Brazilian companies should treat LGPD email marketing consent as a proof problem, not just a checkbox problem. Between Brevo and Mailchimp, both platforms can support compliant consent capture, but neither makes purchased email lists safe. For most Brazilian senders, the better choice depends on how much control the company needs over consent records, forms, segmentation, and audit trails.
TLDR: Under Brazil’s LGPD, email marketing usually needs a valid legal basis, clear notice, and an easy opt-out. A purchased list is high risk because the sender often cannot prove valid consent or fair data use. For example, if a retailer buys 50,000 Brazilian B2C contacts and only 1.5% complain, that still means 750 complaints hitting deliverability, brand trust, and legal exposure. Brevo is often stronger for cost-conscious teams managing simple consent flows, while Mailchimp is stronger for polished campaign workflows and reporting, but both reject bought or scraped lists.
LGPD email consent: what Brazilian marketers must prove
The Lei Geral de Proteção de Dados, or LGPD, does not use the exact same consent model as every privacy law. It allows several legal bases for data processing. For email marketing, companies often rely on either consent or legitimate interest, depending on the context.
That sounds flexible. The catch is that flexibility does not mean “send to anyone.” The sender still needs to show that the data was collected fairly, that the person received clear information, and that opting out is simple.
For consent, LGPD expects it to be:
- Free: not forced or hidden inside unrelated terms.
- Informed: the person understands who will send emails and why.
- Specific: broad permission for “partners” or “offers” may be weak.
- Recorded: the company can show when, where, and how consent was given.
For legitimate interest, the sender should have a documented reason, a low privacy impact, and an easy unsubscribe option. Existing customer marketing may fit better than cold outreach to strangers. Still, B2C promotional blasts to unknown contacts are hard to defend.
Image not found in postmeta
Purchased email lists under LGPD
Purchased email lists are the problem child. They may look cheap. They may promise fast reach. They may even claim to be “LGPD compliant.” In practice, they often create weak evidence and strong risk.
A list seller may say that contacts agreed to receive third-party offers. That is rarely enough. The buyer must still prove that each person received clear notice about the buyer’s type of marketing, the data transfer, and the purpose of use. If the buyer cannot prove that, the campaign becomes risky.
Common problems include:
- No original consent record tied to the sender.
- Vague permission language, such as “selected partners.”
- Old data with stale addresses and changed preferences.
- No audit trail for source, timestamp, IP address, or form copy.
- Higher spam complaints, which hurts deliverability fast.
It drives many teams crazy that one purchased campaign can damage sender reputation in days, while rebuilding domain trust can take weeks or months. A list that costs little upfront can become expensive very quickly.
Brevo for LGPD consent management
Brevo, formerly Sendinblue, is a strong option for companies that want forms, contact attributes, segmentation, and transactional email in one place. It supports subscription forms, double opt-in workflows, unsubscribe links, consent fields, and list management.
Brevo can work well for a Brazilian business that collects email addresses through checkout pages, lead magnets, webinars, WhatsApp follow-ups, and website forms. The platform allows teams to store custom fields, such as consent source or consent date, if the setup is planned properly.
Best Brevo strengths for LGPD:
- Flexible forms for newsletter signups and lead capture.
- Double opt-in options to strengthen proof of consent.
- Contact segmentation based on source, language, region, or consent status.
- Transactional email support for receipts, confirmations, and account notices.
- Competitive pricing for senders focused on email volume.
Brevo also has anti-spam rules. It generally requires permission-based lists and does not approve purchased, rented, scraped, or third-party lists. That matters. Even if a company wants to upload bought contacts, the platform’s rules may block or suspend the account after high bounce rates or complaints.
The annoyance is in the setup. Consent tracking often needs custom fields and careful form design. If a team imports contacts without mapping sources and dates, the account may contain contacts but not enough proof.
Mailchimp for LGPD consent management
Mailchimp is popular because its campaign builder, templates, reporting, and audience tools are easy for non-technical teams. It offers signup forms, landing pages, tags, groups, segments, unsubscribe handling, and consent-friendly form fields.
