> ## Documentation Index
> Fetch the complete documentation index at: https://docs.orbit.devotel.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Portugal ePrivacy + CNPD Sender Rules (Lei 41/2004)

> The Portugal posture expanded from the country-requirements matrix: Lei 41/2004's ePrivacy opt-in rule for electronic direct marketing, CNPD data-protection oversight, the national do-not-contact list posture for voice, and the tenant-owned consent, suppression, and quiet-hours surfaces that carry a Portuguese campaign.

# Portugal ePrivacy + CNPD Sender Rules (Lei 41/2004)

Portugal (`PT`) is an enabled Orbit destination for voice and SMS,
dialing prefix `351`. Portuguese marketing traffic sits under Lei 41/2004
of 18 August, the national transposition of the ePrivacy Directive, which
carries the opt-in rule for electronic direct marketing (with the
existing-customer exception that Portuguese law conditions on the same
product or service category), and on top of it the GDPR as applied by the
CNPD (Comissão Nacional de Proteção de Dados, the national data
protection authority). Telecom-side context sits with ANACOM. Portugal
operates a national do-not-contact posture for covered telephone
marketing that you scrub before voice campaigns alongside your own
suppression ledger. This page expands the PT row of the
[country-requirements matrix](https://docs.orbit.devotel.io/compliance/country-requirements.md) so you can
assemble the posture before your first Portuguese send.

Portugal is a **tenant-owned burden**. Orbit keeps the country-rules
reference and the send-time surfaces; the legal posture for your
Portuguese recipients is yours.

> [!NOTE]
>
> This page is documentation, not legal advice. Lei 41/2004's
> direct-marketing provisions and the CNPD's GDPR enforcement are applied
> against the sender, and the CNPD publishes guidance that moves over
> time. Have counsel review your consent and scrub practice for
> Portuguese recipients; Orbit supplies the surfaces.

***

## Accepted sender types and registration level

Portugal operates no statutory alphanumeric sender-ID registry.
Portuguese operators accept alphanumeric senders at the operator level,
and the operative layer is carrier deliverability rather than law: an
unregistered alphanumeric sender can be relabeled in transit, so register
the sender identity where stable branding matters and treat that as
posture, not statute. Expect the live PT country-rules row to read
`registration: none`:

```bash theme={null}
curl "https://api.orbit.devotel.io/api/v1/compliance/country-rules?country=PT" \
  -H "Authorization: Bearer $ORBIT_API_KEY"
```

```json theme={null}
{
  "country": "PT",
  "sender_types": ["alphanumeric", "long_code"],
  "registration": "none",
  "content_restrictions": ["opt-in direct marketing under Lei 41/2004"],
  "stop_requirement": "STOP honored; a working opt-out in every marketing message"
}
```

Registration levels change at the regulator and the operators; always read
the live `registration` field rather than this snapshot. Where a row ever
reads `recommended` or `required`, file the sender through
[Sender-ID Registration](https://docs.orbit.devotel.io/compliance/sender-id-registration.md).

***

## Opt-in and opt-out posture

Electronic direct marketing to Portuguese individuals requires prior
consent under Lei 41/2004; the narrow existing-customer exception applies
only to the same category of products or services you sold to the
recipient, and only while a clear opt-out rode the sale and rides every
message after it. Record consent before dispatch and honor revocations on
every channel. For voice campaigns, scrub the national do-not-contact
list before the campaign alongside your own suppression ledger.

