Ranked by the law,
not by the map.
Three countries to enter, chosen on which regulations actually force a consent decision. That test puts Brazil, Chile and Colombia in, and leaves the region's second largest advertising market out on purpose.
Europe has a safety net.
Latin America does not.
Google Ads consent mode conversion modeling is available in the EEA and the UK only. Same banner, same refusal rate, and nothing comes back.
Some of it returns
The tag is denied and the signal is lost, then Google models a portion of the lost conversions back into Google Ads. The advertiser sees a dip, not a hole. This is why a badly wired European banner is survivable.
safety net · platform sideNothing returns
The same refusal, and no backfill from anyone. The only route back to the conversion is first party server side collection the advertiser owns. That makes "Conversions you keep" a sharper claim here than in Europe.
no net · our groundFive markets, scored on the law.
Regulatory forcing carries 30 percent of the weight. The order it produces is not the order market size would produce — Peru outranks the region’s biggest Spanish speaking market.
BR joined the opt in regions on 5 Aug 2026 and the site ships a Portuguese edition. The regulator gained full independence in Feb 2026 and names advertising in its own enforcement priorities.How the scores were built.
Six dimensions, weighted for a company that is early. A legal trigger and a low cost to serve matter more right now than raw addressable market.
Which USPs cross the Atlantic.
The July research produced six candidates, all shaped around the EU Digital Omnibus. Two are statutory to Europe and cannot be repeated here without making a false claim.
Three that only exist here.
Each one is a consequence of regional law or regional platform behaviour, and none of them can be copied out of the European deck.
No safety net
driver · the modeling gap"In Europe, Google fills part of the gap. In Brazil, nobody does." The strongest single line available in this region, and it is verifiable against Google's own documentation.
The log is the product
driver · Ley 1581 recordsSell the immutable consent log and the rendered screenshot proof as the compliance artifact itself, not as a feature of a banner. No incumbent sells the record.
One account, five regimes
driver · divergenceBrazil opt in, Mexico opt out, Chile flipping on a known date, Colombia express consent, Argentina legacy adequacy. An agency with a regional roster needs all five behaviours in one dashboard.
Brazil
The proving
ground.
Largest market in the region, close to zero entry cost, and a regulator that has just been given teeth.
The LGPD has no ePrivacy style cookie article, but ANPD guidance reads consent as the lawful basis for non essential cookies and requires withdrawal to be as easy as giving it. That is an opt in shape, and a default allow banner cannot honour it for tags that already fired.
Already live. BR entered OPT_IN_REGIONS in the banner SDK and edge policy on 5 August 2026, the site ships a Brazilian Portuguese edition at /pt, and the banner carries a pt locale. The engine moved before the claim, which is the right order.
Every Brazilian advertiser who installs a compliant banner takes a permanent measurement hit, because Google will not model the refusals back. Lead with the loss, quantified from the onboarding scan, then sell the recovery stack as the only route back.
Point a share of the daily answer engine routine at Portuguese questions. The GTM community template reaches Brazilian tag managers on day one. Agency partner program once the stage gate clears — this is one of the most server side literate advertising markets in the world.
An LGPD specific consent record schema, ANPD shaped data subject request tooling, and Portuguese legal pages that are operative rather than courtesy translations. All three are already flagged on the roadmap as not built.
One Brazilian reference account with a measured consent rate and a recovered signal figure. Nothing else in this deck should start before that exists.
Chile
A country
on a clock.
The smallest market on the list and the only certain date. Law 21.719 replaces a 1999 statute that was barely enforced.
Published December 2024 with a 24 month transition, in force 1 December 2026. It creates the Agencia de Protección de Datos Personales, Chile's first independent authority, whose directive council was in Senate confirmation as of May 2026 and is expected to take office in October. Penalties reach 20,000 UTM, rising to 4 percent of revenue for repeat serious breaches.
This is the July research thesis in its purest form. The confusion window is the go to market window — except here the window has a date on it, which the EU Omnibus still does not.
The Spanish banner locale exists. Needed: CL in the opt in region list on both the SDK and the edge policy, Chilean jurisdiction defaults, and Spanish marketing and legal pages. A small build that has to finish well before December.
Content needs months to rank. Spanish material must ship from September, so that when a Chilean marketing lead searches what the law means for cookies in October and November, Velo is the answer they find. Arriving in December is arriving late.
Chile will not pay for itself on volume. It buys being the CMP that was already there on day one, plus Spanish language authority that carries into Colombia, Peru and Mexico. A reference and content investment with revenue attached.
The authority is brand new and will publish its own guidance. Whether it takes a strict European reading of cookies or a lighter one is not yet knowable, and it changes how hard the pitch can be. Re verify before any copy goes out.
Colombia
Where the
log is the sale.
