. ANPD's guidance prescribes a three phase balancing test and puts the burden of proof on the controller.
Two further points a European sender tends to get wrong. Article 3 reaches you with no Brazilian establishment at all, because it applies wherever processing has as its purpose the offer of goods or services to people in Brazil. And Article 18 has no unconditional marketing opt out: the objection right applies only where the Law has been breached, which is narrower than the GDPR's absolute right to object to direct marketing.
The first LGPD fine was a contact list
In July 2023 ANPD issued its first fine under the LGPD: R$14,400 against Telekall Infoservice, a micro enterprise. The case began with a complaint that the company was offering a list of voters' WhatsApp contacts for distributing campaign material in the 2020 municipal election in Ubatuba, Sao Paulo. The structure matters more than the amount:
- R$7,200 for having no legal basis for the processing, under Article 7.
- R$7,200 for failing to respond to ANPD's requests.
- A warning for not appointing a data protection officer, under Article 41.
- Each infraction capped at 2% of gross revenue because the company was a micro enterprise, under Article 52, II.
Three years later, Article 7 is also the core of ANPD's largest fine to date, R$153.7 million against ByteDance over TikTok, published on 25 August 2026 across five separate violations. The bookends of Brazilian enforcement are both "you had no legal basis," which is precisely the hole a bought or scraped list creates. Note what five violations do to the arithmetic: the R$50 million ceiling in Article 52 is per infraction, not per case.
What it means for operators
Cold email into Brazil is lawful, and the work is front loaded. Pick Article 7, IX before the first send, write the balancing test down, and keep the record thin enough to survive the strictly necessary standard in Article 10. ANPD's only published example of promotional email under legitimate interest rests on a prior relationship, so a genuinely cold list is the harder case and the documentation is what carries it.
The other half is deliverability, and the dormant code is still the best checklist anyone has published: your own sending domain, SPF aligned on the return path, matching forward and reverse DNS, a working abuse address, and unsubscribes honoured in two business days rather than ten. That is an infrastructure job, and what our email infrastructure service sets up. If the list is the weak point, that sits with lead generation.
Frequently Asked Questions
Yes. Brazil has no anti-spam statute, and the LGPD lists ten legal bases with no hierarchy. Article 7, IX allows processing on legitimate interest, and Article 10 names the support and promotion of the controller's activities as a legitimate purpose.
Not necessarily. Consent is one of ten bases, not the default. Legitimate interest is available, but Article 10 limits you to data strictly necessary for the purpose and ANPD can demand a data protection impact report, so the balancing test needs to be documented before the first send.
Yes. Article 3 applies regardless of the country of your headquarters wherever the processing has as its purpose the offer of goods or services to people located in Brazil, or where the data was collected in Brazil. A work email address is personal data and there is no B2B carve-out.
Article 52 caps a simple fine at 2% of Brazilian revenue, up to R$50 million per infraction rather than per case. In practice ANPD's first fine was R$14,400 against a micro enterprise in July 2023, and its largest to date is R$153.7 million against ByteDance in August 2026 across five violations.