| Portuguese obligation | Orbit surface |
| - | - |
| Prior consent for electronic direct marketing, with a narrow same-category existing-customer exception | [Consent Management](https://docs.orbit.devotel.io/compliance/consent-management.md); [GDPR Posture Guide](https://docs.orbit.devotel.io/compliance/gdpr-posture-guide.md) for the lawful basis |
| Identifiable sender and a working opt-out in every marketing message | Suppression ledger; [Opt-Out Keyword Alias Table](https://docs.orbit.devotel.io/compliance/opt-out-keyword-alias-table.md) |
| Portuguese-language stop vocabulary on Portuguese sends | Add `STOP` plus the Portuguese `PARAR` family via the [opt-out rules editor](https://docs.orbit.devotel.io/compliance/opt-out-keyword-alias-table.md) |
| National do-not-contact list scrubbing before voice campaigns | [DNC Scrub](https://docs.orbit.devotel.io/compliance/dnc-scrub.md) against the Portuguese list, on top of the suppression ledger |
| Evidence retention for consent and revocation | [Archival Export](https://docs.orbit.devotel.io/compliance/archival-export.md) |

***

## Quiet hours

Portugal sets no statutory marketing quiet-hours window for SMS; the
recipient's consent and your own sending policy carry the clock. Orbit's
tenant quiet-hours channel toggles default OFF, per
[Quiet Hours FAQ](https://docs.orbit.devotel.io/compliance/quiet-hours-faq.md); for Portuguese campaigns,
opt in a recipient-local window over Europe/Lisbon and apply an evening
cutoff consistent with your consent basis. The toggle is tenant-owned and
fails open until you set it, matching the platform posture that every
compliance control except the US federal voice window is yours to
configure.

***

## Number purchase

Portugal is not a member of the platform's regulated
`phone_number_purchase` set (DE, GB, FR, BR, MX, IN, JP, FI, NL, SE), so a
Portuguese number order does not wait on an approved compliance profile.
The marketing posture above still applies to the traffic you originate
from the number: the purchase gate and the sending posture are separate
obligations, and the lighter purchase path does not soften the opt-in
rule. The same holds under the voice country-coverage reference, where
`PT` reads `enabled` ahead of the call.

***

## Worked configuration before your first Portuguese send

**1. Record consent with an sms scope**

Capture prior consent for each Portuguese recipient in
[Consent Management](https://docs.orbit.devotel.io/compliance/consent-management.md) before the first
send; store the source and timestamp so the record is producible. If
you rely on the existing-customer exception, scope it to the same
product category as the original sale.

**2. Add the Portuguese stop vocabulary**

Confirm `STOP` is active and add `PARAR` as a Portuguese alias in the
[opt-out rules editor](https://docs.orbit.devotel.io/compliance/opt-out-keyword-alias-table.md) so
Portuguese-language replies suppress immediately.

**3. Scrub the national list for voice**

Before any Portuguese voice campaign, run the
[DNC Scrub](https://docs.orbit.devotel.io/compliance/dnc-scrub.md) against the do-not-contact list
and keep the suppression ledger current for every channel.

**4. Set the quiet-hours window**

Opt in the tenant quiet-hours toggle for the SMS and voice channels
and set a Europe/Lisbon evening window per
[Quiet Hours FAQ](https://docs.orbit.devotel.io/compliance/quiet-hours-faq.md).

**5. Read the live row and send**

Re-read `GET /api/v1/compliance/country-rules?country=PT` for the
current `registration` and `sender_types` values, then send. A
revocation received on any channel lands in the suppression ledger
and blocks the next send to that recipient.

***

## Related references

* [Regional Posture Hub](https://docs.orbit.devotel.io/compliance/country-rules-directory.md) — the index
  this page is listed in.
* [Country Compliance Requirements](https://docs.orbit.devotel.io/compliance/country-requirements.md) —
  the live PT row this page expands.
* [Denmark Marketing Act Sender Rules](https://docs.orbit.devotel.io/compliance/denmark-marketing-act-sender-rules.md)
  and [Norway Marketing Act Sender Rules](https://docs.orbit.devotel.io/compliance/norway-marketing-act-sender-rules.md) —
  the sibling pages this coverage wave adds.
* [Spain AEPD + LGT Rules](https://docs.orbit.devotel.io/compliance/spain-aepd-lgt-rules.md) — the sibling
  Iberian regime.
* [Consent Management](https://docs.orbit.devotel.io/compliance/consent-management.md) — where the
  Portuguese opt-in record lives.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.