Brazil LGPD Ad Enforcement May 2026: ANPD, EU Adequacy

Quick Answer

ANPD's December 2025 Priority Map placed advertising-driven sensitive data use at the top of Brazil's 2026-2027 enforcement focus. The January 2026 Brazil-EU mutual adequacy decision unlocks cross-border data flows, while a potential 20% revenue fine ceiling reshapes advertiser obligations across Latin America.

Predict ad disapprovals before you submit — try the free Meta Rejection Predictor

Brazil LGPD Ad Targeting Enforcement May 2026: ANPD Priority Map, EU Adequacy Decision & Cross-Border Advertiser Playbook

LGPD Enforcement State May 2026

Brazil's Lei Geral de Proteção de Dados has moved decisively from its educational phase to substantive enforcement through 2024-2026. The ANPD has accumulated over BRL 98 million (~USD 20 million) in fines between 2023 and 2025 — a relatively modest absolute figure but a clear trajectory signal that establishes enforcement credibility and frames the substantively larger sanctions that could apply under proposed legislative changes.

The May 2026 enforcement state combines four distinct developments. The ANPD Resolution CD/ANPD No. 30 published on 24 December 2025 establishes the Priority Map of Issues for 2026-2027 with advertising-driven sensitive data use at the top of enforcement focus. The Resolution 19/2024 cross-border transfer framework has now passed its August 23, 2025 compliance deadline and routine ANPD verification is underway. The Brazil-EU mutual adequacy decision announced on 27 January 2026 has reshaped cross-border data flows between two of the world's largest data protection regimes. The legislative proposal PL 4530/23 to increase fine ceilings from 2% to 20% of revenue continues through the Brazilian legislative process.

The combined effect is a substantively higher-stakes LGPD compliance environment than at any point since the framework's 2020 entry into application. Advertisers operating in Brazil should treat the May 2026 inflection as the appropriate moment to elevate LGPD compliance to a board-level matter and to invest in the compliance infrastructure that will support sustainable operations under the heightened enforcement framework.

"Data subject rights — Ensuring the effectiveness of LGPD rights, with special attention to sensitive data and its use for advertising."
— ANPD Resolution CD/ANPD No. 30, 24 December 2025 (2026-2027 Priority Map)

For consolidated regional framework reference, see EU DSA Compliance and ongoing tracking through Policy Tracker.

ANPD 2026-2027 Priority Map

The Priority Map identifies the specific enforcement focus areas that will guide ANPD investigative resources, sanctioning decisions, and regulatory dialogue with controllers and processors over the two-year window. The Map's elevation of advertising-related enforcement signals a substantive shift in ANPD priorities.

Priority Areas Affecting Advertising

Priority area	Advertising relevance	Likely enforcement focus
Data subject rights — sensitive data + advertising	Direct: targeting based on inferred sensitive characteristics	Health, political, sexual orientation, religious inference
Cross-border data transfers	Direct: platform infrastructure routing Brazilian user data	Compliance with Resolution 19/2024 mechanisms
Sensitive data processing	Direct: Article 11 requirements for sensitive data inference	Explicit consent verification, processing limitation
Children's and adolescents' data	Direct: advertising delivery to minors	Parental consent, best-interest analysis under Article 14
Data protection impact assessments	Indirect: required for high-risk advertising processing	Documentation quality, methodology adequacy

Operational Signal

The Priority Map's explicit identification of advertising as a focus area indicates that ANPD has moved beyond the educational phase that characterised early LGPD enforcement and into substantive enforcement of advertising-specific obligations. Advertisers operating in Brazil should expect increased ANPD attention to data flows, consent frameworks, sensitive data handling, and children's data processing.

For ongoing tracking, see Policy Tracker.

Brazil-EU Mutual Adequacy Decision

The 27 January 2026 mutual adequacy decision is Brazil's first adequacy decision and one of the most comprehensive adequacy frameworks adopted by the EU under GDPR, covering public and private sector data flows.

Operational Impact

SCC elimination: Personal data flows between Brazil and the EU no longer require Standard Contractual Clauses.
Simplified routing: Campaign data, audience segments, measurement data, and creative production data flow without transfer mechanism friction.
Substantive obligations continue: LGPD and GDPR continue to apply to processing operations; adequacy addresses transfer mechanism layer only.
Third-country flows unchanged: Brazil-to-US, Brazil-to-LATAM, and EU-to-non-adequate flows continue under standard transfer mechanism requirements.

