Is bulk sending on WhatsApp a crime? What Brazilian law, the LGPD, and the CDC say
By José Pedro · Co-founder of CRPRO
Volume isn't a crime under Brazilian law; content can be. See how a Meta ban, an LGPD administrative fine, and criminal liability are three separate tracks, what legal basis you need before sending, and why consent you already have probably doesn't hold up.
Bulk sending on WhatsApp isn't a crime in Brazil: there's no criminal statute in Brazilian law that describes the act of sending a lot of commercial messages. What does exist, and is far more likely to catch up with whoever sends, is a different set of risks — sending to someone who never authorized it is an administrative and civil violation (under the LGPD, Brazil's data protection law, and the Consumer Protection Code, the CDC) and a breach of contract with Meta. Criminal liability only shows up when the message's content, not its volume, fits a criminal statute: fraud, false identity, or using a list obtained through a system breach.
Confusing these regimes is the most expensive mistake in the industry: they have different judges and different penalties, and you can be in the clear on one while violating the other. This piece explains the rules and doesn't replace a lawyer.
What's the difference between a Meta ban, an LGPD fine, and a crime?
| Meta's Terms | LGPD and CDC | Criminal law | |
|---|---|---|---|
| Nature | Private contract | Administrative and civil rules | Criminal statute |
| Who enforces it | Meta itself | ANPD (Brazil's data protection authority), Procon (consumer protection agency), the Public Prosecutor's Office, the courts | Police, the Public Prosecutor's Office, the courts |
| What you lose | The number and its history | Money and the database | Freedom |
| Requires a proceeding? | No | Yes (administrative or judicial) | Yes |
| Applies to | Anyone using WhatsApp | Anyone processing personal data in Brazil | Anyone committing the criminal act |
The practical implication: a ban isn't a conviction, and a conviction doesn't come from a ban. They're parallel tracks. The same send can take down the number the same day with no legal proceeding at all — or sail through Meta unscathed and turn into a filing with ANPD months later, when a recipient complains.
What does Meta do to whoever sends without opt-in?
Meta doesn't need a judge to shut off your number. Its commercial policy requires opt-in — contacting only people who gave you the number and gave permission to receive messages. Break the contract, lose access.
On the regular app and on WhatsApp Business for phones, this happens with no advance warning: the number simply stops. On unofficial apps like GB WhatsApp, you're already violating the Terms from the start. If it's already dropped, the review is in WhatsApp banned: what to do.
On the official API, the risk doesn't disappear: Meta keeps deactivation states and can penalize an official number too. What changes is the process — per-number quality rating, a warning before the penalty, and a formal appeal. That rating is calculated over the last 7 days, on a weighted basis (per Meta's documentation, checked as of August 2026), based on blocks and reports from recipients. It's contractual due process, not immunity.
When does bulk sending turn into a crime?
Volume isn't a crime; content can be. Three criminal statutes come up frequently in bulk-sending operations:
| Criminal statute | Legal basis | When it applies |
|---|---|---|
| Fraud by electronic means | Article 171, §2º-A of Brazil's Penal Code, added by Law 14,155/2021 — 4 to 8 years imprisonment | When the fraud uses phone contact, a social network, or a similar channel. This is the classic charge for a WhatsApp scam |
| False identity | Article 307 of the Penal Code | When the sender poses as another company or person |
| Unauthorized access to a computer system | Article 154-A of the Penal Code | When the list was obtained by breaching a system or someone else's device |
Notice what's not on the table: the LGPD carries no criminal penalty. Violating the data protection law doesn't lead to prison — it leads to fines, having your database blocked, and civil liability claims.
What does the LGPD require before the first send?
The LGPD (Law 13,709/2018) is the regime that fines — and the one most people ignore, looking only at ban risk. A phone number is personal data (art. 5, I): every send is data processing, and processing with no legal basis under art. 7 is irregular by definition. Before picking the tool, pick the legal basis:
| Message type | Usual legal basis | Watch out for |
|---|---|---|
| Order confirmation, delivery notice, billing on an active contract | Contract performance (art. 7, V) | Can't turn into a disguised offer |
| Campaign to an existing customer | Legitimate interest (art. 7, IX) or consent | Legitimate interest requires a documented balancing test (art. 10) |
| Campaign to a lead who filled out a form | Consent (art. 7, I) | You need to prove when and for what purpose |
| Purchased or scraped list | None | There's no legal basis that holds up |
There's no generic basis for "marketing campaign": the basis changes depending on your relationship with the recipient and the purpose of that specific message.
Why does the consent you already have probably not hold up?
Three provisions in the law take down most operations.
Generic authorization is void. Art. 8, §4 requires consent for specific, determined purposes. "I agree to receive communications" in the fine print of a sign-up form doesn't cover a third party's campaign.
The burden of proof is yours. Art. 8, §2 requires the data controller to prove the consent was valid. Without a record of the date, source, and the exact text shown, there's nothing to present — a CRM that logs the origin of every contact stops being a convenience and becomes evidence.
Sharing requires fresh consent. Art. 7, §5 requires specific consent to share data with other controllers. This is the provision that makes selling a mailing list indefensible: whoever gave their number to Company A never authorized Company B.
Does legitimate interest work as a basis for marketing?
