# Cookie consent in Portugal: what Law 41/2004 requires > In Portugal, storing information on a visitor's device, or reading information already there, is allowed only with the visitor's prior consent based on clear and complete information, under Article 5 of Law no. 41/2004 as amended by Law no. 46/2012. The data protection authority, the CNPD, enforces the rule and can fine a company between 5,000 and 5,000,000 euros. Strictly necessary storage is exempt, and information for consumers must be given in Portuguese. Source: https://cookiequiet.com/laws/portugal Published: 2026-10-21 Publisher: Cookiequiet ## Quick facts - **Applies to:** Anyone who stores or reads information on the terminal equipment of a subscriber or user in Portugal: websites, apps, ad and analytics providers - **Consent model:** Prior opt-in consent based on clear and complete information - **Cookie rule:** Article 5 of Law no. 41/2004 of 18 August, as amended by Law no. 46/2012 of 29 August - **Authority:** Comissão Nacional de Proteção de Dados (CNPD), under Article 15(1) of Law 41/2004 - **Maximum fine:** 5,000 to 5,000,000 euros for companies and 1,500 to 25,000 euros for individuals (Article 14(1)(e)); GDPR fines up to 20 million euros or 4% of turnover - **Language:** Information to consumers must be in Portuguese (Article 7(3) of Law 24/96) ## Which Portuguese law regulates cookies? Portugal transposes the [ePrivacy Directive](/laws/eprivacy-directive) in Law no. 41/2004 of 18 August on the processing of personal data and the protection of privacy in electronic communications. Law no. 46/2012 of 29 August, which transposed the 2009 amendment to the Directive, rewrote Article 5 to require prior consent and republished the whole law. A second amendment, made by the Electronic Communications Law (Law no. 16/2022), changed only Articles 7 and 10, which deal with location data and emergency calls, so the cookie rule is still the 2012 text. Article 5(1) reads, in substance: storing information, and gaining access to information stored, in the terminal equipment of a subscriber or user is allowed only if the subscriber or user has given prior consent, based on clear and complete information under the data protection law, in particular about the purposes of the processing. Since the data protection law of the time has been replaced by the [GDPR](/laws/gdpr), consent is read with the GDPR definition: freely given, specific, informed, unambiguous, by a clear affirmative action, and as easy to withdraw as to give. ## Which cookies are exempt? Article 5(2) keeps the Directive's two exemptions. No consent is needed for technical storage or access: 1. whose only purpose is to transmit a communication over an electronic communications network; or 2. that is strictly necessary for the provider to deliver an information society service the subscriber or user expressly requested. Session cookies, login, shopping carts, security, load balancing and the cookie that records the consent choice fit here. The exemption is read narrowly: a cookie is not strictly necessary because the site owner finds it useful, only because the service the visitor asked for cannot work without it. Portuguese law has no specific exemption for audience measurement, so analytics cookies need consent unless the tool stores and reads nothing on the device. Advertising pixels, social media plugins, embedded videos and chat widgets that set identifiers before the visitor uses them all need consent first. ## Who enforces cookie rules in Portugal? Unlike several of its neighbors, Portugal gives the cookie rule to the data protection authority rather than the telecoms regulator. Article 15(1) of Law 41/2004 makes the Comissão Nacional de Proteção de Dados (CNPD) responsible for opening and deciding administrative offence proceedings, and for imposing warnings, fines and additional sanctions, for breaches of Article 5. The telecoms regulator ANACOM handles other parts of the law, such as network security. Under Article 13-D, the CNPD can also issue regulations on good practice, give orders and make recommendations. The CNPD also enforces the GDPR in Portugal, so a site that sets trackers without consent can face both a breach of Article 5 and a GDPR breach for the personal data collected. ## How high are the fines in Portugal? Article 14(1)(e) makes it an administrative offence to fail to respect the conditions for storing and accessing information in Article 5. The fine ranges from 5,000 to 5,000,000 euros when the offence is