Brazil Is About to Make Your Ad Targeting Public, Not Just Who Paid For It

On September 23, Brazil's Ministry of Justice and Public Security, through Senacon, Sedigi and SPDigi, published a joint ordinance with new rules for digital advertising. It doesn't stop at who paid for the ad: it forces disclosure of who you tried to reach. If your ads reach consumers in Brazil on a covered platform, the targeting parameters behind them are about to land in a public, searchable, free repository, wherever your company is based.

What goes into the repository, and why the advertiser's name isn't the interesting part

The rule applies to any provider with more than one million monthly active users in Brazil that hosts third-party content and sells paid ads or boosts, regardless of where the company is headquartered: a US platform selling ads to Brazilian consumers is covered exactly the same as a Brazilian one. The threshold is about users, not age: a newer channel like ChatGPT Ads, which already sells ads in Brazil and is one of only two markets in the region with self-serve access, falls under the same logic if it crosses it. Those providers have to keep a public, free, searchable repository with the ad's content, the advertiser's identification (a Brazilian tax ID, CNPJ or CPF), the flight dates, the audience targeting parameters, estimated reach, and payment information, kept available for at least one year after the campaign ends.

Of everything on that list, the targeting field is the one that changes an advertiser's life: not just that an ad ran, but who it was aimed at. A competitor with enough patience will be able to reconstruct, ad by ad, which audiences another brand is buying in Brazil. How much detail shows up will depend on how each platform builds its repository, and that isn't defined yet. It's another chapter in a pattern we keep tracking: how much of an ad account stays private versus becomes visible to, or controlled by, someone else. First it was Google deciding what copy gets added to a Shopping ad description; now it's a regulator deciding what part of your targeting stops being private.

The other half of the rule: verify before a financial ad ever runs

For ads promoting financial products or services aimed at users in Brazil, the ordinance requires something else from the platform: verify the advertiser's identity and confirm the validity of its registration or authorization with the relevant regulator, before the ad is allowed to run. That verification has to be renewed every 12 months, and the ad gets suspended if it isn't. The Ministry frames it as a way to fight deceptive and fraudulent advertising, and singles out ads that impersonate government programs.

For a legitimate financial advertiser this doesn't change the underlying business, but it does add a dependency: the campaign doesn't start until the platform finishes the verification, and it can lapse if regulatory paperwork isn't current twelve months later. The obligation sits with the platform, but the advertiser is the one left without a campaign. It's worth pulling that documentation together before a platform asks for it.

The timeline: two deadlines, counted from the same day

The rule takes effect in two stages: 30 days for the general provisions, including building the repository and the financial-advertiser verification, and 90 days for the transparency tool itself. Counting from the September 23 publication, that puts the first deadline around October 23, 2026, and the second around December 22, 2026. Press coverage isn't unanimous on whether the count starts on the day the ordinance was signed (9/22) or the day it was published (9/23); the gap is one day and doesn't change the order of magnitude, but it's worth not pinning an exact date until it's confirmed against the full legal text. Senacon is the enforcement body, applying penalties under Brazil's Consumer Protection Code.

What to get ready before the deadlines hit

The ordinance doesn't name Meta, Google or TikTok, and it doesn't say how any platform will build its repository or its financial verification flow. There's no public confirmation yet of what each one will show or how. What can be done now, in preparation mode:

• Review which active campaigns target consumers in Brazil, across every platform with meaningful reach in the country.
• If any of those are financial-product or financial-service ads, gather the advertiser's identity and regulatory registration documents before a platform asks for them.
• Audit the targeting parameters currently in use on those campaigns, on the assumption they'll become visible to anyone searching the repository.
• Mark October 23 as an internal operating deadline instead of waiting for a platform notice.

Whether the data ends up useful in practice depends on which fields each platform exposes and at what level of detail, something no one can promise yet.

Who this matters to, and what's still open

This matters to any team buying paid media that reaches consumers in Brazil, no matter where the company cutting the check is based: the ordinance explicitly covers foreign platforms, so the US-based networks where most of that spend runs are in scope. It matters even more to anyone advertising financial products, because that's where a new verification step can stall a campaign if regulatory registration isn't in order. What the rule doesn't resolve yet is how each platform will build its own repository: a new panel, an extension of something that already exists, or a different design per platform. Until that gets confirmed, the date is the only thing that's certain.

This content was developed with AI assistance and reviewed by the Zenda team. Any bad ideas are entirely our own.