Strategic Implications

Advertisers can consolidate cross-jurisdictional data processing in the Brazil-EU corridor where operational simplification applies. The strategic move requires careful attention to third-country flows that remain subject to standard transfer mechanism requirements. The adequacy decision's stability should also be monitored — adequacy decisions can be challenged before the Court of Justice of the European Union and can be modified if material data protection circumstances change.

For consolidated GDPR framework, see EU DSA Compliance.

Sensitive Data Targeting Restrictions

Legal Basis Restrictions

Article 11 limits processing to specific legal bases including explicit consent specifically given for the specific purpose, fulfilment of legal obligations, public administration, joint research, judicial proceedings, life or safety protection, health protection by professionals, and fraud or transaction security. The list excludes most legitimate interest bases available for general personal data.

Inference Targeting Implications

The exclusion affects advertising targeting that infers sensitive characteristics from non-sensitive signals. Behavioural advertising that uses purchase history, browsing patterns, or content engagement to infer sensitive characteristics produces sensitive data processing requiring Article 11 compliance rather than general personal data treatment. The implication is particularly relevant for health, political, sexual orientation, and religious targeting.

Compliant Workflow Elements

Explicit consent mechanisms: Designed specifically for sensitive data categories the advertising depends on.
Audit trails: Documenting consent capture and ongoing validity.
Processing limitations: Constraining sensitive data use to specific purposes consented to.
Rights handling: Addressing heightened consent withdrawal and rectification requirements.
DPIAs: Sensitive-data-specific assessments under Article 38.

For industry-specific framework on sensitive data, see Healthcare Social Media Compliance.

Fine Framework and PL 4530/23

The current Article 52 framework establishes a maximum administrative fine of 2% of the entity's revenue with an absolute cap of BRL 50 million per violation. The proposed PL 4530/23 would increase the percentage to 20% of revenue and the absolute cap to BRL 100 million per violation.

Current vs. Proposed Framework

Parameter	Current (Article 52)	Proposed (PL 4530/23)
Maximum percentage	2% of revenue	20% of revenue
Absolute cap	BRL 50 million	BRL 100 million
Per violation	Yes	Yes
Daily penalty option	Available	Retained, scaled

Legislative Status

The bill is under consideration by the Brazilian legislature as of May 2026. Enactment depends on Brazilian political dynamics and could result in the bill passing in its current form, being modified before enactment, or failing to advance. The probability assessment for enactment should account for both domestic political factors and international pressure favouring stronger data protection sanctions.

Exposure Modelling

Advertisers should adopt a probabilistic exposure model that reflects the proposed framework as a possibility rather than as established law. Platforms face existential exposure under the proposed framework and should treat compliance as a board-level matter. Advertisers face exposure proportional to their direct LGPD obligations which are typically narrower than platform obligations but still material under the proposed ceiling.

For ongoing legislative monitoring, see Policy Tracker.

Platform-Advertiser Compliance Interaction

Platform-Side Compliance Posture

Meta: Brazil-specific data handling infrastructure, ANPD-approved transfer mechanisms, joint controllership for advertising operations.
Google: LGPD-specific consent mode and data flow controls; advertiser support documentation and training; product-dependent controller/processor relationships.
TikTok: Brazil-specific consent frameworks; ANPD engagement on sensitive data, children's data, and cross-border transfers.
YouTube: Google framework with YouTube-specific implementation for video advertising operations.

Advertiser-Side Compliance Elements

Data processing agreements: Address LGPD-specific obligations including rights handling, sub-processor management, security, breach notification.
Consent management: Capture LGPD-compliant consent for advertising data sharing including sensitive data inference.
Rights handling integration: Coordinate with platform-side rights handling for end-to-end compliance.
Audit trail: Document compliance posture across the advertiser-platform interaction.

For automated compliance scanning, run Legal Compliance Scan.

Brazil LGPD Advertiser Checklist

[ ] Data processing agreement with each major advertising platform addresses LGPD-specific obligations
[ ] Consent management framework captures LGPD-compliant consent for advertising data use
[ ] Sensitive data processing identified and Article 11 requirements verified for inference-based targeting
[ ] Children's and adolescents' data processing compliant with Article 14 parental consent and best-interest analysis
[ ] Cross-border transfer mechanisms verified under Resolution 19/2024 for non-EU destinations
[ ] Brazil-EU adequacy decision opportunity assessed for routine personal data flows
[ ] PL 4530/23 legislative progress monitored for compliance investment planning
[ ] Data subject rights handling workflows established with LGPD-specific timelines
[ ] Breach notification process aligned with LGPD requirements (ANPD + affected data subjects)
[ ] DPIAs documented for high-risk advertising processing operations

Frequently Asked Questions

What is the ANPD 2026-2027 Priority Map and how does it elevate advertising-related enforcement?

