Quick Answer: Does the LGPD allow email, WhatsApp and remarketing?
Yes. The LGPD does not prohibit digital marketing. But every marketing operation needs an applicable legal basis and must follow principles such as purpose, adequacy, necessity, transparency, security and accountability. Consent is not automatically required for every marketing message; legitimate interest can be considered in some contexts when a concrete purpose, necessity, prior relationship or reasonable expectation, safeguards and a balancing test support it. ANPD's guidance includes a legitimate-interest example involving related promotional emails and app notifications with an unsubscribe option. By contrast, ANPD says consent will generally be more appropriate for non-essential advertising cookies and behavioral tracking, particularly third-party profiling and cross-site tracking.
Key Takeaways
- The channel does not determine the legal basis. Email, WhatsApp, SMS, CRM and app notifications still require a purpose-by-purpose LGPD analysis.
- Consent is not mandatory for every marketing activity. Legitimate interest can fit some lower-intrusion, reasonably expected promotions.
- Behavioral remarketing is different from a normal customer email. Third-party profiling and cross-site tracking create a much stronger case for consent.
- A lead source is not a legal basis. Purchased, scraped or public contact information still requires source, purpose, expectations and transparency analysis.
- Your CRM should preserve compliance evidence. Source, purpose, legal-basis decision, consent version, opt-out and suppression status should not live only in someone's memory.
- Opt-out must change system behavior. Unsubscribing from one tool should not be undone by another automation.
- Ad platforms and marketing SaaS are vendors and often international recipients. Vendor and Article 33 transfer analysis may be required.
The most useful way to apply the LGPD to marketing is to stop thinking only in terms of “our mailing list” and start thinking in processing operations. The same email address can be used for an order receipt, support, fraud prevention, a newsletter, a customer audience and campaign measurement. Those purposes should not automatically inherit one legal basis.
Article 7 contains the legal bases for ordinary personal data. Article 8 regulates consent. Article 9 requires clear information about processing. Article 10 limits legitimate interest to concrete legitimate purposes, strict necessity, legitimate expectations and transparency. Article 18 provides rights including consent withdrawal and opposition to no-consent processing when LGPD requirements are not met.
Map the Marketing Funnel Before Choosing a Legal Basis
A Practical Marketing Data Journey
Ad / Search / Referral → Landing Page → Cookies / Pixel → Lead Form → CRM → Enrichment → Email / WhatsApp → Sales Conversation → Customer Account → Remarketing Audience → Analytics → Suppression / Retention / Deletion
Each arrow can introduce a new purpose, vendor, recipient, identifier or international transfer.
At every stage, ask: what personal data are we using, why are we using it, which legal basis supports the purpose, and what does the person reasonably understand and control?
Consent vs Legitimate Interest for Marketing
Useful when the user can make a real affirmative choice and the organization can prove and honor withdrawal.
Requires a concrete purpose, necessity, reasonable expectations, balancing, safeguards and transparency.
Contract, legal obligation or legal claims may support separate non-promotional CRM activities.
ANPD's official legitimate-interest guide gives an important marketing example: a private university sends students, teachers and employees promotions and discounts for books and cultural products from its own publisher by email and app notification. ANPD says legitimate interest can support that scenario because the promotion is connected to the institution's activities, there is a prior relationship, the communication fits reasonable expectations, the data is not unnecessarily shared and recipients can unsubscribe.
LGPD and Email Marketing
Email can range from a highly expected renewal offer to a completely unexpected message from a company that bought the recipient's address. Those are not legally identical situations.
When consent may be the cleaner basis
Consent is often easier to defend when a person voluntarily signs up for a newsletter, requests promotional updates or chooses a specific offer category that is not necessary to receive another service. When consent is used, Article 8 places proof responsibility on the controller, ties consent to determined purposes, rejects generic authorization and allows withdrawal through a free and facilitated procedure.
When legitimate interest may be considered
A company can consider legitimate interest where the message is connected to a real prior relationship and reasonably expected context, the purpose is specific, the data used is limited, the communication is not excessively intrusive and a balancing test supports the result.
Useful safeguards include clear sender identity, explanation of why the person receives the message, easy unsubscribe, frequency limits, limited segmentation, no unnecessary sharing of the underlying database and suppression after opt-out.
