Chile's data protection law 21.719: what to change on your website if you sell into Chile

Chile has a new data protection law, and it does not stop at the border. If your company sells to customers in Chile, runs ads aimed at Chilean audiences, or tracks visitors from Chile on its website, Law 21.719 can apply to you even if you have no office there. This guide skips the legal summary and goes straight to the website: privacy policy, forms, analytics, pixels, WhatsApp and chat, with a 12-point checklist at the end.

Does Chile's Law 21.719 apply to your company?

The law adds an article 1 bis to Chile's data protection statute (Law 19.628) that defines its territorial reach. It applies when:

• The controller or processor is established in Chile.
• A processor anywhere in the world handles data on behalf of a controller established in Chile. If you host, run CRM or automate leads for a Chilean company, this is you.
• The controller or processor is not in Chile, but its processing is aimed at offering goods or services to people in Chile (whether or not they pay), or at monitoring their behavior in Chile, including analysis, tracking, profiling or behavior prediction.

That third point is the one that matters for international businesses. A Spanish-language landing page targeting Chile, prices in Chilean pesos, shipping to Chile or ad campaigns geotargeted to Chile are all signs that you are offering services there. Tracking Chilean visitors with analytics or ad pixels is monitoring behavior.

One more duty applies specifically to foreign companies. Under article 14, a controller with no domicile in Chile that processes data of people living in Chile must designate, and keep up to date and working, an email address or similar contact channel for data subjects and for the Agency.

Chile's Law 21.719 in five facts

The consolidated text (in Spanish) is published by the Library of the National Congress of Chile.

About the possible delay. In September 2026 the government sent the Senate a bill (Boletín 18.623-07) that, according to analyses published by Chilean law firms, would push the start date to December 1, 2027. As of October 12, 2026, the Senate record shows it in its first reading, awaiting the Constitution Committee's report: pending, not approved. Until that changes, December 1, 2026 is the date that counts. And even if it passes, the work on your website is the same; only the deadline moves.

Does your website process personal data?

Almost certainly. Personal data is any information that identifies a person or makes them identifiable. On a typical business website it comes in through:

• Contact or quote forms: name, email, phone, company.
• WhatsApp button and live chat: phone number and conversation history.
• Newsletter or gated downloads: email and sometimes job title or industry.
• Analytics: Google Analytics assigns an identifier to each browser and logs the pages it visits.
• Ad pixels: the Meta Pixel and the Google Ads tag send visit events to those platforms.
• Session recording: tools such as Microsoft Clarity or Hotjar capture clicks and scrolling.
• Server logs: the IP address of every visit.

Each of these needs an answer to three questions: why you use the data, on what legal basis, and who you share it with.

What the law requires you to publish

Article 14 ter requires controllers to keep information about their data processing permanently available on their website. Failing to do so is a minor infringement (art. 34 bis), and minor does not mean free: it can reach 5,000 UTM.

A privacy policy with a date and version number

The policy must show its date and version. The reason is practical: if you change it, you need to prove which text was in force when someone gave you their data. Keep the old versions.

Who the controller is and how to reach them

The company responsible for the data, its legal representative, and a concrete channel for requests: a postal address, an email, a contact form or an equivalent tool. A dedicated privacy email works. A generic "contact us" form shared with sales does not work as well.

What data you collect, why, and who receives it

The categories of data, the purposes, the legal basis and the recipients. For most companies the list of recipients is longer than expected: hosting, email, CRM, Google, Meta, WhatsApp, the automation that moves your leads around. If a vendor receives data, it goes on the list.

Forms: what to change, field by field

Minimization: the field you never use is free risk

If your contact form asks for a national ID number, date of birth or address and nobody uses it, delete the field. Every piece of data you store is data you must protect, disclose and hand over on request.

Consent checkbox: separate, unticked, one purpose each

Article 12 requires consent to be free, informed, specific, prior and unambiguous. On a form, that means:

• The checkbox starts unticked. A pre-ticked box is not an affirmative act.
• One purpose per checkbox. Answering an inquiry and sending promotions are two different things.
• The text links to your privacy policy, close to the checkbox and before the submit button.

Replying to an inquiry can rely on another legal basis in article 13 (such as steps taken at the person's request before a contract), but marketing emails need their own consent.

Where the data ends up and how long you keep it

Follow one lead: it arrives by email, gets copied to the CRM, an automation pushes it to a spreadsheet, someone forwards it on WhatsApp. Each stop is a place where it can leak. Set how long you keep contacts that never convert, and record when each person accepted your policy.

Analytics, pixels and cookies: where most sites get it wrong

What your tags load today

Open your site in a private window and check the Network tab in the developer tools before clicking anything. On many sites, Google Analytics 4, the Google Ads tag, the Meta Pixel and a session recorder all load immediately: they set identifiers and send data to third parties before the visitor has decided anything.

The law does not mention cookies

Law 21.719 never uses the word "cookies", and Chile has no cookie-specific rule like the EU's ePrivacy framework. So why ask for consent?

