LGPD and cookies: Brazil's rules for consent banners

What is the LGPD?

The Lei Geral de Proteção de Dados Pessoais, Law No. 13,709 of 14 August 2018, is Brazil's general data protection law. It was modeled on the GDPR and shares its vocabulary: controllers, processors, legal bases, data subject rights, a national authority. It entered into force on 18 September 2020, and the administrative sanctions in Articles 52 to 54 became applicable on 1 August 2021. The Autoridade Nacional de Proteção de Dados (ANPD) supervises it, issues regulations and guides, and imposes fines.

Who does the LGPD apply to?

Article 3 applies the law to any processing operation carried out by a natural or legal person, public or private, regardless of the medium, the country where the company is based or where the data is located, as long as the processing takes place in Brazil, aims to offer goods or services to people located in Brazil, or concerns personal data collected in Brazil. A foreign website that sells to or tracks Brazilian visitors is in scope. Small businesses and startups benefit from simplified obligations under an ANPD regulation, but not from an exemption.

What does the LGPD require for cookies and consent?

The LGPD has no article about cookies. It applies to them because cookie identifiers, IP addresses and device identifiers relate to an identifiable person and are therefore personal data. The ANPD's guide Cookies e Proteção de Dados Pessoais, published on 18 October 2022, explains how. It is an interpretive document rather than a binding regulation, but it is the regulator's stated reading of the law.

The guide classifies cookies by who manages them (first or third party), by necessity (necessary or non-necessary), by purpose (functional, analytics, advertising) and by retention period, and then matches them to legal bases:

• Strictly necessary cookies (session, security, consent storage) do not fit consent, because the visitor has no real choice; the guide points to legitimate interest or the performance of a contract instead.
• Analytics cookies may in some cases rely on legitimate interest, for example simple audience measurement, subject to the balancing test and transparency.
• Advertising and profiling cookies should rely on consent, because legitimate interest is unlikely to prevail where data is used to target people.

Consent under the LGPD is defined in Article 5 XII as a free, informed and unequivocal expression by which the data subject agrees to the processing of personal data for a specific purpose. Article 8 adds the conditions: it can be given in writing or by another means that demonstrates the person's will, generic authorizations are void, the controller bears the burden of proving that consent was obtained, and it can be revoked at any time through a free and easy procedure. Article 9 requires clear information about the purposes, the duration and the recipients of the data.

The guide lists practices to avoid: non-necessary cookies pre-selected or active by default, a Reject option harder to see than Accept, banners that only offer Accept, information buried in a long policy, and cookie walls that block the site until everything is accepted. Its good-practice banner shows Accept and Reject together on the first layer, with a link to granular preferences and the cookie policy.

What must a compliant banner do?

• Load no consent-based cookies before the visitor chooses, and keep necessary cookies clearly separated.
• Offer Accept and Reject with equal prominence, and a preferences screen with the categories off by default.
• Explain, in Portuguese for Brazilian visitors, what each category does, how long cookies last and who receives the data.
• Record the choice, because Article 8 puts the burden of proof on the controller.
• Let visitors withdraw consent as easily as they gave it, through a link or icon on every page.

Enforcement and fines

Article 52 lists the sanctions: a warning with a deadline to correct, a simple fine of up to 2% of the revenue of the company, group or conglomerate in Brazil in its last financial year, excluding taxes, capped at R$50 million per infraction, a daily fine up to the same cap, publication of the infraction, blocking of the data and deletion of the data. The ANPD's 2023 regulation on the calculation of fines grades them by the seriousness of the breach, the share of revenue and the company's cooperation.

Enforcement started modestly. The ANPD's first fine, published on 6 July 2023, hit a telemarketing microenterprise, Telekall Infoservice, with a warning and R$14,400 in fines for processing without a legal basis and failing to cooperate. Since then the ANPD has focused its sanctioning processes on data breaches, missing data protection officers and unlawful data use, and has issued orders rather than cookie fines so far. Brazilian consumer protection bodies and courts also hear LGPD claims, and the law gives data subjects a right to compensation.

How Cookiequiet handles the LGPD

Brazil is one of the countries in Cookiequiet's regulated list, so with geo-targeting on, Brazilian visitors see the consent banner while visitors from countries without a cookie law can be left alone. The banner follows the ANPD's model: Accept all and Reject all with the same weight, categories off by default, Portuguese strings picked from the browser language and editable. Scripts and embeds are held until consent for their category, the consent log keeps the proof Article 8 asks for, and the privacy policy generator includes LGPD sections (legal bases, rights, the ANPD as the authority) as a template, not legal advice. The cookie scanner gives you the cookie inventory the guide expects you to publish. See also how to write a cookie policy.