Data subjects have the right to object to the processing of their personal data when it is carried out exclusively for direct marketing purposes, including the creation of marketing profiles. Once this right is exercised, the controller must cease all such marketing related processing.

In addition, the data controller must, as part of their information duty, make available to the public on a permanent basis, on its website or through any other equivalent information medium, at least the following information:

• The privacy policy, including its most recent date and version.
• The identification of the controller and its legal representative, and the identification of the Data Protection Officer if applies. 
• The postal address, email address, contact form, or identification of the equivalent technological means in common use and easily accessible through which requests submitted by data subjects are to be notified to it.
• The categories or types of data it processes; a generic description of the universe of persons encompassed by its databases; the recipients to whom the data are expected to be communicated or ceded; the purposes of the processing it carries out; the legal basis for the processing; and, in the case of processing based on the satisfaction of legitimate interests, what those interests are.
• The security measures adopted to protect the personal databases it administers.
• The data subject’s right to request from the controller access, rectification, erasure, objection and portability of his or her personal data, in accordance with the law.
• The data subject’s right to submit a complaint with the Agency if the controller rejects or fails to timely respond to the requests submitted by the data subject.
• Where applicable, whether personal data will be transferred to a third country or an international organization and whether such destination offers an adequate level of protection. If an adequate level of protection is not present, it must be indicated whether there are safeguards that justify such transfer.
• The period for which the personal data will be retained.
• The source from which the personal data originates and, where applicable, whether they come from publicly accessible sources.
• Where the processing is based on the data subject’s consent, the existence of the right to withdraw such consent at any time, without affecting the lawfulness of processing based on consent prior to its withdrawal.
• The existence of automated decision-making, including profiling. In such cases, meaningful information about the logic involved, as well as the envisaged consequences of such processing for the data subject.

The Chilean Consumer Protection Act (Law 19,496/1997), on the other hand, defines “advertising” as the communication that the provider of goods or services send to the public by any means, in order to inform and motivate the purchase of goods or services. It also indicates that all promotional or advertising communication must indicate an expeditious way in which the recipients can request the suspension of the promotional communication (opt-out). After a consumer has exercised his opt out right, the sending of new communications is prohibited. In case of promotional or advertising communication sent by e-mail, the communication must also indicate the subject matter or theme and the identity of the sender.