A market intelligence team in São Paulo runs a weekly crawl across twelve Brazilian marketplaces, three classifieds portals, and a handful of review sites. The output feeds a pricing dashboard the commercial team checks every Monday. Nobody on the team considers this a privacy project. Then legal asks a simple question: what happens to the seller names, store addresses, and reviewer handles sitting in the raw JSON?
That question is where most Latin American data collection programmes meet the Lei Geral de Proteção de Dados Pessoais for the first time. LGPD (Law No. 13.709/2018) has been in force since September 2020, with administrative sanctions applicable since August 2021, and the Autoridade Nacional de Proteção de Dados (ANPD) has spent the years since moving from guidance to enforcement. Scraping is not illegal under LGPD. Scraping without a documented legal basis, without minimisation, and without control over where the data ends up is a different matter.
This guide is written for the people who actually build and run these pipelines: data engineers, research leads, and the compliance partners who have to sign off. It covers how LGPD applies to automated collection, how the rest of the region differs, and why the proxy layer is a compliance surface rather than a neutral plumbing detail.
What LGPD Actually Covers, and Why Scrapers Are In Scope
LGPD is a general data protection law modelled closely on the European framework, with Brazilian adaptations. It applies to any processing operation carried out by a natural person or legal entity, regardless of the medium, the country where the controller is headquartered, or the country where the data is stored.
Three triggers in Article 3 matter for collection teams. Processing is covered if the operation is carried out in Brazilian territory, if the purpose is to offer or supply goods or services to individuals located in Brazil, or if the personal data being processed was collected in Brazil. That third trigger is the one that catches scrapers. A team operating entirely from Mexico City or Lisbon that crawls Brazilian sites and pulls data about people in Brazil is processing data collected in Brazil. The server location does not save you.
Personal data is broader than engineers assume
LGPD defines personal data as information relating to an identified or identifiable natural person. There is no closed list. In a typical commercial crawl, the following items are routinely personal data even though nobody set out to collect them:
- seller display names, store names that include a person's name, and CNPJ or CPF fragments exposed on listing pages;
- reviewer usernames paired with purchase history, location hints, or photographs;
- contact phone numbers and email addresses published on classifieds listings;
- job posting contacts, broker names on real estate portals, and profile URLs from professional networks;
- IP addresses and device identifiers captured in your own logs during the crawl.
Sensitive personal data gets stricter treatment: racial or ethnic origin, religious belief, political opinion, trade union or religious organisation membership, health, sex life, and genetic or biometric data. Review text and social listening corpora frequently contain all of these in free form. If your NLP pipeline enriches reviews with inferred sentiment about health conditions, you have crossed into sensitive data territory whether or not anyone intended to.
The "It Is Public, So It Is Fair Game" Myth
The single most common misreading of LGPD inside scraping teams is that public availability removes the law. It does not.
Article 7, paragraph 3, says that processing of personal data whose access is public must consider the purpose, the good faith, and the public interest that justified making it available. Paragraph 4 waives the consent requirement for data made manifestly public by the data subject, but explicitly preserves the data subject's rights and all the principles of the law.
Read carefully, those clauses do two things. They spare you from chasing consent for genuinely public information. They also bind you to the original purpose of publication. A phone number published so buyers can contact a seller about a sofa was not published so that you could build a national contact database for outbound sales. Repurposing public data beyond its original context is exactly the behaviour those paragraphs were drafted to restrain.
The practical rule for research teams: public availability changes which legal basis is available to you, not whether LGPD applies at all. Every other obligation, which means the principles in Article 6, data subject rights, security duties, and accountability, still stands.
Choosing a Legal Basis Before the Crawler Runs
Article 7 sets out ten legal bases for processing non-sensitive personal data. For market research, only a few are realistic.
Legitimate interest is the workhorse, and it has conditions
Legitimate interest (Article 7, item IX, developed in Article 10) is where most commercial research lands. It permits processing to support the controller's or a third party's legitimate interests, provided fundamental rights and freedoms are not overridden. Article 10 requires that processing be limited to what is strictly necessary for the stated purpose and that the controller adopt transparency measures.
This is a documented balancing exercise, not a checkbox. A workable record covers the specific interest being pursued (competitive pricing analysis for a named product line, not "business intelligence"), why scraped data is necessary and why a less intrusive route will not serve, what the realistic impact on the individuals is, and what safeguards reduce that impact. ANPD can request a Relatório de Impacto à Proteção de Dados Pessoais, the Brazilian data protection impact report, where legitimate interest is the basis. Writing it before the crawler ships is dramatically cheaper than writing it under a request for information.
Consent is usually the wrong tool here
Consent under LGPD must be free, informed, unambiguous, and tied to a specific purpose. You cannot obtain it from people whose data you are scraping without contact, and a consent banner on your own website does not cover third party data subjects. Teams that claim consent as the basis for scraped personal data are almost always claiming something they cannot evidence.
