How Does Brazil's LGPD Affect Meta Ads?

The LGPD (Lei Geral de Proteção de Dados Pessoais) is Brazil’s data protection law. Its text covers processing of personal data of people in Brazil, and it can reach companies based elsewhere. Meta’s help page says that from a technical standpoint businesses can keep using its tools the same way, but they are responsible for their own LGPD compliance. This page reports what the law’s own page and Meta’s pages say, as checked on 2 Oct 2026. It is not legal advice: read the sources and ask a qualified adviser.

Does the LGPD reach your ads?

Article 3 says the law applies to any processing operation, regardless of the medium, the country of the company’s seat or where the data are located, if one of three things is true. The processing happens in Brazil. The activity aims to offer goods or services to, or process data of, individuals located in Brazil. Or the data were collected in Brazil. Meta’s page says the LGPD applies to companies that process data about individuals in Brazil.

The text does not name online advertising: it uses “publicidade” only for publicizing processing operations or a consent exemption, and never “propaganda”, “marketing” or “anúncio”. Whether a campaign is covered is for your adviser.

What counts as personal and sensitive data?

Article 5 defines personal data as information related to an identified or identifiable natural person. It defines sensitive personal data as data on racial or ethnic origin, religious belief, political opinion, membership of a union or of a religious, philosophical or political organization, health or sex life, and genetic or biometric data, when linked to a person. Article 11 sets separate conditions for sensitive data, starting with specific and highlighted consent for specific purposes.

Meta’s business tools page says health information, financial information and other categories that may be considered sensitive under applicable laws must not be shared with Meta through its business tools. The entry on personal attributes covers the ad rules.

What you can do: list which events, audiences and forms could hold sensitive data, and keep them out of Meta.

What legal bases does the LGPD list?

Article 7 lists ten situations in which personal data may be processed. They include consent, a legal or regulatory obligation, performance of a contract at the person’s request, the legitimate interests of the controller or a third party (unless the person’s fundamental rights prevail) and credit protection. So consent is one basis among several, and which fits your case is a legal judgement.

What does the law say about consent?

Article 8 says consent must be given in writing or by another means that shows the person’s will. The controller carries the burden of proving that consent was obtained under the law. Consent must refer to specific purposes, and generic authorizations are void. The person can revoke consent at any time by a free and easy procedure.

Meta’s business tools page says you need a lawful basis and any necessary consents before sharing information with Meta, and that nothing should reach Meta before the person has consented where consent is required.

What you can do: keep a record of when and how each person consented, and make withdrawal as easy as agreeing.

What rights do people have, and who answers?

Article 18 lets a person ask the controller to confirm it processes their data, give access, correct it, delete unnecessary data, port it and revoke consent. Requests are served at no cost, in the terms of the regulations. Article 41 says the controller must name a data protection officer (the “encarregado”), and publish the officer’s identity and contact details, preferably on its website.

What can the law do to a company that breaks it?

Article 52 lists sanctions applied by the national data protection authority, the ANPD, including a warning, a simple fine of at most 2% of the company’s, group’s or conglomerate’s revenue in Brazil in its last financial year (excluding taxes), limited in total to R$50,000,000 per infraction, publicizing the infraction, and blocking or deleting the data concerned.

What differs from other places, and what does not?

The LGPD’s text, consent rules and authority are specific to Brazil. Meta’s business tools page says its requirements apply to all Meta business tools, and it links to a GDPR page as well as the LGPD one. Its limited data use page, as checked on 2 Oct 2026, lists only US states.

FAQ

Does the LGPD apply if my company is outside Brazil?

Article 3 says the law applies regardless of the country of the company’s seat if the processing happens in Brazil, aims to offer goods or services to people located in Brazil, or concerns data collected there. Whether you meet a condition is for a qualified adviser.

Do I always need consent to use data in Meta ads?

Not according to the law’s text: Article 7 lists ten legal bases, and consent is one of them. Meta separately asks you to have a lawful basis and any necessary consents before sharing data with it. Check Article 7 and Meta’s page, and ask your adviser which basis you rely on.

Who enforces the LGPD?

Article 52 says sanctions are applied by the national authority (autoridade nacional), and Article 55-A creates it as the Autoridade Nacional de Proteção de Dados, ANPD. Article 52 adds that sanctions follow an administrative procedure that allows full defence.