Email marketing in Brazil can be a growth engine. It can also be a banana peel. One wrong step, and your campaign slips into legal trouble. The main rulebook is the Lei Geral de Proteção de Dados, or LGPD. It controls how businesses collect, use, store, and share personal data, including email addresses.
TLDR: Under Brazil’s LGPD, you need a valid legal basis to send marketing emails. Consent is useful, but it is not the only option. Purchased email lists are risky because you must prove the data was collected and shared legally. Always be clear, keep records, offer easy opt-outs, and respect people’s choices fast.
What Makes an Email “Personal Data”?
An email address can identify a person. So it is personal data under the LGPD.
This includes:
- Work emails, like maria@company.com.
- Personal emails, like joao@gmail.com.
- Emails linked to customer profiles.
- Emails connected to buying habits.
- Emails inside a lead list or CRM.
If you use an email address to promote products, send newsletters, or run lead nurturing campaigns, the LGPD likely applies.
Even if your company is outside Brazil, the LGPD may still apply. If you offer goods or services to people in Brazil, or process data collected in Brazil, you are in the game.
The Big Idea: You Need a Legal Basis
The LGPD does not say, “Email marketing is banned.” It says, “Use personal data only when you have a legal basis.”
Think of a legal basis as your permission slip. Without it, your marketing train should not leave the station.
For email marketing, the two most common legal bases are:
- Consent.
- Legitimate interest.
Consent is the famous one. But legitimate interest can also work in some cases. The catch is that you must use it carefully.
Consent Under the LGPD
Consent under the LGPD must be clear. It must be informed. It must be specific. It must be freely given.
In plain language, the person should know what they are signing up for.
A good consent message says:
- Who is collecting the email.
- What emails will be sent.
- Why the emails will be sent.
- How often emails may arrive.
- How the person can unsubscribe.
For example:
“I agree to receive weekly promotional emails from Sunny Shoes about discounts, new products, and events. I can unsubscribe at any time.”
That is much better than:
“Submit.”
Or the classic scary checkbox:
“I agree to everything forever.”
No. Do not do that. That checkbox belongs in a haunted museum.
Can Consent Be Pre-Ticked?
Do not use pre-ticked boxes for email marketing consent.
A pre-ticked box is weak. It does not show a real, active choice. The person may not even notice it.
Use an empty checkbox instead. Let the user choose. Make the wording simple.
Good example:
- ☐ Yes, I want to receive marketing emails from this company.
Bad example:
- ☑ Yes, send me marketing emails, partner emails, surprise emails, and maybe a carrier pigeon.
Keep Proof of Consent
Under the LGPD, saying “they opted in” is not enough. You should be able to prove it.
Keep records such as:
- Date and time of consent.
- Source of consent.
- Exact wording shown to the person.
- IP address, if appropriate.
- Form or landing page used.
- Privacy notice version.
This is your consent receipt. It is like a seatbelt. You hope you never need it. But you will be glad it exists if there is a complaint.
What About Legitimate Interest?
Legitimate interest can sometimes support email marketing. But it is not a magic wand.
You need to balance your business interest against the person’s rights and expectations.
Ask yourself:
- Does the person expect to hear from us?
- Do we have a prior relationship?
- Is the message relevant?
- Is the data use low risk?
- Can the person easily opt out?
For example, sending a product update to an existing customer may be easier to justify. Sending random ads to people who never heard of you is much harder.
If you use legitimate interest, document your reasoning. Many companies create a Legitimate Interest Assessment. Fancy name. Simple purpose. It shows you thought before you clicked send.
The Golden Rule: Make Opt-Out Easy
Every marketing email should include an easy unsubscribe option.
Make it visible. Make it simple. Make it work.
Do not force people to log in. Do not ask them to answer a survey first. Do not make them solve a puzzle like a temple door in an adventure movie.
A good unsubscribe link says:
“Unsubscribe from marketing emails.”
Once someone opts out, stop sending marketing emails quickly. Keep a suppression list so you do not accidentally add them again.
Purchased Email Lists: The Spicy Part
Purchased lists are where things get messy.
Buying a list may seem fast. It may seem cheap. It may look like a giant shortcut. But shortcuts sometimes lead to crocodiles.
Under the LGPD, you are responsible for how you use the data. If you buy a list, you must make sure the seller collected and shared it legally.
You should ask:
- Where did the emails come from?
- Did people consent to receive third-party marketing?
- Did the consent name your company or type of company?
- Was the privacy notice clear?
- Can the seller provide proof?
- Were opt-outs respected?
- Is the data accurate and current?