Hard stops worth writing into the crawler config
Sensitive data generally requires specific and highlighted consent or one of the narrow exceptions in Article 11. Children's and adolescents' data under Article 14 carries its own regime around best interests and parental consent. The pragmatic engineering answer is to exclude these categories at ingest rather than to collect first and filter later. A field level allowlist in your parser is a compliance control, not just a schema decision.
Building Compliance Into the Pipeline, Not Around It
Compliance programmes that live in a PDF do not survive contact with a production scraper. The controls that hold up are the ones encoded in the pipeline.
Classify at ingest. Tag every extracted field as non-personal, personal, or sensitive at the parser level. Downstream storage, retention, and access policies key off that tag. Without it, nobody can answer a data subject request six months later.
Minimise aggressively. The principle of necessity in Article 6 means collecting only what the purpose requires. If the pricing model needs price, SKU, availability, and store rating, the seller's personal name should never enter the warehouse. Discarding at parse time is far stronger than redacting at query time.
Pseudonymise early. Hashing reviewer identifiers with a salted function preserves longitudinal analysis while reducing exposure. LGPD recognises anonymisation as taking data outside its scope, but the bar is genuine irreversibility considering reasonable effort and available technology. Treat most pseudonymised sets as still in scope.
Set retention that someone enforces. Raw HTML archives are the quiet liability in most scraping stacks. Teams keep them "for reprocessing" indefinitely. Pick a window, automate deletion, and log it.
Maintain processing records and appoint an encarregado. Article 37 requires controllers and operators to keep records of processing operations. Article 41 requires appointing a data protection officer, the encarregado, whose identity must be publicly disclosed. ANPD has issued guidance easing the formality for small processing agents, but the records obligation remains the backbone of accountability.
Publish a route for data subject rights. Article 18 gives individuals rights to confirmation, access, correction, anonymisation or deletion of unnecessary or non-compliant data, portability, and information about data sharing. If your organisation scrapes personal data, someone has to be able to search for it and act on a request within the statutory response expectations.
Cross Border Transfers: Getting Brazilian Data Into a Global Stack
Most research pipelines are not Brazil-only. Data lands in a warehouse in Virginia or Frankfurt, gets enriched by a model hosted somewhere else, and is read by analysts on three continents. Chapter V of LGPD (Articles 33 to 36) governs that movement.
Transfers are permitted to countries with an adequate level of protection as recognised by ANPD, or where the controller provides guarantees through specific contractual clauses, standard contractual clauses, global corporate rules, or seals and certificates. In August 2024, ANPD approved Resolution CD/ANPD No. 19, establishing the Brazilian standard contractual clauses and setting a transition period for existing contracts to be brought into line. Adequacy recognitions remain limited in practice, so for most teams the contractual route is the operative one.
Two practical consequences follow. First, your cloud provider, your enrichment vendor, and your proxy provider are all part of the transfer map and each needs a documented basis. Second, the clauses are not interchangeable with European ones by default. Legal teams that lifted their GDPR paperwork and relabelled it tend to discover gaps around the Brazilian specific wording and the role definitions of controller, operator, and encarregado.
One Pipeline, Many Regimes: The Rest of Latin America
Research teams rarely stop at the Brazilian border, and the regional picture is moving quickly.
Mexico replaced its federal data protection framework in 2025, with oversight shifting to the federal executive following the dissolution of INAI. Teams that built relationships with the old regulator need to re-verify notification and complaint routes.
Chile enacted Law 21.719 in December 2024, a European style overhaul that creates a dedicated data protection agency and introduces materially higher sanctions. It takes effect after a transition period, which makes 2026 the planning year rather than the reaction year.
Colombia operates under Law 1581 of 2012, supervised by the Superintendencia de Industria y Comercio, with a national database registry obligation that catches organisations other jurisdictions would leave alone.
Argentina and Uruguay both hold long standing recognition from the European Commission, with Argentina's framework dating to Law 25.326 and reform proposals circulating for several years.
Peru and Ecuador have both tightened implementation recently, with Peru's updated regulation of Law 29733 and Ecuador's sanctions regime now active.
The operational takeaway is not to build five pipelines. It is to build one pipeline with per-country policy flags: which fields may be collected, which retention window applies, which transfer mechanism covers the destination, and which regulator receives notification if something goes wrong.
Enforcement Reality and the Mistakes That Attract It
ANPD sanctions under Article 52 include warnings, fines of up to 2 percent of the revenue of the company or group in Brazil for the previous financial year, capped at R$50 million per infraction, daily fines, publicisation of the violation, blocking or deletion of the personal data involved, and partial or total suspension of database operations. The suspension power is the one that should concentrate minds in data teams: a research programme whose database is frozen stops delivering value immediately.
