BRAZIL Law and Practice Contributed by: Lucia Ancona Lopez de Magalhães Dias, Maria Fernanda Saab Nersessian and Camila Emi Tomimatsu, Magalhães e Dias
municating and calls that make it difficult to identify the caller, among other types of calls. Infractions of these rules will subject offenders to the administrative sanctions of Law 9,472/1997, as well as to ANATEL’s Administrative Sanctions Application Regulation. At the state level, several laws provide for telephone number registration (often managed by state PRO - CONs) to block product or service telemarketing calls. Finally, the LGPD provides for specific obligations regarding consent, conditions for data processing and liability resulting from data processing failures, which will significantly increase in future. 6.3 Text Messaging Text messages are governed by the CDC principle that prohibits abusive marketing aimed at consumers (Articles 6 (IV) and 39 (IV) of the CDC). ANATEL Resolution 765/2023 establishes that con - sumers of telephone, cable TV and internet services are entitled to not receive advertising messages on their mobile platforms in the absence of prior, free and express consent. Moreover, several initiatives at the state level (in Paraná, Espírito Santo, Minas Gerais, etc) take into account opt-out registrations – ie, con - sumers who no longer wish to receive active telemar - keting calls and/or messages can opt-out therefrom, whereas those who are interested in receiving such communications (where it could be in their best inter - est, having had a previous relationship with a given brand or company) may continue to receive them. There will be penalties only for those companies that disregard the expressed wishes of the consumer. Finally, upon the LGPD coming into force, further dis - cussions will arise about consent and the supplier’s lawful interest in data collection and processing. 6.4 Targeted/Interest-Based Advertising General rules, both in the CDC and in the Civil Rights Framework for the Internet, are applicable to the consent needed for personal data collection, storage and transfer (Article 7 (IX), Law 12968/2014), and the LGPD also reinforced the need for consent for data collection and processing. Accordingly, only the data subject – if they wish and when asked explicitly and unequivocally – can authorise their information to be
used by companies and public bodies offering prod - ucts and services, whether free or otherwise. How - ever, consent is not the only basis that could enable a company to use personal data for advertising pur - poses: companies may also rely on legitimate inter - est, provided for in Articles 7 (IX) and 10 of the LGPD (where it could be in the legitimate interest of the data holder to receive certain advertisements, for instance from companies and/or brands with which it had a prior relationship). When considering using legitimate interest as a legal basis for processing personal data, it is essential that the company performs a legitimate interests assessment (LIA), through which it will be able to assess whether or not it is possible to evoke legitimate interest in the case in question. One important development was the approval in August 2025 of the Digital ECA (published in the Offi ‑ cial Gazette under Law No 15,211/2025), which, with respect to advertising, imposes an outright ban on profiling-based targeting of minors and the use of emotion analysis, as well as AR/XR/VR techniques, for that purpose. 6.5 Marketing to Children Collection or Use of Personal Information From Children The LGPD (Law 13,709/2018) provides a specific sec - tion (Article 14) pertaining to how children’s personal data should be treated, considering their best inter - ests and with the specific and highlighted consent of at least one parent or legal guardian (Paragraph 1). For the purposes of this Law, information concerning an identified or identifiable natural person is considered personal data (Article 5 (I)). Under the principles of child protection, children’s data should not be collected without parental consent, let alone to target them via media “that interests them” or is based on their “browsing habits”. Liability for Violation of the Rules Articles 56 and 57 of the CDC provide for penalties that may be applied in case of violation of the fore - going rules, notably including a fine of up to BRL13 million.
20 CHAMBERS.COM
Powered by FlippingBook