For companies with a content team, Mailchimp usually feels polished. Reports are clear. A/B testing is accessible. Audience engagement metrics are easy to read. For a Brazilian brand with newsletters, product updates, and customer education campaigns, that can save time.
Best Mailchimp strengths for LGPD:
- Signup forms with customizable consent language.
- Audience tags and segments for consent source and campaign type.
- Marketing permissions that can separate email, ads, and other channels.
- Clear unsubscribe tools included in campaigns.
- Strong reporting for opens, clicks, bounces, and complaints.
Mailchimp also prohibits purchased, rented, scraped, and third-party email lists. Its compliance systems are known to react strongly to bad data. A sudden import of cold contacts can trigger warnings, low deliverability, or account review.
Image not found in postmeta
Brevo vs Mailchimp: consent and list risk comparison
| Area | Brevo | Mailchimp |
|---|---|---|
| Purchased lists | Not allowed under anti-spam rules | Not allowed under anti-spam rules |
| Consent capture | Good with forms and custom fields | Good with forms and marketing permissions |
| Double opt-in | Available and useful for proof | Available and useful for proof |
| Ease of reporting | Solid, practical reporting | Often stronger for campaign analytics |
| Cost fit | Often attractive for higher email volume | Can cost more as audiences grow |
For LGPD consent, neither platform magically creates compliance. The platform records what the company collects. If the form is vague, the proof is vague. If the list is bought, the risk stays with the sender.
Which platform should a Brazilian business choose?
Brevo is often the better fit when the business wants practical consent forms, automation, transactional email, and lower sending costs. It suits ecommerce stores, SaaS tools, and companies with frequent operational emails.
Mailchimp is often better when the marketing team values design, campaign reporting, audience engagement tools, and an easier editorial workflow. It suits newsletters, content marketing, retail promotions, and brand campaigns.
A safe LGPD setup should include:
- Clear signup text naming the sender and message type.
- Separate consent for marketing when practical.
- Double opt-in for higher-risk lead sources.
- Stored proof of source, date, form, and IP address where available.
- Easy unsubscribe in every marketing email.
- Suppression lists to avoid re-adding unsubscribed contacts.
- Regular list cleaning to remove inactive or invalid contacts.
Best practice for purchased contacts
The safest answer is simple: do not upload purchased email lists into Brevo or Mailchimp. A company that already bought a list should avoid blasting it. A better path is to run ads, gated content, events, referral campaigns, or partner campaigns where the contact chooses to subscribe directly.
If a partner is involved, the partner should send the first message to its own opted-in audience. The Brazilian company can invite people to sign up on its own form. That creates a cleaner record and lowers complaint risk.
FAQ
Does LGPD require consent for every marketing email?
No. LGPD allows more than one legal basis, including consent and legitimate interest. Still, the sender must provide notice, respect opt-outs, and keep evidence. Consent is usually safer for newsletters, lead magnets, and cold promotional campaigns.
Are purchased email lists legal in Brazil?
They are high risk. A purchased list may fail LGPD standards if the buyer cannot prove clear, specific, and valid permission for that buyer’s marketing. Platform rules may also prohibit the upload.
Does Brevo allow purchased email lists?
No. Brevo’s anti-spam rules require permission-based contacts. Purchased, rented, scraped, or third-party lists can lead to deliverability problems or account action.
Does Mailchimp allow purchased email lists?
No. Mailchimp does not allow purchased, rented, scraped, or third-party lists. A cold import with high complaints can trigger account review or suspension.
Which is better for LGPD, Brevo or Mailchimp?
Brevo is often better for cost control, automation, and transactional emails. Mailchimp is often better for campaign design and reporting. For LGPD, the real winner is the setup with the strongest consent records.
What should a company record for consent?
It should record the email address, consent date, signup source, form text, campaign purpose, IP address where available, and any later opt-out. This record helps prove fair data use under LGPD.