Brazil is simultaneously one of the most challenging markets to configure SMS for and one where SMS configuration is often not the right starting point. With approximately 148 million WhatsApp users, Brazil ranks second globally in WhatsApp adoption behind only India, and WhatsApp penetration sits at well over 90% of smartphone users. For many operational programs in Brazil, the channel architecture question comes before the SMS compliance question: which audience segment needs SMS, and which segment is better served through WhatsApp with SMS as the fallback?
Business SMS in Brazil is regulated by ANATEL (Agência Nacional de Telecomunicações) for telecommunications requirements and by the LGPD (Lei Geral de Proteção de Dados) for data protection. Alphanumeric sender IDs require pre-registration that can take several weeks, often approaching ten weeks depending on the carrier and provider. Short codes are the primary A2P mechanism. Promotional SMS is generally subject to sending-hour restrictions, including overnight restrictions and an all-day Sunday prohibition. Brazil spans three time zones, which means a national promotional campaign requires time-zone-aware scheduling or recipients in Manaus will receive messages outside the permitted window while São Paulo recipients are within it.
That three-time-zone constraint is one of the most practically significant operational facts about Brazil and one of the least commonly addressed in SMS compliance guides. A program scheduled to start at 8 AM São Paulo time (UTC-3) reaches subscribers in Acre and Amazonas (UTC-5) at 6 AM, two hours before the promotional window opens for them. Getting this wrong is both a compliance exposure and a user experience problem.
The mobile market: four carriers, two that dominate
Brazil's mobile market is served by four major operators: Vivo (Telefónica), Claro (América Móvil), TIM (Telecom Italia), and Oi, which has undergone significant restructuring and sells certain operations to competitors. Vivo and Claro together hold the dominant share of the market, with TIM a significant third. Oi's network reach has contracted through its restructuring, and its status as a routing option should be confirmed with your provider before including it in route planning.
Alphanumeric sender IDs are supported on TIM, Claro, and Vivo only. Oi and smaller carriers do not support alphanumeric-originated messages. This means an alphanumeric sender ID registration covers the majority of the market but not all of it, and programs requiring universal reach should plan for short code delivery as the baseline for network segments where alphanumeric IDs are not delivered.
The provisioning timeline for alphanumeric sender IDs across Vivo, TIM, and Claro can take several weeks, often approaching ten weeks depending on the carrier and provider. This is among the longest provisioning timelines in the cluster of markets covered in this series, and it is the planning constraint that most international organizations underestimate when entering the Brazilian market. If a program needs to launch on a date, sender ID registration must begin well in advance. International routing through random numeric strings can be used during the provisioning period for some traffic types, but these do not display a brand name and may be overwritten at the carrier level.
Short codes are the primary mechanism for high-volume A2P in Brazil. Long codes, standard 10 or 11-digit numbers, are not available for A2P traffic in Brazil. Programs must route through either a registered alphanumeric sender ID, a short code, or a domestic number approved for A2P use. Understanding which routing mechanism your provider uses and whether it is carrier-approved is the first deliverability check for any Brazil program.
LGPD: Brazil's GDPR-modeled data protection framework
Brazil's Lei Geral de Proteção de Dados, enacted in 2018 and in full force since August 2021, is the country's comprehensive data protection law. The ANPD (Autoridade Nacional de Proteção de Dados) is the enforcement authority. The LGPD is explicitly modeled on GDPR in its principles and structure, which means organizations already operating GDPR-compliant programs in Europe will find the framework familiar, though Brazil-specific provisions require attention.
The LGPD applies extraterritorially. Any organization that collects or processes the personal data of individuals located in Brazil, regardless of where the organization is based, must comply. Phone numbers used for SMS programs are personal data. The law applies to your program whether your organization is based in São Paulo, New York, or London.
For SMS programs, the relevant LGPD obligations cover lawful basis for processing, consent requirements, purpose limitation, data subject rights, and breach notification. Consent under the LGPD must be freely given, informed, specific, and unambiguous. Organizations should periodically reassess whether the lawful basis for continued contact remains valid, especially after long periods of inactivity, as sustained inactivity can weaken the basis for continued processing.
