Email marketing in Brazil can feel like a carnival parade. Bright colors. Big music. Lots of people. But under the Lei Geral de Proteção de Dados, or LGPD, you need more than confetti. You need a clear reason to use someone’s email address.

TLDR: Under Brazil’s LGPD, email marketing usually needs a valid legal basis, and consent is one common choice. Consent must be free, informed, clear, and specific. For example, if an online store has 10,000 subscribers, it should be able to show when and how each person agreed to receive emails. If 3% unsubscribe after a campaign, those 300 people must be removed from marketing lists quickly.

What is the LGPD?

The LGPD is Brazil’s main data protection law. It protects personal data. That means any information that can identify a person.

An email address is often personal data. For example:

  • maria@gmail.com is personal data.
  • joao.silva@company.com.br is also personal data.
  • sales@company.com.br may be less personal, but you should still be careful.

The LGPD applies when you process personal data in Brazil. It may also apply if you offer goods or services to people in Brazil. So, even if your business is outside Brazil, you may still need to follow it.

Email marketing is “processing.” You collect emails. You store them. You segment them. You send campaigns. That all counts.

Does email marketing always need consent?

Not always. The LGPD has several legal bases. Consent is one of them. Another is legitimate interest. Some businesses use legitimate interest for soft marketing, such as sending offers to existing customers.

But consent is often the safest and clearest path. It is also easier to explain. A person says, “Yes, send me marketing emails.” You keep proof. Everyone knows the deal.

If you rely on consent, the rules are strict. You cannot treat consent like a tiny checkbox hidden in a dark cave. It must be easy to understand.

What makes consent valid under the LGPD?

LGPD consent must be freely given, informed, and unambiguous. For some uses, it should also be linked to a specific purpose.

Let’s break that down.

  • Freely given: The person must have a real choice. No pressure. No trickery.
  • Informed: The person must know what they are agreeing to.
  • Unambiguous: The person must take a clear action. Silence is not enough.
  • Specific: The consent should match the purpose. “Marketing emails” is clearer than “communications.”

A good consent message is simple. For example:

“Yes, I want to receive promotional emails from Sunny Shoes Brazil. I can unsubscribe at any time.”

That works much better than:

“By continuing, you agree to receive information, notices, updates, opportunities, offers, partner messages, and other communications.”

That second one is a fog machine. The LGPD likes sunshine.

Pre-checked boxes are a bad idea

Do not use pre-checked boxes for email marketing consent. They are risky. The person should actively choose to subscribe.

Use an empty checkbox. Use a clear label. Make the action obvious.

Here is a better form:

  • Name: optional
  • Email: required
  • Empty checkbox: “I agree to receive marketing emails.”
  • Link to privacy notice

This is not fancy. But it is clean. Clean beats clever in privacy law.

Tell people what they are signing up for

People should know what kind of emails they will receive. Will you send coupons? Newsletters? Product launches? Event invites? Partner offers?

Say it clearly.

Also tell them how often you may email them. You do not need to promise an exact number forever. But a rough idea helps.

For example:

“Subscribe to get weekly beauty tips, product news, and special discounts.”

That is friendly. It is also useful. The subscriber knows what to expect.

Image not found in postmeta

Keep proof of consent

Under the LGPD, you should be able to prove consent. Think of it like keeping a receipt. If someone asks, “Why are you emailing me?” you should have an answer.

Keep records such as:

  • The email address used to sign up
  • The date and time of consent
  • The form or page where consent happened
  • The wording shown at the time
  • The IP address, if appropriate
  • The privacy notice version

This record can save headaches. It can also help if the Brazilian data protection authority, the ANPD, asks questions.

Make unsubscribing easy

Consent is not a life sentence. People can change their minds.

Every marketing email should include an easy way to opt out. The unsubscribe link should be visible. It should work. It should not require a treasure map.

A good unsubscribe process is:

  • One or two clicks
  • No login required
  • No confusing buttons
  • No guilt trip
  • Fast removal from the marketing list

You can ask why they are leaving. But make it optional. Do not block the unsubscribe process.

Also, do not keep sending “Are you sure?” emails forever. That is like following someone out of a party with a drum.

Be careful with purchased email lists

Purchased lists are tempting. They look like a shortcut. But shortcuts can lead to a swamp.

If you buy an email list, can you prove each person gave valid consent to receive your marketing? Can you prove they agreed to hear from your company? Can you show the exact wording?

If the answer is no, do not use the list.

Even if a vendor says, “These leads are compliant,” you still have risk. Under the LGPD, your business may be responsible for how it uses the data.

What about B2B email marketing?

B2B does not mean “privacy rules disappear.” If an email identifies a person, the LGPD can apply.

For example, ana.rocha@company.com.br identifies Ana. That is personal data. You need a legal basis to use it.

You may be able to use legitimate interest for some B2B outreach. But you should be careful. The message should be relevant. The person should expect it. You should offer a clear opt-out.

If you use consent, follow the same rules. Clear choice. Clear purpose. Clear proof.

Privacy notices matter

Your privacy notice should explain your email marketing practices. Keep it simple. No legal soup.

Include:

  • Who controls the data
  • What data you collect
  • Why you use it
  • The legal basis you rely on
  • Who you share it with
  • How long you keep it
  • How people can unsubscribe
  • How people can exercise LGPD rights

LGPD rights include access, correction, deletion, portability, and information about data sharing. People can also withdraw consent.

Image not found in postmeta

Segment with care

Marketing teams love segments. New customers. VIP buyers. Cart abandoners. Cat lovers. Soccer fans. People who buy glittery sandals.

Segmentation is useful. But it still uses personal data. Be fair and transparent.

If you track clicks, purchases, location, or behavior, explain that in your privacy notice. If you use sensitive personal data, be extra careful. Sensitive data includes things like health, religion, race, political opinions, and biometric data.

Most brands do not need sensitive data for email marketing. If you do not need it, do not collect it.

Children and teens need extra care

The LGPD has special rules for children and adolescents. If your email marketing targets children, be very careful. You may need consent from a parent or legal guardian.

Keep the language simple. Use child-friendly explanations when needed. Also consider whether marketing to children is appropriate at all.

Quick compliance checklist

Before you send your next campaign, run through this mini checklist:

  • Do we have a valid legal basis?
  • If we use consent, was it clear and voluntary?
  • Can we prove when and how consent was given?
  • Does our email identify our company?
  • Is there a working unsubscribe link?
  • Are unsubscribed users removed quickly?
  • Does our privacy notice explain email marketing?
  • Are we avoiding shady purchased lists?
  • Are we protecting the email database?

Common mistakes to avoid

Here are the classic banana peels:

  • Bundled consent: Mixing marketing consent with terms of sale.
  • Hidden consent: Burying email permission in long text.
  • No records: Having no proof of signup.
  • Hard unsubscribe: Making people log in to leave.
  • Over-emailing: Sending too often and annoying subscribers.
  • Vague wording: Saying “updates” when you mean “sales emails.”

Final thoughts

LGPD email marketing consent is not about ruining the fun. It is about respect. Ask clearly. Explain simply. Keep proof. Let people leave when they want.

Good consent also improves marketing. People who choose to hear from you are more likely to open, click, and buy. Your list may be smaller, but it will be healthier.

Think of consent like an invitation to dance. Do not drag people onto the floor. Ask nicely. Play good music. And if they step away, smile and let them go.