The ANPD published Resolution CD/ANPD No. 30 on 24 December 2025 establishing the Map of Priority Issues for Oversight and Regulatory Action for the 2026-2027 biennium. The Priority Map identifies the specific enforcement focus areas that will guide ANPD investigative resources, sanctioning decisions, and regulatory dialogue with controllers and processors over the two-year window. The Map's elevation of advertising-related enforcement signals a substantive shift in ANPD priorities. The Priority Map identifies several focus areas with direct relevance to advertising operations. The first is data subject rights — ensuring the effectiveness of LGPD Articles 18 through 22 rights with special attention to sensitive data and its use for advertising. The framing explicitly identifies advertising data use as a Priority Map concern and signals that ANPD will allocate investigative resources to advertising-related complaints and to platform-level advertising data practices. The framing is significant because it indicates that ANPD has moved beyond the educational and guidance phase that characterised early LGPD enforcement and into substantive enforcement of advertising-specific obligations. The second relevant focus area is cross-border data transfers — verifying compliance with the international transfer framework established under Resolution CD/ANPD No. 19/2024 and the standard contractual clauses approved by ANPD. The framing affects the major advertising platforms that route Brazilian user data to international processing infrastructure and that depend on cross-border transfers for ad-serving operations. The third relevant focus area is sensitive data processing — addressing the specific obligations under Articles 11 through 13 that apply to processing sensitive data including racial origin, religious convictions, political opinions, health data, sexual life, and biometric data. The framing affects advertising that infers or targets based on sensitive data categories which is a common practice in interest-based and lookalike advertising. The fourth relevant focus area is children's data — addressing Article 14 obligations on processing data of children and adolescents. The framing affects advertising delivery to younger audiences and the parental consent and best-interest analysis requirements that apply to such processing. The combined effect of the Priority Map focus areas is to position advertising operations as a substantive enforcement priority for the 2026-2027 biennium. Advertisers operating in Brazil should expect increased ANPD attention to their data flows, consent frameworks, sensitive data handling, and children's data processing. The increased attention combines with the recent fine trajectory that produced over BRL 98 million in cumulative fines between 2023 and 2025 to create a substantive compliance imperative. For consolidated regional framework, see EU DSA Compliance as a comparable framework reference.

How does the January 2026 Brazil-EU mutual adequacy decision affect data flows for advertisers operating across both markets?

Brazil and the European Union officially announced mutual recognition of adequacy in personal data protection on 27 January 2026. The decision represents Brazil's first-ever adequacy decision and one of the most comprehensive adequacy frameworks adopted by the EU under the GDPR, covering public and private sector data flows. The mutual recognition produces significant operational consequences for advertisers operating across both markets. The pre-adequacy operational reality required advertisers to rely on standard contractual clauses, binding corporate rules, or other Article 46 transfer mechanisms for personal data flows from the EU to Brazil. The reliance on SCCs imposed contractual, operational, and ongoing assessment obligations that increased the friction of routine data flows. The same reliance applied in reverse for Brazil-to-EU flows under ANPD Resolution 19/2024 with the additional requirement that SCCs follow the strict format approved by ANPD. The mutual adequacy decision eliminates the SCC requirement for routine personal data flows between the two jurisdictions. Personal data can flow without the contractual mechanisms that previously governed each transfer. The elimination simplifies operational data flows for advertisers including campaign data routing, audience segment exchange, measurement data consolidation, and creative production data flows. The simplification produces material efficiency gains for cross-jurisdictional advertising operations. The adequacy decision does not eliminate substantive obligations. Both LGPD and GDPR continue to apply to processing operations and the data subject rights, lawful basis requirements, sensitive data restrictions, and other substantive protections continue to operate within each jurisdiction. The adequacy decision addresses the transfer mechanism layer rather than the underlying obligations and advertisers must continue to comply with LGPD obligations for processing Brazilian data and GDPR obligations for processing EU data. The adequacy decision also does not extend to data flows involving third countries. Data flows from Brazil to the US, from Brazil to other LATAM markets, or from Brazil to Asian markets continue to require the ANPD-approved transfer mechanisms under Resolution 19/2024. Similarly, data flows from the EU to non-adequate third countries continue to require GDPR Article 46 mechanisms. The Brazil-EU adequacy creates a privileged corridor between the two jurisdictions but does not affect flows to other markets. The strategic implications for advertisers include opportunity to consolidate cross-jurisdictional data processing in the Brazil-EU corridor where operational simplification applies and continued attention to third-country data flows that remain subject to standard transfer mechanism requirements. The implications also include monitoring the adequacy decision's stability — adequacy decisions can be challenged before the Court of Justice of the European Union and can be modified or withdrawn if material data protection circumstances change in the adequate jurisdiction. For ongoing tracking of cross-border framework changes, see Policy Tracker.