LGPD fines can reach 2% of a company's revenue in Brazil, capped at R$50 million per infraction. The ANPD has been actively enforcing since 2023, with financial institutions and data brokers among the early enforcement targets. For organizations processing Brazilians' personal data from outside the country, the extraterritorial reach means the ANPD can investigate and act regardless of where the organization is incorporated.
Brazil also enforces its Consumer Defense Code (CDC) and participates in an SMS anti-spam initiative coordinated with the Federal Public Ministry. Multiple regulatory bodies can act on the same violation from different angles, which makes compliance documentation important not just for demonstrating regulatory compliance but for managing the risk of simultaneous enforcement from different authorities.
WhatsApp and SMS: designing around Brazil's channel reality
Brazil's WhatsApp penetration is not just a consumer behavior fact. It is an operational design constraint. The first question in Brazil is often not "how do I comply with SMS?" It is "should this audience receive SMS at all?" Brazil is not SMS versus WhatsApp. It is WhatsApp-first with SMS as the fallback for reach. For any program targeting urban smartphone users in São Paulo, Rio de Janeiro, or Belo Horizonte, WhatsApp is the channel where recipients are most likely to see and engage with a message. SMS is the channel where recipients are most likely to receive it regardless of data connectivity, device type, and plan.
A Brazilian messaging program designed without considering the WhatsApp layer is a program designed around the fallback. The practical architecture for most operational programs in Brazil is to attempt delivery via WhatsApp first for contacts where the recipient is known to use the channel, fall back to SMS for contacts who do not engage on WhatsApp or where data connectivity is unreliable, and use SMS exclusively for contacts in lower-connectivity regions or on feature phones.
For transactional programs, including payment confirmations, appointment reminders, OTP delivery, and account alerts, the channel sequence matters less because both WhatsApp and SMS deliver these reliably. The compliance picture for WhatsApp in Brazil runs through Meta's Business verification and template approval process rather than ANATEL's SMS framework. Both channels require LGPD-compliant consent handling, but the channel-specific requirements differ.
For operational communications involving staff, contractors, or field teams, communication orchestration across SMS and WhatsApp within the same workflow is the natural architecture. A dispatch notification might go to WhatsApp for staff on smartphones with active data plans, and to SMS for those in field locations or with inconsistent connectivity.
One practical point worth naming directly: in Brazil, the wrong channel strategy can look like a compliance problem. Low SMS engagement may not mean the list is bad or the route is broken. It may mean the audience expects WhatsApp first and SMS only when reach matters more than engagement. Before diagnosing a deliverability or consent issue, check whether the channel itself is the mismatch.
The three-time-zone scheduling problem
Brazil spans three main time zones, and the promotional SMS window of 9 AM to 10 PM applies to each recipient's local time, not the sender's time zone. This creates a scheduling constraint with real operational implications for national programs.
The three zones are: Brasília Time (BRT, UTC-3), covering the majority of the country including São Paulo, Rio de Janeiro, Brasília, Belo Horizonte, and most of the northeast. Amazon Time (AMT, UTC-4), covering most of Amazonas, Roraima, Rondônia, Mato Grosso, and Mato Grosso do Sul. Acre Time (ACT, UTC-5), covering the state of Acre and a portion of Amazonas.
Promotional SMS is generally subject to sending-hour restrictions and should not be sent before 9 AM or after 10 PM in the recipient's local time zone, and not at all on Sundays. A campaign launched at 8:30 AM São Paulo time reaches AMT contacts at 7:30 AM and ACT contacts at 6:30 AM, both before the generally expected promotional window opens for them. National campaigns that do not account for time zone distribution create exposure for a portion of the list on every send.
The practical solution for high-frequency promotional campaigns is to segment by time zone and schedule delivery for 9:30 AM or later in each zone's local time. For transactional and operational messages without the promotional window restriction, time zone management is a user experience consideration rather than a compliance requirement, but the principle of not messaging at antisocial hours applies in Brazil as it does across all markets in this cluster.
Sundays are fully prohibited for promotional SMS regardless of time zone. Marketing campaigns must pause for the full day, not just outside standard business hours.
