Cold Email Compliance in Brazil: LGPD Rules That Actually Matter

If you're sending cold emails to Brazilian prospects, you're operating under different rules than the rest of the world. Brazil's Lei Geral de Proteção de Dados (LGPD) is stricter in some ways than GDPR, more permissive in others - and most cold email campaigns ignore it entirely.

The result: campaigns that look successful on the surface but expose you to real legal risk, fines up to 50 million Brazilian reais (roughly $10 million USD), and getting blacklisted by Brazilian email providers.

Here's what actually matters if you're targeting Brazilian B2B prospects.

What LGPD Actually Says About Cold Email

LGPD applies to any personal data of Brazilian residents, regardless of where your company is based. That's the first thing to understand - you can't opt out by being foreign.

The law requires "lawful basis" to process personal data. For cold email, there are two relevant bases:

Legitimate interest - this is the one people misunderstand. Yes, it exists in LGPD. No, it's not a blank check. It covers business-to-business prospecting, but only if you follow specific rules we'll cover below.
Consent - explicit, informed consent. This is the safer path but much harder to scale in cold email.

Most B2B cold email to Brazil operates under legitimate interest, not consent. That's legal - but it requires you to actually document your legitimate interest and follow the compliance framework around it.

The Three Rules That Protect You (And Most People Get Wrong)

1. You Need a Documented Legal Basis (Not Just Hope)

This is the part that separates compliant cold email from gambling. You need to write down why you're sending emails to this person - and it needs to be specific to your business model.

Here's what actually works: Create a one-page document for your cold email program that states:

What data you're collecting (name, email, company name, job title)
Where you're getting it from (Hunter.io, LinkedIn, public directories - be specific)
Why contacting this person serves your legitimate business interest ("We help B2B SaaS companies improve email delivery. We're contacting decision-makers at tech companies who use email-dependent systems.")
How long you retain data (30 days if no response, delete it)
How people can opt out (unsubscribe link in every email)

Store this document. If LGPD authorities ask, you can show it. If you can't articulate why you're emailing someone beyond "we bought a list," you're exposed.

2. Unsubscribe Must Actually Work (Immediately)

LGPD requires an "opt-out mechanism" that works. Not "works eventually." Works immediately.

This means:

Every single email needs an unsubscribe link. Non-negotiable. Not in a footer - it can be in a footer, but it must be there.
When someone clicks unsubscribe, they must be removed from your list within 48 hours. Automated removal is better - do it instantly.
That person should never receive another email from you. Not "after the current campaign." Never.
You need to log unsubscribe requests. If you get audited, you should be able to produce a list of everyone who opted out and when.

We've seen campaigns that "forgot" to add unsubscribe links to Brazilian sequences. That's not just bad practice - that's a direct LGPD violation.

3. Your Data Source Matters More Than You Think

Where you get email addresses from affects whether your legitimate interest claim holds up.

Good sources for cold email in Brazil:

LinkedIn (publicly available professional information)
Company websites (published contact pages, team directories)
Public business registries
Reputable data providers that comply with LGPD themselves (ask them for their compliance documentation)

Risky sources:

"Scraped" email lists where you don't know the original source
Lists purchased from vendors who can't explain where the data came from
Data from social media without the person's knowledge that you're using it for email

If you're buying a list, ask the vendor: "Can you provide documentation of how this data was collected and what legal basis you used?" If they can't answer clearly, don't buy it. That's a compliance liability waiting to happen.

Practical Setup: What Your Campaign Should Actually Look Like

Here's a concrete example of what a LGPD-compliant cold email sequence looks like:

Email 1 (Day 1):

Subject line: "Quick question about your email infrastructure at [Company]"
Body: 4-5 sentences. Mention their company by name. State the specific reason you're reaching out (not generic).
Footer: Your company name, address, email, phone. Unsubscribe link that says "Unsubscribe from future emails."

Email 2 (Day 5, if no reply):

Short follow-up. Same footer with unsubscribe link.

Email 3 (Day 10, if no reply):

Final follow-up. Same footer. Then remove them from your list after this email sends.

Total touches: 3. Response rate for B2B cold email to decision-makers in Brazil typically runs 2-4% reply rate if you're hitting the right people. That's your benchmark.

If someone replies "no thanks," they're not opting out - they're just saying no. You can email them again in 6 months if you have a good reason. But if they click unsubscribe, you're done. Forever.

The One Thing That Gets People Fined

It's not sending cold emails. It's not even having an outdated privacy policy. It's continuing to email someone after they've told you to stop.

LGPD authorities have shown they care most about enforcing opt-out rights. Build your infrastructure to handle unsubscribes automatically and completely. If your email platform is old enough that unsubscribe removal is a manual process, upgrade it.

Also - if you're running multiple domains or sender addresses, make sure an unsubscribe on one covers all of them. Emailing someone from a different domain after they opted out from the first one is a gray area that regulators don't look kindly on.

How This Compares to Other Markets

If you're already compliant with GDPR in Europe, you're about 70% of the way there for LGPD. The frameworks are similar - both require documented basis, unsubscribe mechanisms, and retention limits. The main difference is LGPD is slightly more prescriptive about legitimate interest documentation.

Brazil also sits between global compliance frameworks - stricter than Canada, less prescriptive than Australia's Spam Act. If you're managing compliance across multiple markets, LGPD lands in the "medium complexity" range.

What This Means for Your Campaign

If you're targeting Brazilian B2B prospects, you can absolutely run cold email campaigns. The law isn't designed to kill prospecting - it's designed to stop data abuse and forced marketing.

The practical difference between compliant and non-compliant comes down to infrastructure and documentation - both doable, neither expensive:

Write down your legal basis for the campaign (one page)
Use a reputable email provider that tracks unsubscribes
Include unsubscribe links in every email
Source your data responsibly
Remove people who opt out, immediately

Do this and you're not just avoiding fines - you're building better campaigns. People who actually want to hear from you reply at higher rates than lists full of people who never asked to be contacted.