--- title: "LGPD (Brazil): What It Means for Cold Email" description: "Is B2B cold email legal in Brazil under the LGPD? Legitimate interest, transparency and opt-out duties, ANPD guidance, fines up to BRL 50 million and cases." path: /cold-email-laws/lgpd family: laws updated: 2026-10-17 html: /cold-email-laws/lgpd sources: - "https://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/l13709.htm" - "https://www.planalto.gov.br/ccivil_03/_ato2023-2026/2026/lei/L15352.htm" - "https://www.gov.br/anpd/pt-br/centrais-de-conteudo/materiais-educativos-e-publicacoes/guia_legitimo_interesse.pdf" - "https://www.gov.br/anpd/pt-br/acesso-a-informacao/institucional/atos-normativos/regulamentacoes_anpd/resolucao-cd-anpd-no-2-de-27-de-janeiro-de-2022" - "https://www.gov.br/anpd/pt-br/acesso-a-informacao/sancoes-administrativas" - "https://www.gov.br/anpd/pt-br/assuntos/noticias/anpd-multa-tiktok-em-r-153-7-milhoes-por-falhas-na-protecao-de-dados-de-criancas-e-adolescentes" - "https://www.gov.br/anpd/pt-br/assuntos/fiscalizacao-2/saiba-como_fiscalizamos/arquivos/cgf20231autodeinfraotelekall-process-00261000489_2022_62.pdf" - "https://www.ecb.europa.eu/stats/policy_and_exchange_rates/euro_reference_exchange_rates/html/index.en.html" - "/anti-spam" - "/terms" - "/features" facts: law: "Lei Geral de Proteção de Dados Pessoais (General Personal Data Protection Law) (Lei No. 13.709/2018)" jurisdiction: "Brazil" in_force: "2020 (sanctions from August 1, 2021)" regulator: "Agência Nacional de Proteção de Dados (ANPD)" b2b_cold_email: "Allowed on legitimate interest, opt-out" max_penalty: "2% of revenue in Brazil, up to BRL 50 million per infraction" --- # LGPD (Brazil): What It Means for Cold Email Usually yes, on legitimate interest. Brazil's LGPD can allow B2B email without consent if you keep data minimal, say who you are and where you got the contact, and honor opt-outs. Fines reach 2% of revenue in Brazil, capped at BRL 50 million per infraction. ## Not Legal Advice > Not legal advice. We checked this page against the law's text and the regulator's guidance on October 17, 2026; it has not been reviewed by a lawyer. ## Can You Send B2B Cold Email Under the LGPD? **In short:** Usually yes, on legitimate interest: the LGPD does not require consent if you keep data to a minimum, are open about who you are and where you got the contact, keep records and honor objections. The LGPD is a privacy law, not an anti-spam law, and we found no Brazilian statute aimed at unsolicited email. Every processing of personal data needs one of the ten legal bases in article 7, and consent is only one of them. For prospecting, the usual basis is legitimate interest (article 7, IX), and article 10 lists supporting and promoting the controller's activities as a legitimate purpose. A named work email is personal data, because it relates to an identifiable natural person (article 5, I). Data about the company itself is not, since only a natural person can be a data subject (article 5, V). The law reaches companies outside Brazil that offer goods or services to, or process data of, people in Brazil (article 3). The ANPD's 2024 guide on legitimate interest accepts promotional email under that basis when every message offers a way to unsubscribe, in an example where the sender already had a relationship with the recipients. It names a prior relationship and the source of the data, including public sources, as factors in what the person can expect. Cold email has no prior relationship, so your balancing test carries more weight. ## What Do You Need to Do Under the LGPD? **In short:** 7 rules apply to a cold email program under the LGPD. **LGPD requirements for cold email, checked October 17, 2026** | Requirement | What it means | How to do it | Section | | --- | --- | --- | --- | | Legal basis | Each processing needs a basis in article 7. Legitimate interest works only if it does not override the person's fundamental rights. | Document legitimate interest for prospecting, with a written balancing test for each campaign purpose. | LGPD art. 7, IX and art. 10; ANPD legitimate interest guide | | Data minimization | Under legitimate interest, only the personal data strictly needed for the purpose may be processed. | Keep name, role, company and work email only, with no personal or sensitive data. | LGPD art. 6, III and art. 10, paragraph 1 | | Transparency | Tell people the purpose, your identity and contact details, and their rights. | Name your company and the purpose, say where you got the contact, and link a privacy notice with a contact channel. | LGPD art. 9 and art. 10, paragraph 2 | | Public-source data | Using publicly accessible data must respect the purpose, good faith and public interest behind its publication, and the person's rights still apply. | Use sources where the person published the contact for work, and log the source of each contact. | LGPD art. 7, paragraphs 3, 4 and 7 | | Objection and deletion | A person can object to processing based on legitimate interest and ask for deletion, free of charge. | Put an opt-out in every email, suppress the contact permanently and delete their data on request. | LGPD art. 18, paragraphs 2 and 5 | | Records | Keep records of processing, especially when it relies on legitimate interest. The ANPD may ask for an impact report. | Keep a processing record for prospecting: sources, fields, retention and the balancing test. | LGPD art. 37 and art. 10, paragraph 3 | | Privacy contact | Appoint a data protection officer and publish their contact details; small processing agents may instead keep a contact channel. | Publish a privacy contact on your site and in your privacy notice. | LGPD art. 41; ANPD Resolution CD/ANPD No. 2/2022 | ## What Are the Penalties Under the LGPD? **In short:** Maximum penalty: 2% of revenue in Brazil, up to BRL 50 million per infraction. **LGPD maximum penalties, checked October 17, 2026** | Penalty | Maximum | In USD | Section | | --- | --- | --- | --- | | Simple fine per infraction | BRL 50,000,000 cap, up to 2% of the company's revenue in Brazil in its last fiscal year, net of taxes | about USD 9.8 million | [LGPD art. 52, II](https://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/l13709.htm) | | Daily fine | BRL 50,000,000 in total, the same cap as the simple fine | about USD 9.8 million | [LGPD art. 52, III](https://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/l13709.htm) | | Other sanctions | Warning, publication of the infraction, blocking or deletion of the data, suspension of processing for up to 6 months, or a partial or total ban on processing | Not a fixed amount | [LGPD art. 52](https://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/l13709.htm) | USD amounts are approximate, converted at the European Central Bank reference rates of 2026-10-16. The ANPD imposes sanctions (article 52), and people can petition it about their data (article 18). People can also go to court, individually or collectively (article 22), and anyone who causes damage by processing data must repair it (article 42). Sanctions under the Consumer Defense Code and other laws still apply. ## What Enforcement Has There Been Under the LGPD? **In short:** 2 cases from regulator and court records, newest first. The ANPD has issued few fines, and none we found concerns email marketing. Its first fine and its 2026 TikTok fine both punished processing without a legal basis. **LGPD enforcement examples from regulator and court records** | Date | Company | What happened | Outcome | Source | | --- | --- | --- | --- | --- | | 2026-08-25 | ByteDance (TikTok) | Processed children's and teenagers' data without a valid legal basis. | BRL 153.7 million fine, an order to delete the data and a compliance plan | [ANPD news release](https://www.gov.br/anpd/pt-br/assuntos/noticias/anpd-multa-tiktok-em-r-153-7-milhoes-por-falhas-na-protecao-de-dados-de-criancas-e-adolescentes) | | 2023-07-05 | Telekall Infoservice | Offered election candidates a list of voters' WhatsApp contacts for campaign messages, with no legal basis. | BRL 14,400 in fines plus a warning, the ANPD's first LGPD fine | [ANPD process file](https://www.gov.br/anpd/pt-br/assuntos/fiscalizacao-2/saiba-como_fiscalizamos/arquivos/cgf20231autodeinfraotelekall-process-00261000489_2022_62.pdf) | ## Cold Email Checklist for the LGPD 1. Write a legitimate interest balancing test for each campaign: purpose, necessity and safeguards. 2. Keep only name, role, company and work email. 3. Use sources where the person published the contact for work, and log each source. 4. Say who you are, why you are writing and where you got the contact, with a link to your privacy notice. 5. Put an opt-out in every email and suppress objections permanently. 6. Delete a contact's data on request, free of charge. 