The framework
There is no comprehensive data protection statute in Timor-Leste.
With no local consent rule, platform policies and the extraterritorial reach of laws like the GDPR govern campaigns here in practice.
Marketing and advertising
No comprehensive consent requirement. With no local statute, the practical guardrails are platform policy and any foreign law that can reach the campaign.
Cross-border transfers
With no data protection law, nothing restricts personal data leaving Timor-Leste, and nothing local protects it once it has. The binding transfer rules for most campaigns touching this market come from the origin jurisdiction of the data.
Enforcement and penalties
No penalties exist under a general privacy law, because none exists. Only sectoral, criminal or consumer statutes could reach data misuse in Timor-Leste, and enforcement of those against marketing practices is rare.