If the seller cannot answer clearly, walk away.
“Trust us, bro” is not a compliance document.
Can You Use Purchased Lists With Consent?
Maybe. But the bar is high.
For consent to support a purchased list, the original consent must cover the sharing and marketing use.
The person should have known that:
- Their email could be shared with other companies.
- Those companies could send marketing messages.
- The type of marketing was clear.
- They could refuse or withdraw consent.
Generic wording is risky.
Bad example:
“We may share your data with selected partners.”
Better example:
“We may share your email with travel companies so they can send you promotional offers. You may withdraw consent at any time.”
Even better is when the recipient directly opts in to receive emails from your brand. That is cleaner. It is also better for trust.
Can You Use Purchased Lists With Legitimate Interest?
This is usually difficult.
Why? Because the person may not expect your email. There may be no relationship. The message may feel intrusive.
Legitimate interest needs balance. Purchased cold lists often tip the scale the wrong way.
If you still want to explore it, be careful. Do a written assessment. Check the source. Send only relevant messages. Use minimal data. Add a clear opt-out. And be ready to explain why your interest does not override the person’s rights.
In many cases, a purchased list is not worth the risk. It can hurt deliverability too. People may mark your emails as spam. Mailbox providers may punish your domain. Your shiny campaign can become a soggy sandwich.
What Due Diligence Should You Do Before Buying a List?
If you are considering a list provider, do not just ask for the price. Ask for proof.
Use this checklist:
- Source: How was the data collected?
- Legal basis: What legal basis was used?
- Consent proof: Can they show records?
- Notice: What privacy notice did users see?
- Sharing: Did users agree to third-party sharing?
- Age: How old is the data?
- Opt-outs: Were unsubscribe requests removed?
- Contract: Are LGPD duties included?
- Security: How is the data protected?
- Audit rights: Can you verify their claims?
Put this in writing. Save the answers. If the provider gets nervous, that tells you something.
Your Privacy Notice Must Be Clear
Your privacy notice should explain your email marketing practices.
Include:
- What data you collect.
- Why you use it.
- Which legal bases you rely on.
- Who you share data with.
- How long you keep data.
- How people can exercise their rights.
- How they can contact your data protection officer or privacy contact.
Keep the language simple. People should not need a law degree and three coffees to understand it.
Remember Data Subject Rights
People in Brazil have rights under the LGPD.
They may ask to:
- Confirm if you process their data.
- Access their data.
- Correct incomplete or outdated data.
- Delete unnecessary or unlawful data.
- Withdraw consent.
- Know who you shared data with.
- Object to certain processing.
You need a process to respond. Not someday. Not when the moon is full. A real process.
What Happens If You Ignore the LGPD?
The Brazilian data protection authority is called the ANPD. It can investigate and apply sanctions.
Possible consequences include:
- Warnings.
- Fines.
- Public disclosure of violations.
- Blocking of personal data use.
- Deletion of personal data.
- Reputation damage.
Fines can be significant. But reputation damage can be worse. Nobody wants to be known as “that company that spams everyone.”
Best Practices for LGPD-Friendly Email Marketing
Here is the happy path.
- Use clear opt-in forms. Say what people will receive.
- Avoid pre-ticked boxes. Let people choose.
- Keep consent records. Store proof safely.
- Segment your emails. Send relevant messages.
- Use double opt-in when possible. It creates stronger proof.
- Add easy unsubscribe links. Put them in every marketing email.
- Honor opt-outs fast. Do not keep poking people.
- Review vendors. Your email platform and list providers matter.
- Protect the data. Use access controls and security measures.
- Clean your lists. Remove old, invalid, or inactive contacts.
A Simple Compliance Plan
Want a simple action plan? Try this.
- Map your email sources. Know where every contact came from.
- Label the legal basis. Consent, legitimate interest, or another basis.
- Check your forms. Make the wording clear.
- Update your privacy notice. Explain marketing uses.
- Build an opt-out system. Test it often.
- Review purchased lists. Demand proof or reject them.
- Train your team. Marketing and sales must know the rules.
- Keep records. Documentation is your friend.
Final Thoughts
LGPD email marketing compliance is not about killing fun. It is about respecting people. It is about being clear. It is about sending emails that people actually want.
Consent is powerful when it is real. Legitimate interest may help when expectations are fair. Purchased lists, however, are a red flag with fireworks attached. Use them only with serious due diligence, strong proof, and a very good reason.
The best email list is not the biggest list. It is the cleanest list. It is the list of people who know you, trust you, and want your messages. Build that list, and your marketing will be safer, kinder, and much more effective.
