LGPD and digital marketing: what you can and can’t do

Your company has a spreadsheet with 40,000 contacts. Half came from the website, a quarter from events, and nobody is quite sure about the rest: someone imported them from a partner back in 2022. On Friday, the team wants to upload the whole thing as a Meta custom audience and blast a WhatsApp campaign. Is that allowed?

Short answer: some of it is, some of it is not, and the difference lies in where each row came from. Brazil’s data protection law, the LGPD, does not ban digital marketing. It bans using personal data without a legal justification and without the person being able to understand what is happening to it.

LGPD and digital marketing in one sentence: you may collect and use customer and lead data for marketing as long as you have a legal basis (consent, legitimate interest or performance of a contract), a purpose disclosed at the moment of collection, an easy way for the person to opt out, and the ability to prove all of this if challenged.

The rest of this article translates that into the daily routine of people who run campaigns. It is not legal advice: for sensitive data or large volumes, check with your lawyer or DPO.

Why is the LGPD back on the marketing agenda in 2026?

For a few years, the law felt remote to media teams. Enforcement was slow, and the few sanctions hit public bodies or small firms. That has changed.

In February 2026, Law 15,352/2026 turned the ANPD into Brazil’s National Data Protection Agency, with financial and decision-making autonomy and 200 new permanent positions. In August came the first heavyweight signal: the ANPD fined TikTok R$153.7 million (roughly US$28 million) for processing children’s and teenagers’ data without a valid legal basis and without being able to demonstrate compliance.

Look at the grounds for the fine. It was not a data breach. It was a missing legal basis and missing proof. Those are exactly the two places where marketing tends to trip.

There is a commercial side too. In TransUnion’s fraud trends report published in 2026, based on 1,000 Brazilians surveyed in late 2025, 52% named data protection as their top criterion when choosing a company for digital transactions, ahead of price and delivery time. Privacy has become a selling point.

The three legal bases marketing actually uses

The LGPD lists ten grounds for processing personal data. In practice, marketers live in three of them. Picking the wrong one is the most common mistake, and the most expensive.

Legal basis	When it applies	Marketing example	Main caveat
Consent	The person freely and knowingly agrees to a specific purpose	Newsletter, WhatsApp list, gated content	You need proof of opt-in, and it can be withdrawn at any time
Legitimate interest	There is a prior relationship and the use is what the person would reasonably expect	Email about a complementary product to an existing customer	Requires a documented assessment and an opt-out in every send
Performance of contract	The data is needed to deliver what was purchased	Order updates, billing, onboarding	Does not cover promotional offers. A delivered order is not a licence to promote

One rule of thumb that prevents half the problems: if the person would be surprised to get the message, you are probably outside legitimate interest and need consent.

What you can and can’t do: everyday cases

Email marketing to your customer base

Allowed under legitimate interest, as long as the content relates to what the person bought and every send has a one-click unsubscribe. A supplement store emailing whey restock reminders to whey buyers is on the right track. The same store selling its list to an insurance broker is not.

If you want to know which customers actually want to hear from you, RFM segmentation helps you send less and to the people who matter, which also cuts complaints.

Bought lists or lists “borrowed” from partners

Not allowed in almost every case. Whoever sold the list rarely has consent to pass the data on to you, and you inherit the problem. “The data is public” does not fix it either: the law requires that the use of publicly accessible data respect the purpose, good faith and public interest that justified making it available.

Here the LGPD adds to Meta’s own rules, which require opt-in for marketing messages through the official API. A customer who messaged you asking for a quote can receive the answer and the follow-up on that quote. Joining a weekly promotions list requires explicit opt-in. If you use an AI agent for customer service, the same logic applies to what it stores and what it sends.

Pixel, cookies and the Conversions API

Measurement and advertising cookies identify the browser and fall within the law’s scope. The safest pattern is a banner that makes rejecting as easy as accepting, with advertising cookies off until opt-in. When you send events server-side, the rule stays the same: the Conversions API improves signal quality but does not replace consent. If the user declined, the advertising event should not fire.

Custom audiences (Custom Audiences, Customer Match)

Uploading your customer base with hashed emails and phone numbers is processing personal data, hash or no hash. It can be supported by legitimate interest for active customers, provided your privacy policy clearly states that data may be used for advertising on third-party platforms. Cold leads of doubtful origin should stay out.