It works as its own basis (art. 7, IX), but it isn't a wildcard. Art. 10 ties its use down: concrete purposes, data that's strictly necessary, and an impact report that ANPD can demand. In practice, you need to keep a written balancing test — covering the purpose and the data subject's legitimate expectation — before the campaign goes out. Invoking the term after the complaint doesn't produce the document that was missing.
And legitimate interest never reaches someone who never had a relationship with the company. A purchased list still has no legal basis, with or without the argument.
How does opt-out need to work?
Art. 8, §5 requires that consent can be withdrawn at any time, through a free and easy procedure. Art. 18, §2 adds a right to object when processing done without consent breaks the law. Translated to your operation: if joining the list costs one click, leaving can't cost an email to the legal department.
The obligation applies equally to the regular app's broadcast list: a simple tool doesn't mean a lesser obligation. And Brazil's Do Not Disturb registry doesn't solve this for you — it was designed for telemarketing and regulated sectors, it isn't a general WhatsApp opt-out.
What the Consumer Protection Code adds
When the recipient is a consumer, an extra layer kicks in: art. 6, IV protects against abusive advertising and unfair commercial practices, and art. 39, IV bars taking advantage of a consumer's weakness to push products.
One correction that rarely comes up: art. 39, III gets misquoted constantly. It bans "sending or delivering to the consumer, with no prior request, any product, or providing any service" — the object is a product or a service, not a marketing message. For bulk sending, the sturdier provision is art. 43, §2: opening a consumer data record not requested by them must be reported to them in writing. Whoever buys a mailing list opens a record without reporting it.
Add Brazil's Marco Civil da Internet (Law 12,965/2014), art. 7, VII: providing data to third parties requires free, express, and informed consent.
What penalties can ANPD apply?
Art. 52 of the LGPD (text in effect as of August 2026) is broader than the fine everyone quotes:
| Penalty | Scope |
|---|---|
| A warning with a deadline to fix things | First step |
| A simple fine | Up to 2% of revenue in Brazil, capped at R$50 million per violation |
| A daily fine | Accumulates until the fix |
| Publicizing the violation | Reputational damage |
| Blocking or deleting the data | You lose the base |
| Suspending the database or the activity | Up to 6 months |
| Banning the processing activity altogether | The final step |
For anyone who lives off WhatsApp, "deleting the data" usually hurts more than the fine. Add individual liability claims on top, whose outcomes vary between courts.
Being within Meta's Terms doesn't protect you from the law
You can operate on the official API, with an approved template, a respected 24-hour window, and a green quality rating — and still be sending to a purchased list. Meta doesn't know where the number came from; ANPD and Procon do, when someone complains.
The reverse also holds: legally flawless opt-in doesn't prevent a block, because that's decided by the platform's quality system, measured by blocks and reports from recipients over the last 7 days. They're two separate obligations; meeting one doesn't excuse you from the other.
Minimum checklist before you send
- Log the source of every number — date, channel, and the exact consent text. Without this you have no proof.
- Write down the legal basis for each campaign before sending.
- Discard purchased lists. With no legal basis there's no defense, and the report risk is the highest.
- Offer an opt-out in every active message and process the request — an ignored opt-out is a violation and turns into a report.
- Publish your privacy policy with purpose, retention, and a channel for data subjects; CRPRO's LGPD page works as a reference.
- Take specific cases to a lawyer if you operate in a regulated sector, do collections, or handle sensitive data. The operational side is in how to bulk-send without burning the number.
If your base grew with no record of its origin, the CRM fixes that before legal gets involved: CRPRO logs origin, consent, and opt-out per contact, on the official API or QR code.
Frequently Asked Questions
Can bulk sending on WhatsApp land you in jail?
Not by itself. There's no crime of bulk sending under Brazilian law. Criminal liability shows up through the content — electronic fraud (art. 171, §2º-A of the Penal Code), false identity, or using a list obtained through a breach. The LGPD carries no prison sentence.
Is buying a contact list illegal?
Using it is. Art. 7, §5 of the LGPD requires the data subject's specific consent for their data to be shared with another controller, and art. 8, §4 voids generic authorizations. A purchased list carries neither, so there's no legal basis to support the send.
Does using the official API make me LGPD-compliant?
No. The official API settles your contractual relationship with Meta: a verified number, an approved template, a visible quality rating, and a formal appeal if penalized. It says nothing about where your contacts came from, which is what the LGPD checks. They're independent kinds of compliance.
Do I need consent to send a transactional message?
Not always. Order confirmations, delivery notices, and communications about an active contract usually rest on contract performance (art. 7, V), which doesn't require consent. The limit is the content: if the message includes an offer, it stops being transactional and needs a different legal basis.
Can a customer sue me over an unsolicited message?
They can file a civil liability claim, and the outcome varies between courts: some rulings see mere annoyance, others recognize damages. The more common route, though, is a complaint to Procon or a filing with ANPD — which hits the whole operation, not just that one contact.
Who actually enforces this?
ANPD applies the penalties under art. 52 of the LGPD, Procon acts under the CDC, the Public Prosecutor's Office can file a public civil action, and the data subject can go to court on their own. Meta, in parallel, enforces its own contract independently of all three.