The framework
Law 21.719 (2024) is on the books in Chile without yet being fully enforceable, a gap between enactment and operation that defines the current compliance picture.
For advertisers the consent posture matters most, and Chile sits in the opt-in bloc, where tracking and outreach need permission up front.
Key instruments
Law 21.719 (2024), replacing Law 19.628 (1999)
Chile's new law has a legal start date of 1 December 2026, and it may slip. Law 21.719, published December 2024, replaces a 1999 law that had no regulator and no real fines, bringing a data protection agency, turnover-linked penalties and EU-style legal bases. The agency's board has not been appointed after the Senate rejected the nominees, and on 1 September 2026 the government filed an urgent bill to move the start to 1 December 2027 and enlarge the board to five members. Plan for December 2026 until Congress decides.
Marketing and advertising
GDPR-modeled: consent or another legal basis including legitimate interests, with sensitive-data and children's rules; the outgoing 1999 law was consent-based but toothless. Most channel decisions here follow from that consent rule.
Cross-border transfers
Adequacy decisions, safeguards and derogations on the GDPR pattern.
Enforcement and penalties
Up to UTM-denominated fines reaching roughly USD 1.5M, and up to 4% of annual revenue for repeated grave violations.