Brazil's SMS rules combine the LGPD data protection law, the Consumer Protection Code and carrier regulations. Here is what international businesses need to know before sending their first message.
Brazil’s general data protection law (Law 13.709/2018) governs how personal data — including phone numbers — is collected, processed and stored. It applies to any company that processes data of people in Brazil, even if the company is based abroad.
Brazil’s Consumer Protection Code requires clear, transparent communication with consumers and prohibits abusive or misleading practices in commercial messaging.
The national telecom agency regulates carriers and the SMS infrastructure. On top of the legal requirements, Brazilian carriers apply their own registration, filtering and throughput rules.
OTPs, order confirmations, delivery updates and account alerts are transactional. They typically rely on contract execution or legitimate interest as the legal basis — not marketing opt-in — but must still respect LGPD principles like purpose limitation and data minimization.
Promotions, offers, newsletters and re-engagement campaigns are marketing. They always require explicit prior consent and a free opt-out mechanism.
If a transactional message includes promotional content, it is treated as marketing. Keep transactional templates clean to preserve the legal basis.
The LGPD allows fines of up to 2% of a company’s revenue in Brazil, capped at R$ 50 million per violation, plus public warnings and suspension of data processing activities.
Consumers can file individual lawsuits and complaints with consumer protection agencies (Procon) over unwanted messages.
Carriers can block senders with high complaint rates — a deliverability risk even when no legal action is taken.
No marketing opt-in is required for purely transactional messages like OTPs, order confirmations and delivery updates — they are covered by contract execution or legitimate interest. But the message must be strictly transactional: adding promotional content turns it into marketing, which requires consent.
PARE (Portuguese for “stop”) is the standard opt-out keyword. You should also honor common variations like SAIR and CANCELAR, and process every opt-out immediately.
No central registry exists for SMS. Opt-outs are managed per sender, so you must maintain your own suppression list and never re-contact numbers that opted out.
LGPD penalties include fines of up to 2% of revenue in Brazil, capped at R$ 50 million per violation, plus public disclosure of the infraction and possible suspension of processing activities.
Generally no — Brazilian carriers typically replace alphanumeric sender IDs with a numeric short code. Some providers offer local registration that enables branded senders; check with your provider before assuming your sender ID will display as sent.
Yes. The LGPD has extraterritorial scope: it applies to any organization that processes personal data of individuals in Brazil, regardless of where the company is based. If you text Brazilian numbers, Brazilian rules apply.
SMSGo handles consent capture, PARE opt-out processing and sender registration with Brazilian carriers — so your campaigns stay compliant by default.