The strictest consent text in the region, an enforcer that uses it, and the best channel economics of the three.
Law 1581 requires consent that is prior, express and informed for all personal data processing including cookies, with no legitimate interest route around it. The SIC enforces through its data protection delegation, with penalties reaching 2,000 monthly minimum salaries. Two reform bills before Congress would add GDPR aligned rights and extraterritorial scope.
Authorization logs must be maintained. Colombia does not just require consent, it requires the record of consent. Every competitor sells a banner and treats the record as an afterthought.
Sell the log, not the banner. Velo's immutable consent record plus rendered screenshot proof is the artifact the SIC asks for, produced automatically as a side effect of running the banner.
Bogotá and Medellín are nearshore agency hubs serving local and United States clients. That means many domains per account, which is the metric the growth model already treats as the north star, and it means the GPC story cross sells inside the same conversation.
Needs CO in the opt in region list. Spanish assets are shared with the Chile build, so entering Chile first makes Colombia substantially cheaper.
Colombian agencies are price sensitive, so flat portfolio pricing against per domain stacking lands harder here than it does in Europe — provided Velo's own tier is not the euro one.
Peru
The cheap
third market.
Not a fourth entry. A Spanish market that costs almost nothing once Chile and Colombia are built — plus the one distribution asset we have here and nowhere else.
Law 29733 requires consent that is free, prior, express, informed and unequivocal, and the guidance applies it to cookies directly: consent before cookies are set, and continuing to browse is explicitly not acceptance. The new reglamento DS 016-2024-JUS took effect 30 March 2025 with extraterritorial scope, 48 hour breach notification and mandatory DPOs. Fines reach roughly USD 600,000.
Medium sized companies must appoint a data protection officer by November 2026; large companies passed that mark in November 2025. It lands in the same window as Chile, and it puts a named person inside each target company whose job is to ask exactly the question Velo answers.
It shares the entire Spanish asset base with Chile and Colombia. Once CL and CO exist, PE is one region code and a content pass. The marginal cost of the third Spanish market is close to zero, which is the whole argument for including it.
Existing relationships with Peruvian web influencers are a channel Velo has in no other market. Worth testing here precisely because the market is small: prove whether influencer led acquisition works for a CMP at all somewhere a miss is cheap, before spending that motion in Brazil.
66 assumes those creators reach site owners, marketers and developers. If the audience is consumer rather than professional, channel fit drops and Peru falls behind Mexico. Confirm who actually watches before funding it.
Peru does not crack the top three under any reasonable channel assumption — even a best case influencer audience scores it 69, still behind Colombia. It is an attachment, never a replacement, and it must not pull effort off Chile's December date.
The one we leave out
on purpose.
Mexico is the region's second largest advertising market and its weakest legal reason to buy a consent product. Size did not win the argument.
The 2025 LFPDPPP narrowed tacit consent but did not remove it. For non sensitive data — analytics identifiers among them — a privacy notice plus an opt out mechanism can still satisfy the law. There is no opt in trigger to sell against.
Enforcement moved in March 2025 to the Ministry of Anti Corruption and Good Governance. That is a ministry, not an independent specialist authority, and enforcement capacity plausibly decreased rather than grew.
Mexico already works under the default granted policy at no engineering cost. Sell on measurement and United States traffic exposure, never on compliance urgency. Treat demand as inbound and revisit if the Ministry issues cookie guidance.
What happens when.
Anchored to the one fixed date in the region, and to the existing stage gate: no volume outreach and no paid channel until at least one pilot passes.
CL, ship Spanish content early enough to rank.
Phase one gates everything below it. Latin America is a sequencing decision, not permission to open a second front early.
What has to be true first.
BigQuery streaming has zero code. Server side tagging is a stub.
The managed server side product is a roughly 170 line stub whose staging URL points at sgtm-staging.invalid. The consent gate decision logic is real and tested; the delivery vehicle is not.
This matters far more here than in Europe. In the EEA, Consent Mode advanced plus Google's modeling delivers real value even without server side. In Brazil there is no modeling, so without the server side path Velo is a banner that loses the customer data and gives nothing back. The region cannot be sold before this exists.
At Latin American purchasing power Velo's own top plan is the expensive option. Regional tiers in BRL, CLP and COP, or the anti Cookiebot argument points the wrong way. Stripe is also still a stub in production, and Brazil runs on Pix and boleto.
Portuguese legal pages are courtesy translations rather than operative documents, there are no Spanish legal pages at all, and no LGPD specific consent record schema exists.
The EEA and UK restriction is confirmed for Google Ads conversion modeling; GA4's own behavioural modeling was not separately verified, so do not silently widen the claim. And every Chilean statement is an inference from statute until the new authority publishes guidance.