Transactional email is not automatically marketing
An order receipt, security alert, invoice, password reset or service notice can serve a different purpose from a promotional campaign. Do not force every email sent by the same system into one marketing-consent model. Conversely, do not hide unrelated marketing inside a supposedly necessary service communication.
LGPD and WhatsApp Marketing
From an LGPD perspective, WhatsApp is a communication channel—not a separate legal basis. Using a phone number to send a marketing message still requires the same questions about source, purpose, necessity, reasonable expectations, transparency and rights.
A customer gave us their phone number. Can marketing use it?
Not automatically. A customer may provide a number for delivery updates, account security or support. Reusing that number for promotions is an additional purpose that needs its own analysis. If legitimate interest is used, assess whether promotional contact through WhatsApp is reasonably expected in the relationship, how intrusive the frequency/content are, what the person was told at collection and whether a less intrusive method is available. If consent is used, record it and make withdrawal straightforward.
Messaging-platform rules, consumer rules and sector-specific requirements can impose additional obligations beyond the LGPD. This article focuses on the data-protection layer.
CRM Compliance: The Database Behind the Campaign
The CRM is where marketing compliance either becomes operational or collapses. It should not contain only contact details and a “newsletter = yes/no” field.
| Field | Example | Why it matters |
|---|---|---|
| Contact source | Website form, customer account, event, referral, public source, vendor list. | Source affects transparency and expectations. |
| Collection date | 2026-08-12 | Supports retention and campaign-history analysis. |
| Original purpose | Requested product demo. | Helps test later-purpose compatibility. |
| Marketing purpose | Newsletter, renewal offers, partner offers. | Prevents one vague label from hiding multiple uses. |
| Legal-basis record | Consent or legitimate-interest assessment reference. | Shows why the campaign is believed lawful. |
| Consent evidence | Form/version/time/source where applicable. | Supports Article 8 proof. |
| Notice version | Wording shown at collection. | Supports transparency evidence. |
| Channel preferences | Email yes; WhatsApp no. | Avoids treating all channels as identical. |
| Opt-out date | 2026-08-18 | Must drive future exclusion. |
| Suppression status | Do not re-enroll in promotional email. | Prevents accidental remarketing after opt-out. |
| Retention review | Review inactive lead after defined period. | Supports necessity and retention governance. |
Do not delete all evidence of the opt-out
If every suppression reference is removed, the same address may be re-imported days later. A more defensible design can retain the minimum suppression record needed to prevent re-enrollment, supported by a documented purpose, lawful basis, minimization and retention rule. Do not use a suppression record as an excuse to keep the entire marketing profile indefinitely.
Purchased Leads, Scraped Contacts and Public Data
“The data is public” and “we paid for the list” are not legal bases under Article 7. Article 7 says publicly accessible personal data must be processed with attention to the purpose, good faith and public interest that justified its availability. Even where data was manifestly made public by the individual, LGPD principles and rights remain protected.
Before importing a purchased lead list, establish who collected it, the source, what people were told, whether sharing was contemplated, the original purpose, whether recipients would reasonably expect your campaign, your legal basis, how you will provide transparency and how opt-outs will be honored.
Sharing consent-based leads with another controller
Article 7(5) provides that when a controller obtained consent and needs to communicate or share personal data with other controllers, specific consent is required for that sharing unless another consent-waiver basis applies. That can be important for lead-generation businesses, affiliates, agencies and “partner offers.”
Pixels, Analytics and Remarketing
Website marketing often starts before a form is submitted. Cookies, pixels, tags and similar technologies can collect identifiers and behavioral events that may constitute personal data when linked or linkable to an identifiable individual.
Limited audience measurement
ANPD says legitimate interest can support audience-measurement cookies in some contexts, particularly where the purpose is limited to measuring patterns and trends using aggregated data, without combining the information with other tracking mechanisms or building user profiles.
Advertising and behavioral profiling
ANPD says legitimate interest will generally be difficult to justify where cookies are used for advertising, especially third-party cookies involving behavioral profiling, prediction of preferences or behavior, or tracking across different websites. In those contexts, ANPD says consent can be a more appropriate legal basis.
