SMSGo
Start free
Compliance Guide

How to send SMS to Brazil legally

Brazil's SMS rules combine the LGPD data protection law, the Consumer Protection Code and carrier regulations. Here is what international businesses need to know before sending their first message.

Legal framework

The legal framework

LGPD — data protection

Brazil’s general data protection law (Law 13.709/2018) governs how personal data — including phone numbers — is collected, processed and stored. It applies to any company that processes data of people in Brazil, even if the company is based abroad.

CDC — consumer protection

Brazil’s Consumer Protection Code requires clear, transparent communication with consumers and prohibits abusive or misleading practices in commercial messaging.

ANATEL and carriers

The national telecom agency regulates carriers and the SMS infrastructure. On top of the legal requirements, Brazilian carriers apply their own registration, filtering and throughput rules.

Consent

Consent requirements for marketing SMS

  • Marketing SMS requires prior, free, informed and unambiguous consent from the recipient.
  • Consent must be an active action — pre-checked boxes or consent buried in terms of service do not qualify.
  • Record when, where and how each contact opted in (timestamp, source, and IP address when available).
  • Consent for marketing messages is separate from consent to your terms of service or transactional messages.
  • Withdrawing consent must be as easy as giving it — and it takes effect immediately.
  • Only use the phone number for the purpose the contact agreed to (purpose limitation).
Opt-out

Opt-out rules

  • Every marketing SMS must offer a free opt-out mechanism. The standard keyword in Brazil is PARE (“stop”).
  • Also honor common variations like SAIR and CANCELAR.
  • Process every opt-out immediately and send a short confirmation.
  • Keep a suppression list so opted-out numbers are never contacted again, even across campaigns.
  • Brazil has no central do-not-call registry for SMS — opt-outs are managed per sender.
Transactional

Transactional vs. marketing messages

Transactional

OTPs, order confirmations, delivery updates and account alerts are transactional. They typically rely on contract execution or legitimate interest as the legal basis — not marketing opt-in — but must still respect LGPD principles like purpose limitation and data minimization.

Marketing

Promotions, offers, newsletters and re-engagement campaigns are marketing. They always require explicit prior consent and a free opt-out mechanism.

Mixed content

If a transactional message includes promotional content, it is treated as marketing. Keep transactional templates clean to preserve the legal basis.

Sender ID

Sender ID and carriers

  • A dedicated alphanumeric sender ID requires a Letter of Authorization (LoA) registered with the major carriers (Vivo, Claro, TIM) — plan for roughly 10 weeks of lead time before going live. Without it, senders are typically replaced with a numeric short code.
  • Major carriers (Vivo, Claro, TIM and Oi) apply their own content filtering and throughput rules.
  • Avoid URL shorteners, excessive capitalization and spam-like wording — carrier filters can silently drop messages.
  • Send marketing SMS only between 09:00 and 22:00 in the recipient’s time zone, and avoid sending on Sundays — treat this window as mandatory, not just best practice.
Risks

Penalties and enforcement

LGPD fines

The LGPD allows fines of up to 2% of a company’s revenue in Brazil, capped at R$ 50 million per violation, plus public warnings and suspension of data processing activities.

Consumer claims

Consumers can file individual lawsuits and complaints with consumer protection agencies (Procon) over unwanted messages.

Carrier sanctions

Carriers can block senders with high complaint rates — a deliverability risk even when no legal action is taken.

Checklist

Compliance checklist

  • Collect explicit opt-in before any marketing SMS.
  • Store proof of consent (timestamp, source, IP when available).
  • Include a free PARE opt-out in every campaign.
  • Process opt-outs immediately and keep a suppression list.
  • Keep transactional templates free of promotional content.
  • Register your sender ID with your provider when available.
  • Send marketing only between 09:00 and 22:00 (recipient time zone) and avoid Sundays.
  • Review LGPD requirements for cross-border data transfers.
FAQ

Frequently asked questions

No marketing opt-in is required for purely transactional messages like OTPs, order confirmations and delivery updates — they are covered by contract execution or legitimate interest. But the message must be strictly transactional: adding promotional content turns it into marketing, which requires consent.
PARE (Portuguese for “stop”) is the standard opt-out keyword. You should also honor common variations like SAIR and CANCELAR, and process every opt-out immediately.
No central registry exists for SMS. Opt-outs are managed per sender, so you must maintain your own suppression list and never re-contact numbers that opted out.
LGPD penalties include fines of up to 2% of revenue in Brazil, capped at R$ 50 million per violation, plus public disclosure of the infraction and possible suspension of processing activities.
Generally no — Brazilian carriers typically replace alphanumeric sender IDs with a numeric short code. Some providers offer local registration that enables branded senders; check with your provider before assuming your sender ID will display as sent.
Yes. The LGPD has extraterritorial scope: it applies to any organization that processes personal data of individuals in Brazil, regardless of where the company is based. If you text Brazilian numbers, Brazilian rules apply.