What sensitive data restrictions apply under LGPD to advertising targeting and how should advertisers structure compliant workflows?

LGPD Article 11 establishes the framework for processing sensitive personal data with substantially stricter requirements than apply to general personal data. The sensitive data categories under Article 5(II) include data on racial or ethnic origin, religious convictions, political opinions, trade union or religious membership, philosophical or political opinion, health or sexual life data, and genetic or biometric data when associated with an individual. Each category produces specific advertising compliance implications. The Article 11 processing requirements limit sensitive data processing to specific legal bases including explicit consent specifically given by the data subject for the specific purpose, fulfilment of legal or regulatory obligations of the controller, processing for public administration, joint study by a research body, exercise of rights in judicial or administrative proceedings, protection of life or physical safety, health protection in procedures by health professionals, and prevention of fraud or financial security in transactions involving electronic systems. The list excludes most legitimate interest bases that are available for general personal data processing. The exclusion affects advertising targeting that depends on inferring sensitive characteristics from non-sensitive signals. The exclusion is particularly relevant for behavioural advertising that uses purchase history, browsing patterns, or content engagement to infer sensitive characteristics like health conditions, political views, or sexual orientation. The inference patterns produce sensitive data processing that requires Article 11 compliance rather than general personal data treatment. The compliant advertising workflow under Article 11 should include explicit consent mechanisms designed specifically for sensitive data categories that the advertising depends on, audit trails documenting consent capture and ongoing validity, processing limitations that constrain sensitive data use to the specific purposes consented to, and data subject rights handling that addresses the heightened consent withdrawal and rectification requirements for sensitive data. The workflow should also include sensitive-data-specific data protection impact assessments under Article 38 for processing that presents high risks to data subjects. The cross-jurisdictional implications of sensitive data restrictions are substantial. Advertising platforms that operate global infrastructure must accommodate the LGPD restrictions for Brazilian data subjects alongside comparable but distinct restrictions under GDPR Article 9 for EU data subjects, HIPAA for US health data, and other regional sensitive data frameworks. The accommodation typically requires jurisdiction-specific processing flows that segregate sensitive data handling by data subject jurisdiction. The segregation produces operational complexity but is necessary to maintain compliance across jurisdictions. The enforcement trajectory for sensitive data processing is intensifying. The ANPD Priority Map elevates sensitive data as a 2026-2027 focus area. Recent ANPD enforcement decisions have addressed sensitive data processing including health-data advertising and political targeting. The enforcement signals suggest that advertisers should expect continued ANPD attention to sensitive data in advertising contexts and should structure compliance accordingly. For consolidated framework reference, see Healthcare Social Media Compliance and Financial Services Ad Compliance.

What is the proposed fine ceiling increase under PL 4530/23 and how should advertisers model the exposure change?