Because these tools process personal data, and every processing operation needs a legal basis (arts. 12 and 13). Measurement and advertising are not essential for a website to work, so it is hard to justify them on any basis other than consent. This is a prudent interpretation, not an express rule, and the Agency may clarify it through its guidance.

A banner that blocks, not one that just informs

A banner saying "this site uses cookies" while the pixel has already fired does nothing. A serious one:

• Does not load analytics or advertising tags until the visitor accepts.
• Gives "Accept" and "Reject" equal visual weight on the first layer.
• Offers settings by category (measurement, advertising).
• Stores the choice and lets people change it later, for example from a footer link.

Google Consent Mode v2: measure without skipping consent

Consent Mode is Google's mechanism for making its tags respect the visitor's choice. It uses signals such as analytics_storage, ad_storage, ad_user_data and ad_personalization, which start as denied and switch to granted only when the visitor accepts. There are two modes:

• Basic: Google tags do not load until there is consent. The strictest option.
• Advanced: tags load with everything denied and send cookieless pings that Google uses to model conversions. If you choose it, say so in your cookie policy.

For non-Google tools such as the Meta Pixel or Clarity, the rule is simpler: they do not load until there is consent.

How we did it on emignia.com. We built our own banner with three options (accept, reject and settings), Consent Mode v2 in advanced mode with everything denied by default, and the Meta Pixel and Microsoft Clarity load only if the visitor accepts them. The contact form has a required, unticked privacy checkbox, and the chat shows a visible notice before you type. You can change your choice from "Cookie settings" in the footer, and the details are in our Cookie Policy.

WhatsApp, chatbots and AI assistants

• A notice when the conversation starts. Who is answering, whether it is an AI assistant, and where the privacy policy is. One line is enough.
• What the assistant stores. The history, the phone number and whatever the person shares. Decide how long you keep it and who can read it.
• Vendors. The WhatsApp platform, the AI model and the automation server all receive data on your behalf. List them in your policy as recipients and have a contract that limits what they can do with it.
• Sensitive data. In health care or any field where people may share sensitive information, the bar is higher. Design the flow to collect only what you need to book or route the request, not to diagnose over chat.

Data subject rights: the channel your site needs

Article 4 grants the rights of access, rectification, erasure, objection, portability and temporary blocking. In practice, your site needs a clear channel to receive these requests, a way to verify the requester's identity, and a record of how you answered.

The deadline to respond is 30 calendar days, extendable once by another 30. If today such a request would land in the same inbox as sales quotes, separate them before December.

Basic security and what to do after a breach

Covering the basics does not require a security audit:

• HTTPS across the entire site, no exceptions.
• Two-factor authentication on hosting, CMS, email and CRM.
• Least-privilege access and personal accounts, never shared logins.
• Plugins and dependencies kept up to date, and backups someone has actually restored.

On top of that, article 14 sexies requires reporting security breaches affecting personal data to the Agency when there is a reasonable risk to people's rights. Write down who decides, who gets notified and where the logs are reviewed.

Fines: what is at stake

Chilean fines are set in UTM (unidad tributaria mensual), a monthly tax unit adjusted for inflation and published by the tax authority. According to the SII, one UTM is worth CLP 72,151 in October 2026, so the caps below are roughly CLP 361 million, 722 million and 1.44 billion.

For repeat serious or very serious infringements by companies that are not small businesses under Chilean Law 20.416, fines can reach 2% (serious) or 4% (very serious) of annual revenue. The law also creates a national register of sanctions and compliance, so the cost is not only the fine.

Checklist: 12 points for your website

Legal content

1. Privacy policy published, with date, version and controller details.
2. A clear channel for rights requests; if you have no domicile in Chile, a working email for data subjects and the Agency.
3. A list of vendors that receive data: hosting, email, CRM, Google, Meta, WhatsApp, automations.

Forms

4. Only the fields you actually use.
5. Separate, unticked checkboxes per purpose.
6. A record of when and how each person consented.
7. A defined retention period for contacts.

Measurement and advertising

8. An inventory of every script your site loads.
9. A banner that blocks analytics, pixels and session recording until the visitor accepts.
10. Consent Mode v2 configured on your Google tags.

Channels and security

11. A privacy notice at the start of WhatsApp and chat conversations.
12. HTTPS, two-factor authentication and a written incident protocol.

If you want to start with the technical side, run your site through our free SEO audit. If you would rather implement this with us, get in touch.

Frequently asked questions

Sources

• Law 21.719, consolidated text (Spanish): Library of the National Congress of Chile (LeyChile).
• Bill to delay the start date, Boletín 18.623-07: Chilean Senate legislative record.
• UTM values for 2026: Chilean Internal Revenue Service (SII).

---

This article is for information only and is not legal advice. For decisions about your case, consult a lawyer qualified in Chilean law. Information reviewed on October 12, 2026.