Sensitive data

Health, religion, sex life, biometrics and political opinion have their own regime. A clinic targeting ads based on appointment history, or a gym crossing fitness assessment data with campaigns, needs specific and prominent consent. Legitimate interest does not cover sensitive data.

A simplified decision tree for whether a piece of data can go into a campaign. When torn between two paths, take the stricter one.

How to organise marketing data without slowing the team down

LGPD compliance in marketing is less about law and more about operations. It depends on knowing, for each contact, where it came from, why it was collected and how long you will keep it. Companies already running well-structured first-party data get there almost for free.

In practice, four fields solve most of the problem. Add them to your CRM or lead sheet: source (website form, event, purchase), collection date, legal basis and consent status per channel (email, WhatsApp, ads). With that, filtering who can receive each campaign becomes a query, not a meeting.

A simulated example: a language school with 40,000 contacts fills in these fields and finds that 22,000 are current or former students (legitimate interest for course offers), 11,000 came from forms with recorded opt-in (consent) and 7,000 have no traceable origin. The right call is to pull those 7,000 out of every campaign. Losing 17.5% of the base hurts, but those are precisely the contacts most likely to complain, unsubscribe and report you, and the ones that convert worst.

This inventory also improves your analysis. A list without traceable origin is a list with a data quality problem, and that skews open rates, conversion and cost per lead.

Every piece of marketing data goes through five stages. The one people forget is the last: data kept with no deadline is risk with no return.

How much does getting it wrong cost?

The LGPD fine can reach 2% of the company’s revenue in Brazil, capped at R$50 million (about US$9 million) per violation. For most small and mid-sized businesses, though, the likely risk is not the maximum fine. It is a combination of three things: complaints to consumer protection bodies and the ANPD from an annoyed customer, a WhatsApp number blocked after user reports, and an order to delete a base that was expensive to build.

The law also provides for publicising the violation. For a brand that runs on trust, showing up on a list of sanctioned companies weighs more than the fine itself.

Minimum checklist for the marketing team

Every form states what the data will be used for and has the promotional opt-in box unticked by default.
Every CRM contact has source, date, legal basis and consent status per channel.
Every promotional send has a one-click unsubscribe, honoured across all tools.
The cookie banner lets people reject as easily as accept.
Bought lists and contacts with no origin stay out of campaigns.
There is a retention period for leads who never bought (for example, 24 months without interaction).
There is a clear channel for people to request access, correction or deletion of their data.

Frequently asked questions

Does the LGPD ban email marketing?

No. Email marketing is allowed with consent or, for customers with a prior relationship, under legitimate interest. Either way, every send must include a simple way to unsubscribe.

Can I buy an email or phone list?

In practice, no. Sellers rarely have a legal basis to pass the data on, and buyers are liable for how it is used. Beyond the legal risk, bought lists convert poorly and damage the reputation of your domain and WhatsApp number.

Do I need consent for cookies and pixels?

For advertising and tracking cookies, the safest answer is yes, with a banner that allows rejection. Strictly necessary cookies that keep the site working can do without opt-in, as long as they are disclosed in the policy.

Who enforces the LGPD?

The ANPD, which since 2026 has been an autonomous regulatory agency. Consumer protection bodies (Procons), public prosecutors and the courts also act when consumers are harmed.

What is the LGPD fine?

Up to 2% of revenue in Brazil, capped at R$50 million per violation, plus warnings, publicity, blocking or deletion of the data. The ANPD weighs company size, severity and good faith when setting the sanction.

Privacy is a data problem, not a legal one

A company that knows where each contact came from, what it is for and when it should leave the base is not just LGPD compliant. It also measures better, segments better and wastes less budget on audiences that were never going to buy. The work of organising data origin is the same work that separates a mature marketing operation from one that fires in the dark.

That is where Sherlok comes in: it connects Meta Ads, Google Ads, GA4, your CRM and spreadsheets, and lets you ask in plain language things like “how many leads this month came in with no traceable source?” or “which channel brings consented contacts that convert best?”, getting the analysis back ready instead of building the cross-reference by hand.