committed by a company or other legal person, and from 1,500 to 25,000 euros for an individual. Under Article 15, 60% of the fine goes to the State and the rest to the authority that imposed it. GDPR breaches linked to the same tracking fall under the GDPR scale, up to 20 million euros or 4% of worldwide annual turnover, and a single banner can breach both laws at once. We found no published CNPD fine under Article 5 as of October 2026, and the CNPD has not issued cookie-specific guidance of its own. Its list of guidelines covers direct marketing, security measures and other subjects. In practice, Portuguese sites follow the EDPB's guidelines, which the CNPD publishes in Portuguese, and the consent standard of the Court of Justice in Planet49 (C-673/17, 1 October 2019). ## What should a cookie banner in Portugal do? A banner that meets Article 5 and the EDPB's guidance: - blocks every non-exempt cookie and script until the visitor has chosen; - explains clearly and completely what each category is for, who sets the cookies, how long they last and whether third parties can read them, the points the Court of Justice named in Planet49; - offers Accept and Reject options of equal prominence on the first layer, as the EDPB's cookie banner task force expects (see the [Reject all guide](/guides/reject-all-button)); - lets visitors consent per purpose, with nothing pre-ticked; - does not make access to the site depend on accepting tracking; - makes withdrawal as easy as consent and records each choice. ## Does the banner have to be in Portuguese? Yes for sites aimed at consumers in Portugal. Article 7(3) of the Consumer Protection Law (Law no. 24/96 of 31 July) says that information to the consumer is given in Portuguese, and Decree-Law no. 238/86 requires information about goods and services offered on the Portuguese market to be in Portuguese. Article 5 of Law 41/2004 also demands clear and complete information, which a visitor can only get in a language they read. ## How Cookiequiet fits Setting up Cookiequiet takes one script tag and about five minutes: the scan fills the cookie table, Reject all sits next to Accept all on the first layer by default, and the banner is shown in Portuguese to visitors whose browser asks for it, among 24 languages. Each choice goes into a consent log, and geo-targeting is included on every plan, [including Free](/pricing). The [cookie scanner](/tools/cookie-scanner) shows which trackers your site sets before any choice. ## Questions ### Who enforces the cookie rules in Portugal? The CNPD, the Portuguese data protection authority. Article 15(1) of Law 41/2004 gives it the power to open proceedings and impose fines for breaches of Article 5, the cookie rule. ANACOM, the telecoms regulator, handles other parts of the law. ### What is the maximum cookie fine in Portugal? Under Article 14(1)(e) of Law 41/2004, breaching the cookie rule is punishable by a fine of 5,000 to 5,000,000 euros for a company and 1,500 to 25,000 euros for an individual. GDPR fines for the related personal data can be higher. ### Do analytics cookies need consent in Portugal? Yes. Article 5 only exempts storage needed to transmit a communication and storage strictly necessary for a service the user expressly requested. Portugal has no specific analytics exemption. ### Does a Portuguese cookie banner have to be in Portuguese? For consumer-facing sites, yes. The Consumer Protection Law requires information to consumers in Portuguese, and Article 5 requires clear and complete information, which in practice means the visitor's language. ## Sources - [Lei n.º 46/2012, de 29 de agosto (amends and republishes Lei n.º 41/2004; Articles 5, 14 and 15), Diário da República](https://diariodarepublica.pt/dr/detalhe/lei/46-2012-174793) - [Lei n.º 41/2004, de 18 de agosto, Diário da República](https://diariodarepublica.pt/dr/detalhe/lei/41-2004-480710) - [Lei n.º 16/2022, de 16 de agosto (Electronic Communications Law; amends Articles 7 and 10 of Lei 41/2004), Diário da República](https://diariodarepublica.pt/dr/detalhe/lei/16-2022-187481298) - [Lei n.º 24/96, de 31 de julho (Consumer Protection Law, Article 7), Diário da República](https://diariodarepublica.pt/dr/detalhe/lei/24-1996-406882) - [CNPD, Diretrizes (list of CNPD guidelines)](https://www.cnpd.pt/decisoes/diretrizes/) - [EDPB, Report of the work undertaken by the Cookie Banner Taskforce (17 January 2023)](https://www.edpb.europa.eu/documents/task-force-report/report-of-the-work-undertaken-by-the-cookie-banner-taskforce_en)