Bill PL 4530/23 proposes substantial increases to the LGPD fine framework. The current framework under Article 52 establishes a maximum administrative fine of 2% of the entity's revenue with an absolute cap of BRL 50 million per violation. The proposed framework would increase the percentage to 20% of revenue and the absolute cap to BRL 100 million per violation. The proposed changes represent the largest potential increase in administrative sanctions for data protection in Latin America and would align the LGPD fine ceiling more closely with the GDPR's higher tier (4% of global annual turnover) than with most other regional frameworks. The proposed framework affects the financial exposure modelling that advertisers should apply to LGPD compliance investment. The current framework produces meaningful but limited exposure for major advertising operations. A 2% revenue fine for a major platform represents substantial financial impact but is not existential. The proposed 20% fine would represent a different magnitude of exposure that could fundamentally affect business viability for major LGPD violations. The exposure modelling should reflect the proposed framework as a possibility rather than as established law. The bill is currently under consideration by the Brazilian legislature and has not been enacted as of May 2026. The legislative process is ongoing and the bill's progression depends on Brazilian political dynamics including the broader data protection regulatory agenda and the relationship between Brazilian legislators and the international data protection community. The bill could be enacted in its current form, modified before enactment, or fail to advance through the legislative process. The probability assessment for enactment should account for both Brazilian domestic political factors and international pressure factors. The international community has generally welcomed stronger data protection enforcement and the bill's increases align with global trends toward higher data protection sanctions. Within Brazil the bill faces typical legislative friction including industry lobbying, technical refinement requests, and competing legislative priorities. The probability assessment should produce a probabilistic exposure model rather than a binary assumption. The compliance investment implications include adopting a higher exposure ceiling for compliance investment decisions, accelerating compliance projects that address material risk areas before the bill's potential enactment, and engaging with the legislative process where appropriate to address technical implementation concerns. The investment implications affect platform-level compliance posture and advertiser-level compliance posture differently. Platforms face existential exposure under the proposed framework and should treat compliance as a board-level matter. Advertisers face exposure proportional to their direct LGPD obligations which are typically narrower than platform obligations. The compliance investment implications also include cross-jurisdictional considerations. Advertisers operating across multiple jurisdictions should consider whether the proposed LGPD framework signals a broader trend toward higher data protection sanctions globally. The signal is consistent with recent enforcement activity in the EU, UK, India, and other major data protection frameworks. The cross-jurisdictional implications suggest that compliance investment should anticipate continued tightening of sanctions globally rather than treating the LGPD changes as isolated. For ongoing regulatory tracking, see Policy Tracker.

How do the major advertising platforms approach LGPD compliance and what is the advertiser-side compliance interaction?

The major advertising platforms approach LGPD compliance through platform-level data handling, processor-controller relationships, and tools that support advertiser compliance. The approaches vary across platforms in significant ways and produce distinct advertiser compliance implications. Meta operates Brazil-specific data handling infrastructure that processes Brazilian user data under LGPD-compliant frameworks. The infrastructure includes Brazilian-data-resident processing for sensitive operations, ANPD-approved transfer mechanisms for cross-border flows, and Brazilian-specific consent frameworks for advertising data use. Meta's advertiser tools support compliance through targeting restrictions that reflect LGPD sensitive data limitations, consent flow integration that captures LGPD-compliant consent for custom audience uploads, and audit capabilities that document compliance posture. Meta's processor-controller relationship with advertisers is typically structured as joint controllership for advertising operations which produces shared compliance obligations. Google's approach combines Google's own data handling under LGPD with advertiser-facing tools that support compliance. Google Ads and Google Marketing Platform have introduced LGPD-specific consent mode and data flow controls that allow advertisers to configure data handling according to their LGPD compliance posture. Google's advertiser support includes documentation, training, and tools that help advertisers structure compliant campaigns. The processor-controller relationship varies by Google product with some products operating as controllers and others as processors. TikTok's approach has evolved through ongoing engagement with ANPD. TikTok operates Brazil-specific data handling and has implemented Brazilian-specific consent frameworks for advertising operations. The ANPD has engaged with TikTok on several occasions regarding sensitive data handling, children's data processing, and cross-border transfers. The engagement has produced specific compliance commitments and ongoing monitoring relationships. The advertiser-side compliance interaction with platforms requires several specific elements. The data processing agreements between advertisers and platforms must address LGPD-specific obligations including data subject rights handling, sub-processor management, security obligations, and breach notification. The advertiser-side consent management must capture LGPD-compliant consent for advertising data sharing with platforms including specific consent for sensitive data inferences. The advertiser-side data subject rights handling must integrate with platform-side rights handling to ensure that data subjects who exercise rights at the advertiser also have those rights reflected in platform-side processing. The cross-jurisdictional advertiser-platform interaction is complex because most advertisers operate across multiple jurisdictions and most platforms operate global infrastructure. The complexity requires advertiser-side compliance infrastructure that handles jurisdiction-specific obligations including LGPD-specific requirements alongside GDPR, CCPA, and other regional requirements. The infrastructure typically includes consent management platforms that distinguish jurisdictional obligations, data subject rights handling workflows that route requests to the appropriate jurisdictional framework, and audit trail capabilities that document compliance posture across jurisdictions. For automated compliance scanning and ongoing policy tracking, run Legal Compliance Scan.