7. Keep a record of your prospecting: sources, fields, retention and the balancing test. 8. Publish a privacy contact on your site. ## How Ken Helps **In short:** Ken Campaigns handles opt-outs, suppression and sending limits; it does not make your emails lawful, and the law stays your responsibility. - Campaign emails must include a legally appropriate opt-out or unsubscribe mechanism unless Ken approves another lawful approach in writing, and Ken can run the unsubscribe links, reply-based opt-outs and suppression for you (Ken Terms of Service, section 7.3). - Ken's anti-spam policy puts opt-outs, abuse complaints, spam-trap notices and hard bounces on a suppression list that applies across every domain and mailbox Ken operates, and never expires it. - Ken tracks every bounce, unsubscribe and spam report, and every campaign rotates across several inboxes to stay under daily send limits. - You give Ken your legal entity name and mailing address for the email footer, and Ken will not knowingly use materially false or misleading headers, sender details or subject lines (Terms, section 7.2). - Ken's anti-spam policy bars purchased and scraped lists, and accounts found sending unsolicited bulk email are suspended (section 6). - Ken's terms leave the legality of your offer, audience and data, and any consents and notices the law requires, with you (section 7.1). Under the LGPD, that includes your legitimate interest balancing test and your privacy notice. - [Join the waiting list](/waitlist) - [Read Ken's anti-spam policy](/anti-spam) ## FAQ ### Do I need consent to send B2B cold email in Brazil? No. Consent is one of ten legal bases (article 7), and legitimate interest (article 7, IX and article 10) can cover prospecting if you keep data minimal, are transparent and offer an opt-out. The ANPD's 2024 guide accepts promotional email under legitimate interest when every message has an unsubscribe option. ### Does the LGPD cover work email addresses? Yes, when the address relates to an identifiable person (article 5, I). Data about the company itself is not personal data, because only a natural person can be a data subject (article 5, V). ### Does the LGPD apply if my company is outside Brazil? Yes, if you offer goods or services to, or process the data of, people located in Brazil (article 3), wherever your company is based. ### Can I use contact details I found online? Yes, but you must respect the purpose, good faith and public interest behind their publication (article 7, paragraph 3), and all other duties still apply. The ANPD treats the source of the data as a factor in what the person can expect. ### What is the maximum LGPD fine? Up to 2% of revenue in Brazil, net of taxes, capped at BRL 50 million per infraction (article 52, II). The ANPD's first fine was BRL 14,400 (Telekall, 2023), and in 2026 it fined TikTok's owner BRL 153.7 million. ## Related - [Cold email laws by country](/cold-email-laws): All 12 laws compared - [GDPR: What It Means for Cold Email](/cold-email-laws/gdpr): Legitimate interest; consent rule varies by country - [POPIA (South Africa): What It Means for Cold Email](/cold-email-laws/popia): Consent first; one consent-request email allowed - [DPDP Act (India): What It Means for Cold Email](/cold-email-laws/dpdp-india): Consent first, once the core rules start - [Ken anti-spam policy](/anti-spam) ## Sources | Source | URL | Checked | | --- | --- | --- | | LGPD, Lei No. 13.709/2018, compiled text | https://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/l13709.htm | 2026-10-17 | | Lei No. 15.352/2026 (ANPD becomes an agency) | https://www.planalto.gov.br/ccivil_03/_ato2023-2026/2026/lei/L15352.htm | 2026-10-17 | | ANPD, Guia orientativo: legitimo interesse (2024) | https://www.gov.br/anpd/pt-br/centrais-de-conteudo/materiais-educativos-e-publicacoes/guia_legitimo_interesse.pdf | 2026-10-17 | | ANPD, Resolution CD/ANPD No. 2/2022 (small processing agents) | https://www.gov.br/anpd/pt-br/acesso-a-informacao/institucional/atos-normativos/regulamentacoes_anpd/resolucao-cd-anpd-no-2-de-27-de-janeiro-de-2022 | 2026-10-17 | | ANPD, administrative sanctions | https://www.gov.br/anpd/pt-br/acesso-a-informacao/sancoes-administrativas | 2026-10-17 | | ANPD, TikTok fine (2026) | https://www.gov.br/anpd/pt-br/assuntos/noticias/anpd-multa-tiktok-em-r-153-7-milhoes-por-falhas-na-protecao-de-dados-de-criancas-e-adolescentes | 2026-10-17 | | ANPD, Telekall Infoservice process file (2023) | https://www.gov.br/anpd/pt-br/assuntos/fiscalizacao-2/saiba-como_fiscalizamos/arquivos/cgf20231autodeinfraotelekall-process-00261000489_2022_62.pdf | 2026-10-17 | | European Central Bank, euro foreign exchange reference rates (2026-10-16) | https://www.ecb.europa.eu/stats/policy_and_exchange_rates/euro_reference_exchange_rates/html/index.en.html | 2026-10-17 | | Ken anti-spam policy (sections 4 and 6) | /anti-spam | 2026-10-17 | | Ken Terms of Service (sections 7.1 to 7.3) | /terms | 2026-10-17 | | Ken features: deliverability monitoring and multi-inbox rotation | /features | 2026-10-17 | ## Changelog - 2026-10-17: Page published.