Understanding how the LGPD and Não Me Perturbe affect SMS in Brazil

You will learn

Learn about best practices for SMS marketing to recipients in Brazil.

The following regulations apply to SMS and telemarketing communications in Brazil:

• Lei Geral de Proteção de Dados (LGPD) — Brazil's General Data Protection Law
• Não Me Perturbe — the national do-not-disturb registry maintained by Procon-SP, respected by major telecom, banking, and insurance companies
• ANATEL regulations — telecom regulator rules governing SMS delivery, sender identification, and short code/long code use
• State-level "do-not-spam" registries, which may impose additional requirements depending on the recipient's state

Please note, certain states and sectors may have additional rules that apply to SMS marketing and are not included in this guidance.

SMS compliance in Brazil

There are a number of compliance dos and don'ts for SMS marketing in Brazil:

Do:

• Obtain a valid legal basis — generally consent — before messaging recipients.
• Allow recipients to easily opt out of future messages.
• Only send during appropriate daytime hours.
• Include an opt-out method on messages such as an unsubscribe URL.
• Clearly identify your brand or organization in your messages.
• Check recipients against the Não Me Perturbe registry, and any applicable state do-not-spam lists, before sending.
• Do not:
  • Send marketing messages to numbers registered on Não Me Perturbe or another applicable do-not-disturb registry, once your organization is bound by it.
  • Include prohibited or high-risk content in your messages.
  • Continue messaging someone after they've withdrawn consent.

The following sections explain these practices in more detail.

Obtain a valid legal basis for processing

Under the LGPD, personal data — including a mobile number used for marketing — can only be processed when the organization can point to one of the law's lawful bases, such as consent or legitimate interest. For SMS and telemarketing, consent is the basis Klaviyo customers should plan to rely on.

To be valid under the LGPD, consent must be freely given, informed, and unambiguous, and given for a specific purpose. In practice, this means:

• Make it easy for recipients to opt out at any time (e.g., via a reply keyword or unsubscribe link).
• Provide a link to your privacy policy at the point of collection.
• Be clear about what data you're collecting, why, and how it will be used.
• Ask for consent separately for each channel (e.g., don't bundle SMS consent with email consent in a single checkbox).
• Require an active, unambiguous step from the subscriber (e.g., checking an unchecked box, texting a keyword) — consent cannot be inferred from silence or a pre-checked box.
• Do not make consent a condition of receiving a good or service where it isn't necessary to provide that good or service.
• Keep accurate, dated records of when, where, and how each subscriber gave consent, since the burden of demonstrating a valid legal basis sits with the controller.
• Allow subscribers to withdraw consent as easily as they gave it, and stop messaging them once they do.

When using Klaviyo SMS, you need to obtain explicit consent from recipients using the guidelines above.

Check the Não Me Perturbe registry

Não Me Perturbe is a free, public do-not-disturb registry where Brazilian consumers can register their phone numbers to block unsolicited telemarketing and commercial offers from categories such as banking, telecom, and insurance. Many of the country's largest telecom, financial, and insurance companies participate in and honor the registry.

Before sending marketing SMS or making telemarketing calls to a Brazilian number, it's good practice to:

• Screen your contact list against Não Me Perturbe and suppress any matching numbers, even if you separately hold consent for that contact.
• Re-screen your list periodically, since consumers can register at any time.
• Check for and respect any relevant state-level do-not-spam registries, since requirements can vary by state.
• Remember that having consent from a subscriber does not override their registration on a do-not-disturb list — when in doubt, honor the stricter rule.

Only send during appropriate hours

As a general best practice, avoid sending marketing SMS very early in the morning or late at night, and avoid sending on national holidays. In the absence of a single, harmonized national rule for all sectors, a widely used guideline is prevent sends:

• Before 8 a.m.
• After 8 p.m.

SMS engagement also tends to be lower outside of typical daytime hours, so limiting sends to reasonable local hours is good practice from a deliverability and reputation standpoint as well as a compliance one.

Identify your brand/organization

Each text message you send to recipients in Brazil should clearly identify you as the sender. Many companies do this by including their organization's name at the start of each message.

When using Klaviyo SMS, you can automatically add your organization's name to the start of each SMS in the message editor by selecting the option in the Compliance tab (this is turned on by default).

Do not include prohibited content

Carriers and financial institutions may refuse to deliver — or flag as high-risk — SMS messages that reference certain topics, including:

• Illegal substances
• Adult content
• Firearms
• Tobacco (including CBD)
• Gambling
• Debt collection/forgiveness
• High-risk financial services (e.g., cryptocurrency, unregulated lending)
• Multi-level marketing
• Content resembling common phishing or fraud patterns (e.g., fake package delivery notices, "your CPF is blocked" style messages), which carriers increasingly filter aggressively given the prevalence of SMS-based scams in Brazil

While not all of these topics are prohibited outright, carriers and financial partners periodically reassess what they will allow, and don't always publish these changes formally or in advance. It's best to avoid content related to these topics when sending to Brazil.

Messages related to these prohibited topics may result in filtering, message blocking, or your sending number being blocked entirely. For more information, read our article on prohibited SMS content.

Allow people to opt out easily

Each text message you send to recipients in Brazil must also include a clear opt-out mechanism. Many companies do this by adding opt-out keywords such as STOP/SAIR, or via an unsubscribe link at the end of each message.

When creating an SMS in Klaviyo's message editor, you can automatically add an unsubscribe link via the option in the Compliance tab. When using Klaviyo to send SMS in Brazil, opt out is managed via an unsubscribe link only. Note that these options are turned on by default.

Do not contact users on do-not-call or do-not-disturb registries

As a guideline, don't contact anyone registered on Não Me Perturbe or another applicable do-not-disturb list. Some Brazilian states also maintain their own "do-not-spam" registries with requirements that can differ from the national registry, so check for state-specific rules that may apply to your recipients.

Additional resources