Lei Geral de Proteção de Dados (Brazil)
The Lei Geral de Proteção de Dados (LGPD), or General Data Protection Law, is Brazil's comprehensive data privacy legislation that came into effect on September 18, 2020. The law regulates the processing of personal data of individuals in Brazil, both online and offline, by public and private entities.
LGPD is heavily inspired by the European Union's GDPR and shares many similar principles, but it has unique characteristics tailored to the Brazilian legal system and cultural context. If your website has Brazilian visitors or processes data of Brazilian residents, LGPD compliance is mandatory.
Under LGPD, you must have a valid legal basis to process personal data. The law recognizes 10 legal bases, including:
For cookies and tracking technologies, consent is typically the most appropriate legal basis, especially for analytics and marketing cookies.
When relying on consent as the legal basis, LGPD requires that consent must be:
Important: Pre-ticked boxes, implied consent through continued browsing, and bundled consent are NOT valid under LGPD.
LGPD grants Brazilian residents comprehensive rights over their personal data:
Your privacy policy must be clear, accessible, and written in plain language. It must include:
While not mandatory for all organizations, appointing a DPO is recommended, especially for larger organizations or those processing sensitive data. The DPO's contact information must be publicly available.
While LGPD is inspired by GDPR, there are some important differences:
| Aspect | LGPD | GDPR |
|---|---|---|
| Territorial Scope | Applies to processing of data of individuals in Brazil | Applies to processing of data of individuals in EU/EEA |
| Legal Bases | 10 legal bases including credit protection | 6 legal bases |
| Age of Consent | Not explicitly defined (generally considered 18) | 16 years (member states can lower to 13) |
| Maximum Fine | 2% of revenue in Brazil, up to R$50 million per violation | 4% of global annual revenue or €20 million, whichever is higher |
| DPO Requirement | Recommended but not always mandatory | Mandatory for certain categories of processing |
| Data Breach Notification | Must notify ANPD within a reasonable timeframe | Must notify within 72 hours |
While LGPD doesn't have a separate "cookie law" like the EU's ePrivacy Directive, cookie consent falls under LGPD's general consent requirements. Here's what you need to know:
Cookies that are essential for the website to function can be placed without consent, based on the "legitimate interest" legal basis. Examples include:
All other cookies require explicit consent before being placed:
Your cookie banner must:
CookieConfig is designed to help you meet LGPD's cookie consent requirements:
You must comply with LGPD if:
Important: LGPD has extraterritorial reach. If you have a website that's accessible to Brazilian users and you use cookies to track them, LGPD likely applies to you, regardless of where your company is based.
LGPD does NOT apply to:
Identify all cookies and tracking technologies on your website. Document what data each cookie collects and why.
Place the CookieConfig script in your website's <head> section BEFORE any tracking scripts.
Review and customize the cookie categories in your CookieConfig dashboard to match your actual cookie usage.
Ensure your privacy policy is LGPD-compliant and includes detailed information about:
Update the banner text to clearly explain your cookie usage in Portuguese (if targeting Brazilian users) or provide a Portuguese translation option.
Create processes to handle requests from Brazilian users to:
Verify that:
Regularly review and export consent logs. Be prepared to provide proof of consent if requested by ANPD or a data subject.
Periodically review your website for new cookies or tracking technologies. Update your cookie banner and privacy policy accordingly.
Train your team on LGPD requirements and how to handle data subject requests properly.
The Autoridade Nacional de Proteção de Dados (ANPD) is Brazil's data protection authority responsible for enforcing LGPD. The ANPD gained full enforcement powers in August 2021.
LGPD violations can result in the following administrative sanctions:
When determining penalties, ANPD considers:
While LGPD enforcement is still ramping up, ANPD has begun taking action:
Mistake: Blocking access to the website unless users accept all cookies.
Why It's Wrong: LGPD requires that consent be "freely given." Forcing users to accept cookies to access content makes consent conditional and potentially invalid.
Solution: Allow users to access your basic content even if they reject non-essential cookies. Only truly essential cookies should be required for site functionality.
Mistake: Having cookie categories pre-selected or automatically checked.
Why It's Wrong: LGPD requires explicit, unambiguous consent through an affirmative action. Pre-ticked boxes don't meet this standard.
Solution: All non-essential cookie categories must be unchecked by default. Users must actively opt in.
Mistake: Assuming that continued browsing or scrolling constitutes consent to cookies.
Why It's Wrong: LGPD requires explicit consent. Silence, inactivity, or continued browsing cannot be considered valid consent.
Solution: Require users to click "Accept" or actively select cookie preferences. Block non-essential cookies until explicit consent is received.
Mistake: Bundling cookie consent with acceptance of terms of service or other agreements.
Why It's Wrong: LGPD Article 8 requires that consent clauses be "highlighted" and presented separately from other contractual clauses.
Solution: Keep cookie consent separate from other agreements. Users should be able to accept terms of service without being forced to accept all cookies.
Mistake: Using overly technical or legal language in cookie notices without clear explanations.
Why It's Wrong: LGPD requires information to be provided in "clear, adequate, and easily accessible" language. Users must be properly informed.
Solution: Use plain Portuguese (or translated text) that average users can understand. Explain in simple terms what each cookie type does.
Mistake: Not keeping records of when and how consent was obtained.
Why It's Wrong: Under LGPD, you must be able to prove that valid consent was obtained. ANPD can request evidence of consent.
Solution: Use CookieConfig's consent logging to maintain detailed records with timestamps, visitor IDs, and geographic information.
Mistake: Making it hard for users to withdraw consent or change cookie preferences (e.g., buried in settings, requiring account login).
Why It's Wrong: LGPD Article 8 requires that consent withdrawal be as easy as giving consent.
Solution: Provide a clear, easily accessible way for users to change their cookie preferences at any time (e.g., a link in the footer or floating button).
Mistake: Not having special procedures for processing data of children and adolescents.
Why It's Wrong: LGPD Article 14 requires that processing of children's data must be in their best interest and requires parental consent (for minors under 18).
Solution: If your website targets children or knowingly collects data from minors, implement age verification and parental consent mechanisms.
CookieConfig is a tool to help implement cookie consent requirements under LGPD and other privacy regulations. However, it is not legal advice. Your specific compliance obligations depend on your business activities, the types of data you process, and your target markets. We strongly recommend consulting with legal counsel familiar with LGPD and Brazilian privacy law for your specific situation.