ANPD recommends visible options to reject non-essential cookies, category management, clear purposes, consent by specific purpose/category where appropriate and consent-based cookies disabled by default. It discourages a single “Accept” button, hidden reject controls, pre-enabled non-essential cookies and treating continued browsing as consent.
Customer Audiences, Hashed Emails and Profiling
A common workflow exports customer emails or phone numbers from the CRM, transforms them into identifiers and sends them to an advertising platform to match users and build an audience.
Do not assume hashing automatically takes that workflow outside the LGPD. If the identifier remains usable to match or relate to an identifiable individual within the advertising ecosystem, the safer compliance approach is to treat it as personal data unless the LGPD's anonymization standard is genuinely satisfied.
Document the identifiers uploaded, platform, purpose, legal basis, transparency, transfer location, vendor role, audience retention and what happens after withdrawal or opt-out.
Lookalike and predictive audiences
The more a system combines sources and predicts interests or behavior, the less appropriate it is to label the operation merely “analytics.” If a decision is made solely through automated processing and affects a person's interests, Article 20 can also become relevant depending on the actual decision and impact.
CRM Enrichment and Data Brokers
Enrichment tools can append job title, employer, social profile, inferred interests or additional contact information. Review what fields are added, where the provider obtained them, whether they are inferred, which basis supports your use, whether the purpose matches reasonable expectations, the provider's role, and how correction/deletion requests reach the enriched record.
Marketing Agencies and Client Data
An agency can act as an operator for client campaigns when it processes customer data on instructions, while acting as controller for its own prospect database, account administration, billing or independent marketing. The contract should define audience control, reuse restrictions, platforms/subprocessors, transfers, rights routing, incidents and deletion/return after the campaign.
International Marketing Platforms
Foreign CRM, email, automation, analytics and ad-tech platforms create a separate international-transfer layer. If Brazilian personal data is transferred abroad, the organization should identify an applicable Article 33 route. As of August 2026, ANPD lists the European Union as adequate under Resolution No. 32/2026; the United States is not listed as adequate, so a Brazil-to-U.S. marketing-vendor flow needs another applicable route.
What Happens When Someone Unsubscribes?
| System | Expected action | Common failure |
|---|---|---|
| Email platform | Suppress from the relevant promotional stream. | New import silently reactivates the person. |
| CRM | Record preference/withdrawal centrally. | Sales automation ignores the status. |
| Stop the relevant promotional messaging. | Salesperson keeps sending manually. | |
| Ad audience | Assess whether withdrawal/objection requires removal based on the campaign's basis and purpose. | Email stops but identical consent-based remarketing continues indefinitely. |
| Agency/vendor | Propagate the required preference change. | Third-party campaign list remains active. |
| Suppression layer | Keep only what is necessary to prevent re-enrollment under a documented rule. | Either all evidence is erased or the full profile is retained forever. |
15-Point LGPD Marketing Compliance Checklist
Common LGPD Marketing Mistakes
“LGPD requires opt-in consent for every marketing email.”
Too broad. Consent is one basis, and ANPD gives an example where legitimate interest can support related promotional communications. The facts still need analysis.
“We have a legitimate interest in selling, so every prospect can be contacted.”
Too broad. Article 10 requires a concrete purpose, strict necessity, legitimate expectations, rights analysis, transparency and safeguards.
“The lead was public, so LGPD does not apply.”
Incorrect. Public availability does not eliminate LGPD principles, rights or the need for lawful processing.
“The cookie banner says Accept, so pixels are compliant.”
Not if non-essential consent-based trackers already fired before the person chose. ANPD recommends genuine choice and consent-based cookies disabled by default.
“Hashed email is anonymous.”
Not automatically. If it remains usable to match or relate to a person, do not assume it meets the LGPD anonymization standard.
“Unsubscribe only applies to email.”
The scope depends on the request and the purpose/legal basis. A mature preference center distinguishes channels and purposes while making choices effective.