ANPD's enforcement posture has become visibly more active, including preventive measures against large platforms over the use of Brazilian personal data for model training and over biometric collection practices. The pattern in those actions is consistent: the authority focuses on purpose, transparency, and whether individuals could reasonably have anticipated the processing.
The recurring mistakes worth naming:
- Treating LGPD as a legal-only project. The controls that matter live in the parser, the warehouse schema, and the retention job.
- Collecting everything "in case it is useful later". This directly contradicts the necessity principle and inflates breach exposure.
- Ignoring non-privacy exposure. Terms of service, copyright under Law 9.610/1998, unfair competition provisions, and the Marco Civil da Internet all apply in parallel. A clean LGPD position does not immunise a crawl that systematically copies protected database content.
- Hammering target infrastructure. Aggressive request rates are bad engineering and bad optics, and they make a good faith argument harder to sustain.
- Skipping vendor due diligence. Every third party touching the data, including the network layer, needs to withstand scrutiny.
Where Proxies Fit In: The Network Layer as a Compliance Surface
Two things make proxy infrastructure central to a Brazilian and Latin American research programme rather than incidental to it.
The first is data accuracy, which is itself a compliance obligation under the data quality principle in Article 6. Brazilian e-commerce is intensely regionalised: shipping cost, availability, instalment terms, and promotional pricing shift between São Paulo, Recife, and Porto Alegre, and many platforms personalise by CEP and detected location. A crawl executed from a single foreign exit node does not return Brazilian market reality. It returns a foreign visitor's view of a Brazilian site, then feeds that distortion into a pricing decision. Genuine in-country coverage across multiple Brazilian states, plus equivalent coverage in Mexico, Colombia, Chile, and Argentina, is what makes regional comparisons defensible. Before a campaign of record goes live, it is worth verifying that your exit nodes actually geolocate where you expect using a proxy testing tool, since mislabelled IPs quietly corrupt months of comparative data.
The second is sourcing. A residential proxy network is built from real consumer connections, which means the network itself processes personal data belonging to the people whose devices and bandwidth participate. If those participants were not clearly informed and did not meaningfully agree, the entire chain inherits that defect. Under LGPD's accountability principle, a controller cannot outsource that problem. This is why due diligence on ethically sourced proxy pools belongs in the same vendor review as your cloud contracts: ask how participants opt in, how they withdraw, what disclosure they receive, and what the provider logs about their traffic.
EnigmaProxy is a useful worked example of what that evaluation looks like in practice. The platform operates multiple pool types, residential, ISP, datacenter, and mobile, which lets a research team match the pool to the sensitivity of the target rather than forcing every job through one network. Granular geo-coverage supports the city and state level targeting that Latin American pricing research demands. Transparent sourcing practices and business-grade reliability give compliance teams something concrete to document, and predictable pricing makes it possible to budget a long running monitoring programme instead of improvising. Session control matters too: sticky sessions for multi-step flows that must stay coherent, fast rotation for broad catalogue sweeps, each chosen deliberately and recorded in your processing documentation.
The broader point is that your network layer is part of your processing chain. Treat it with the same seriousness as your database.
Future Trends and Strategic Insights
Regional convergence with local teeth. Chile's new law, Mexico's restructured oversight, and Peru's updated regulation are all moving toward the LGPD and European model. Expect fewer structural differences between countries and more divergence in enforcement culture, registration formalities, and notification deadlines. Build policy as configuration, not as separate codebases.
AI training data under direct scrutiny. ANPD's interventions around personal data used for model training signal where the attention is going. Research teams that scrape text corpora and feed them into fine-tuning pipelines should assume that the purpose stated at collection will be compared against the purpose at training. Brazil's pending AI legislation will sharpen that comparison.
Provenance becomes a procurement question. Buyers of data and of data infrastructure are increasingly asked to evidence where a dataset came from and how the collection network was constituted. Providers that can answer in writing will clear enterprise reviews. Those that cannot will be excluded quietly at the security questionnaire stage.
Documentation as competitive advantage. The teams that will move fastest in 2026 are not the ones with the loosest interpretation of the rules. They are the ones who can launch a new country crawl in a week because the legal basis template, the transfer clauses, the field classification policy, and the vendor assessments already exist. Compliance maturity converts into speed.
Conclusion
LGPD does not stop market research teams from scraping the Brazilian web. It requires them to know what personal data they are touching, to name a legal basis and defend it, to collect only what the purpose needs, to respect the context in which public data was published, and to control where that data travels. Those are tractable engineering and governance problems, and solving them once pays off across every country in the region.
The network layer deserves the same rigour as the rest of the stack. Geo-accurate, properly sourced infrastructure is what makes regional data trustworthy and what keeps a vendor review from stalling a project. Providers such as EnigmaProxy that combine pool diversity, broad geo-coverage, and transparent sourcing give research teams in Latin America a foundation they can document, defend, and scale.