What workflow should advertisers establish for Brazil-specific LGPD compliance and what should they monitor through the rest of 2026?

Advertisers operating in Brazil should establish a structured LGPD compliance workflow that addresses platform-level compliance, advertiser-level compliance, and the interaction between the two. The workflow should accommodate the Priority Map enforcement focus areas, the Brazil-EU adequacy decision opportunities, and the potential PL 4530/23 fine framework changes. The platform-level workflow should include verification of platform LGPD compliance documentation, configuration of platform tools for LGPD-compliant operations, and ongoing monitoring of platform-level enforcement signals. The verification should cover data processing agreements, sub-processor lists, security documentation, and any platform-specific LGPD attestations. The configuration should activate platform tools including consent mode, sensitive data restrictions, and Brazil-specific data flow controls. The monitoring should track ANPD enforcement against platforms and any consent decrees or commitments that affect advertiser obligations. The advertiser-level workflow should include LGPD-specific data inventory, lawful basis documentation, consent management, sensitive data restrictions, data subject rights handling, and breach notification preparation. The data inventory should map all advertising-related Brazilian data flows including first-party data collection, partner data sharing, and platform data exchange. The lawful basis documentation should identify the LGPD legal basis for each processing activity and document the assessment supporting the basis selection. The consent management should capture LGPD-compliant consent for processing activities that depend on consent and should maintain consent records for the duration of processing. The sensitive data restrictions should identify any processing that involves sensitive data categories and ensure that Article 11 requirements are met. The data subject rights handling should establish workflows that respond to access, rectification, deletion, portability, and other LGPD rights within applicable timelines. The breach notification preparation should establish processes for identifying breaches, assessing notification obligations, and executing notifications to ANPD and affected data subjects within the LGPD timelines. The interaction workflow should include data processing agreements that allocate responsibilities between advertisers and platforms, coordinated incident response that addresses breaches affecting both parties, and joint compliance reviews that verify the operational integration of advertiser-side and platform-side compliance frameworks. The monitoring focus through Q3 and Q4 2026 should include ANPD enforcement activity under the Priority Map focus areas, legislative progress on PL 4530/23 and any other LGPD amendments, Brazil-EU adequacy decision stability, and cross-jurisdictional data protection developments that affect LGPD compliance posture. Advertisers should also monitor industry-specific guidance from ANPD on advertising data practices and any sector-specific enforcement actions that establish precedent for the broader advertiser community. The monitoring infrastructure should integrate with the advertiser's broader compliance monitoring including FTC, GDPR, and other regional frameworks. The integration produces a coherent global compliance posture that addresses LGPD obligations alongside other regional obligations. For automated compliance scanning and ongoing policy tracking, run Legal Compliance Scan and use Policy Tracker.

Don't miss the next policy change.

Create a free account — track every policy change across 8 platforms, get instant alerts, and access every free compliance tool. Or try our Meta Rejection Predictor first.

Create Free Account

Report Keywords — Run AI Compliance Audit

#LGPD#ANPD#Brazil#Data Privacy#Cross-Border Transfer#EU Adequacy#GDPR#Ad Targeting#Sensitive Data#2026 Policy#Advertisers#LATAM Compliance

Share This Report

Tweet Share

South Korea's AI Advertising Law in 2026: Labeling Rules, KFTC Enforcement and Misleading-Claim Penalties

From 2026 South Korea moves to require labeling of AI-generated advertising and tightens rules on misleading claims and virtual endorsers. Here is what changes and how advertisers comply.

COPPA Rule Amendments in 2026: The Children's Privacy Overhaul That Changes Targeted Advertising, Biometrics and Data Retention

The FTC's amended COPPA Rule reaches full compliance in April 2026 — requiring separate parental consent for third-party targeted advertising and limiting data retention.

EU AI Act Article 50 Transparency Code of Practice June 2026: What AI Ad Creative Must Disclose Before August 2

The European Commission published its Transparency Code of Practice for AI-generated content on June 10, 2026 — weeks before EU AI Act Article 50 obligations apply on August 2. Here is what advertisers using AI ad creative must label, mark, and document.

Platforms

Industries

Knowledge

Blog

Brazil LGPD Ad Targeting Enforcement May 2026: ANPD Priority Map, EU Adequacy Decision & Cross-Border Advertiser Playbook