Opt-out in Portuguese: PARE and related keywords
Portuguese-language opt-out keywords must be supported in any Brazil SMS program. PARE (STOP in Portuguese) is the primary opt-out keyword and should be honored promptly upon receipt. Related keywords including SAIR (exit), CANCELAR (cancel), and equivalent phrases should also be processed as opt-out requests when received.
Brazil does not maintain a centralized DND registry equivalent to Mexico's REPEP or Nigeria's 2442 system. Opt-out management is therefore entirely the program's responsibility. Suppression lists must be checked before every send, and contacts who have opted out must not receive subsequent marketing messages regardless of how they appear in a contact database.
Consent records should document the date, source, and method of opt-in for each contact. For LGPD compliance, these records serve as the documentation of the lawful basis for processing and must be available for ANPD review if a complaint is filed.
Multi-market programs and BYOC architecture
For organizations running messaging programs in Brazil alongside the US, Mexico, or other markets, the compliance requirements and platform implications align with the broader multi-market design principle: consent records, suppression lists, and delivery logs should belong to the organization, not to a specific connectivity provider.
BYOC architecture means your LGPD-documented consent records and your suppression list travel with the program regardless of which provider carries traffic to Vivo, Claro, or TIM. When route performance changes or sender ID provisioning needs to be updated after the ten-week registration cycle, the program logic and data stay intact. For a program running simultaneously in Brazil, Mexico, and the US, the same platform layer handles the Brazil LGPD documentation, the Mexico REPEP verification, and the US 10DLC registration without requiring separate systems for each market.
For organizations adding Brazil to an existing multi-market program, the sender ID provisioning timeline is the planning constraint to build around from day one. Everything else, LGPD consent documentation, time-zone scheduling logic, WhatsApp-SMS sequencing, Portuguese opt-out handling, can be configured in days. The sender ID is the long lead item.
Frequently asked questions
How long does sender ID registration take in Brazil? Sender ID provisioning across the major carriers can take several weeks, often approaching ten weeks depending on the carrier and provider. This is among the longest provisioning timelines in the Latin America cluster and the primary planning constraint for Brazil market entry. Registration should begin well before the intended program launch date. Oi's routing status should be confirmed with your provider during planning.
What are the permitted hours for marketing SMS in Brazil? Marketing SMS may not be sent before 9 AM or after 10 PM in the recipient's local time zone, and not at all on Sundays. Brazil spans three time zones, which means national campaigns require time-zone-aware scheduling to ensure all recipients receive messages within their permitted window. Transactional and operational messages arising from an existing relationship are generally not subject to the same restriction, though best practice is to avoid messaging at antisocial hours regardless.
Does the LGPD apply to my organization if I am based outside Brazil? Yes. The LGPD has explicit extraterritorial reach and applies to any organization that collects or processes personal data of individuals located in Brazil, regardless of where the organization is established. Phone numbers used for SMS programs are personal data. The ANPD can investigate and take enforcement action against organizations based outside Brazil.
Should I send WhatsApp or SMS in Brazil? Both, with channel choice driven by recipient connectivity and program type. Brazil has approximately 148 million WhatsApp users and penetration exceeding 90% of smartphone users, making it the second largest WhatsApp market globally. For urban, smartphone-connected audiences, WhatsApp is often the primary engagement channel. SMS provides guaranteed reach across all devices and connectivity levels, including feature phones and areas with intermittent data. Most operational programs in Brazil benefit from a sequenced approach: WhatsApp first where available, SMS as fallback.
What opt-out keywords are required in Brazil? PARE is the primary Portuguese-language stop keyword and should be honored promptly upon receipt. Related keywords including SAIR and CANCELAR should also be recognized as opt-out requests. Brazil does not have a centralized DND registry, so opt-out list management is entirely the program's operational responsibility.
This article provides general operational information and should not be considered legal advice. Organizations should consult qualified legal or data protection professionals regarding their specific compliance obligations under Brazilian telecommunications and data protection law.
Talk to our team about building a compliance-ready SMS and multi-channel messaging program for Brazil and across your operating markets.
