LGPD and WhatsApp (Brazil's data protection law): consent, opt-out and templates

Brazil's General Data Protection Law (Law 13,709/2018) treats a phone number and the content of conversations as personal data. Every processing activity needs a legal basis listed in the law, such as consent, contract performance or legitimate interest, plus a clear purpose, necessity (collect only what you need) and transparency toward the person.

In marketing and support practice this becomes four questions you should be able to answer for any contact: where did this number come from, what did the person authorize you to contact them for, when and how did they authorize it, and how do they ask you to stop. If the answer is "we bought a list", legal risk and the risk of reports on WhatsApp are high at the same time. See also bulk messaging and the LGPD.

Choosing the legal basis is the controller's decision and must be documented. A common map, which does not replace legal analysis, is this:

Legitimate interest requires a documented balancing test and is not a blank check for cold marketing. For anyone starting out, the simplest and most defensible route for campaigns is specific consent, asked for clearly.

Valid consent is freely given, informed and for a specific purpose. That means the box cannot come pre-checked, the text must say what the person will receive and how often, and consent for one subject does not cover all the others.

Step by step: 1) put an unchecked field of its own in the form (site, landing page, front desk, signup) saying the person agrees to receive WhatsApp messages about topics X and Y; 2) store date, time, origin (form, page, agent) and the exact text they saw; 3) confirm signup with a short first welcome message that repeats the purpose and offers the exit; 4) respect the purpose: if they asked for scheduling information, do not send a promotion for another product.

If someone challenges you, the burden of showing the authorization is on the sender. So keep a minimal table per contact: number, name, authorized purpose, date and time, origin channel, the notice text shown and the history of opt-out requests. That table is your document, and access should be restricted.

Keep what is necessary for as long as it is necessary. Defining a retention period and deleting what no longer has a purpose is also part of the law. Details on how ZapZap handles account data are on the security page.

The person must be able to leave as easily as they joined. Tell people in every campaign how to stop, for example by replying with an agreed word, and treat the request as a priority. Opt-out is your process. In practice, you receive the reply through the webhook, identify the request in your system or automation and flag the contact as "do not send" in your database before the next send.

Two hygiene rules: never reactivate without fresh consent, and check your exit list before every campaign. An ignored exit request is the most direct cause of reports, and reports drag down a number's reputation. See why WhatsApp bans numbers.

Consent request (form): "I want to receive messages from [Company] on WhatsApp about [appointments and news]. I can cancel at any time by replying STOP."

First message after signup: "Hi, [Name]! This is [Company]. You asked to receive [appointments and news] here. If you want to stop, just reply STOP."

Campaign footer: "You are getting this message because you signed up at [origin] on [date]. To stop receiving them, reply STOP."

Exit confirmation: "Done, [Name]. You will no longer get messages from [Company] here. If you change your mind, just message us."

Reply to someone asking where we got their contact: "Your number came from the signup you made at [origin] on [date]. If you prefer that we delete your data, let me know and we will take care of it." Adapt to your real process and only promise what you actually carry out.

The LGPD gives people rights such as confirmation that processing exists, access, correction and deletion, among others. Have a channel and an owner to receive these requests and an internal deadline to answer. In companies, the data protection officer usually centralizes this contact.

On the technical side, protect your API keys, never leave the secret in browser code, restrict who can access conversations and avoid putting sensitive data in message bodies. For acceptable use of the service, read the acceptable use page.

This text is general guidance. It does not replace legal advice, does not cover sector rules (health, finance, collections) and does not guarantee compliance. Compliance depends on your context, and authorities may read each case in their own way.

If your operation involves health data, children's data or high volume, have a specialized lawyer review it before you scale. And remember that the LGPD is one layer: even with perfect consent, unofficial use of WhatsApp remains subject to the platform's Terms.

Before you hit send, confirm: does the list have recorded origin and authorization? Does the message's purpose match the authorized one? Were recent exit requests removed from the list? Does the text say who is speaking and how to stop? Is whoever handles replies ready for a data deletion request?