The PDPL does not expressly regulate electronic marketing. However, the PDPL does apply to electronic marketing activities if personal data is processed as a result.

If consent is obtained through electronic media, the notice requirements can be met by publishing accessible and identifiable privacy policies with the relevant consent language and mechanism. The PDPL establishes the possibility of obtaining express consent by presenting the option to agree with the privacy policies in clickable ways (eg, by clicking, ticking a box).

Written consent may be provided by other options, including:

• Through an electronic signature
• A written document possible to read or print
• A mechanism or procedure that allows one to identify the subject and to receive his consent through a written text
• A pre-established text as long as it is easily visible, legible and written in simple language

The laws governing electronic signatures are:

• Law N° 27291
• The Digital Certificates and Signatures Law (Law N° 27269)
• Supreme Decree N° 052-2008-PCM (Regulation of Law No. 27269)

Note that expressing the will in any of the regulated forms does not eliminate the other requirements of consent referring to that consent must be prior, informed, express and unequivocal.

Additionally, pursuant to Article 58.1 of Law No. 29571 – the Consumer Protection and Defense Code, the use of call centers, automated or manual telephone calling systems, the sending of text messages to mobile phones, or the mass distribution of electronic messages for the purpose of promoting products or services is prohibited, as is the provision of telemarketing services to consumers. The sole exception to this prohibition applies where a consumer, on their own initiative, has directly contacted the supplier and has granted their free, prior, informed, express, and unequivocal consent to be contacted through a telephone number, e-mail address, or any other analogous means of communication. Such consent may be revoked at any time, with immediate effect and without cause, in accordance with the applicable personal data protection regulations.