A Practical Example: E-Commerce Remarketing Funnel
| Stage | Data / technology | LGPD question |
|---|---|---|
| Landing page | IP/device data, necessary cookies. | Which processing is essential and what transparency is provided? |
| Ad pixel | Behavioral events and advertising identifier. | If consent-based, is it blocked before choice and can it be rejected? |
| Email capture | Email and preferences. | What purpose was stated and what basis supports future messages? |
| CRM | Contact, source, campaign and sales history. | Are purpose, basis, retention and opt-out evidence recorded? |
| Abandoned cart | Cart data + email/phone. | Is the reminder expected, proportionate and transparently explained? |
| Customer purchase | Order and customer data. | Separate contractual fulfillment from optional promotional reuse. |
| WhatsApp upsell | Phone number + purchase relationship. | Would this channel be reasonably expected? Consent or documented legitimate-interest analysis? |
| Remarketing audience | Email/phone or pixel events sent to ad platform. | Legal basis, transparency, vendor role and international transfer. |
| Unsubscribe | Preference/suppression state. | Does the choice propagate to every relevant campaign system? |
Turn Your Marketing Stack Into a Documented LGPD Process
The Brazil LGPD Compliance Playbook — 2026 Edition includes a Cookie and Tracking Inventory, Legal-Basis Decision Record, Legitimate Interest Assessment, Vendor Privacy and Security Review, International Transfer Review, Privacy Notice Framework, Retention Schedule, 100-point compliance audit and 30-day implementation roadmap.
Frequently Asked Questions
Does the LGPD require consent for all email marketing?
No. Consent is one Article 7 basis, and legitimate interest may be considered in appropriate contexts. ANPD gives a favorable example involving related promotional emails and app notifications where there is a prior relationship, reasonable expectations, limited use and an unsubscribe mechanism.
Can a company use legitimate interest for WhatsApp marketing?
Potentially. WhatsApp does not create its own LGPD basis. Analyze relationship, source, purpose, expectations, necessity, frequency, intrusiveness, transparency and safeguards.
Can a business buy a lead list and contact everyone?
Buying a list does not establish a legal basis. Review source, original collection purpose, sharing, transparency, reasonable expectations, your new purpose and rights handling.
Can we scrape public business contacts for marketing?
Public availability does not remove the LGPD. Article 7 still requires attention to purpose, good faith and the context that justified making the data public, while preserving rights and principles.
Does the LGPD require consent for remarketing pixels?
ANPD says legitimate interest will generally be difficult to justify for advertising cookies involving third-party profiling, preference prediction or cross-site tracking, and says consent may be more appropriate.
Can analytics use legitimate interest?
Sometimes. ANPD says audience measurement can be supported by legitimate interest in certain contexts where processing is limited to aggregate patterns and trends without combining trackers or creating user profiles.
Does continued browsing count as cookie consent?
ANPD says consent should not be inferred from omission or continued browsing and discourages tacit consent and pre-selected authorization.
What should a CRM store for LGPD marketing compliance?
Useful fields include contact source, date, purpose, legal-basis decision, consent evidence where applicable, notice version, channel preferences, opt-out date, suppression status and retention-review date.
Can we keep an unsubscribed email address?
A minimal suppression record may be useful to prevent accidental re-enrollment, subject to a documented lawful basis, purpose, minimization and retention rule.
Can we share a consent-based lead with a partner?
Article 7(5) says that a controller that obtained consent and then needs to share personal data with another controller must obtain specific consent for that sharing unless another consent-waiver basis applies.
Do foreign marketing platforms create international transfers?
They can. If Brazilian personal data is transferred abroad, map the flow and identify an applicable Article 33 route under the current international-transfer framework.
Official Sources Used for This Guide
- Law No. 13,709/2018 — LGPD, current compiled textPrimary source for principles, legal bases, consent, transparency, legitimate interest, public data, sharing, rights, profiling and international transfers.
- ANPD — Legitimate Interest GuideOfficial guidance for balancing tests, legitimate expectations, promotional communications, opt-out safeguards and records.
- ANPD — Cookies and Personal Data Protection GuidanceOfficial guidance for consent, continued browsing, analytics, advertising cookies, behavioral profiling, reject controls and default-off consent-based cookies.
- ANPD — Data Subject RightsOfficial overview of access, correction, deletion, consent withdrawal and other rights.
- ANPD — International Data TransfersCurrent transfer framework relevant to foreign CRM, email, analytics and ad-tech vendors.