The framework
Costa Rica regulates personal data through Law 8968 on Protection of the Person Regarding Processing of Personal Data, dating from 2011 and supervised by the PRODHAB.
For advertisers the consent posture matters most, and Costa Rica sits in the opt-in bloc, where tracking and outreach need permission up front.
Key instruments
Law 8968 on Protection of the Person Regarding Processing of Personal Data
A 2011 express-consent law with an operating agency (PRODHAB); a modernization bill has circulated for years without passage.
Marketing and advertising
Express consent is the general rule, with database registration duties. Most channel decisions here follow from that consent rule.
Cross-border transfers
Transfers abroad rest mainly on the individual's consent. Foreign laws with extraterritorial reach, the GDPR above all, can still govern data about residents here whenever a controller abroad is involved.
Enforcement and penalties
Fines reach about USD 20,000, plus registry sanctions. A ceiling means little until the authority uses it, so its docket is the better guide.