The framework
Brazil regulates personal data through the Lei Geral de Proteção de Dados (LGPD), dating from 2018 and supervised by the ANPD.
For advertisers the consent posture matters most, and Brazil sits in the opt-in bloc, where tracking and outreach need permission up front.
Key instruments
LGPD (Law 13.709/2018)
Comprehensive law: ten legal bases, sensitive data rules, data subject rights, DPO requirement, breach notification, ANPD enforcement with turnover-based fines.
ANPD International Transfer Regulation
Created the Brazilian transfer toolkit: standard contractual clauses (with a fixed adaptation deadline that passed in August 2025), equivalence recognition for foreign clauses, adequacy decisions and global corporate rules.
ECA Digital (Law 15.211/2025)
Online protection statute for children and adolescents: age assurance, parental supervision tools and a ban on profiling-based advertising to minors, enforced by the ANPD with fines up to 10% of Brazilian group revenue, capped at R$50M per infraction.
Marketing and advertising
Ten legal bases including legitimate interests, but consent is expected for cookies and most adtech, and the ANPD's guidance pushes granular banners. Most channel decisions here follow from that consent rule.
Cross-border transfers
ANPD's 2024 transfer regulation created Brazilian SCCs (adaptation deadline passed August 2025), adequacy decisions and BCR-style mechanisms.
Enforcement and penalties
Up to 2% of Brazil revenue, capped at R$50M per violation; daily fines and processing bans available.