Brazil
Lei Geral de Proteção de Dados Pessoais
LGPD: Cookie choices and legal bases for websites serving Brazil
Brazil’s LGPD applies to personal data collected through websites, including data from cookies, pixels and forms. This guide marks what the law requires, what the data protection authority (ANPD) recommends and what we suggest in practice.
At a glance
- Who it can apply to
- Organizations anywhere that process personal data in Brazil, offer goods or services to people in Brazil, or process data collected there (Article 3).
- What it is
- Brazil’s general data protection law, Lei 13.709/2018, enforced by the ANPD. ANPD’s cookie guide is good-practice guidance on applying it.
- Choices to offer
- A legal basis for each purpose. Where you use consent, it must be free, informed, unambiguous and easy to revoke. ANPD sees consent as the better fit for advertising cookies.
- Website actions
- Record the purpose and legal basis of each cookie and pixel.
- Keep consent-based cookies off until the visitor opts in.
- Offer a visible option to reject non-necessary cookies.
- Explain purposes and retention in Portuguese for visitors in Brazil.
- Make withdrawal free and easy, then test that tools stop.
- Last reviewed
Does LGPD apply to your website?
LGPD requirement: the law covers processing carried out in Brazil, processing aimed at offering goods or services to people in Brazil or at processing their data, and data collected while the person was in Brazil (Article 3). No size threshold takes small websites outside the law.
LGPD requirement: personal data is information about an identified or identifiable person (Article 5). Cookie IDs, browsing histories and advertising profiles qualify once they can be linked to someone, even without a name.
ANPD guidance: the ANPD cookie guide notes that cookie data can identify people indirectly, through inferences, combined records or behavioral profiles, whether the cookie is first-party or not.
Choose a legal basis for each purpose
LGPD requirement: each use of personal data needs a legal basis from Article 7 (Article 11 for sensitive data), such as consent, a contract the person requested or legitimate interests. Legitimate interests covers only strictly necessary data and yields to the person’s fundamental rights (Article 10).
ANPD guidance: the cookie guide sees no hierarchy between the legal bases and takes this view of common uses.
| Cookie use | ANPD’s view | Practical setup |
|---|---|---|
| Strictly necessary: login, basket, payment | ANPD’s viewConsent is not the appropriate basis; legitimate interests can fit. | Practical setupKeep on and explain in the banner and policy. |
| Audience measurement | ANPD’s viewLegitimate interests can fit for aggregated data that is not combined with other tracking or used for profiles. | Practical setupDocument the assessment and offer a way to object. |
| Advertising and profiling | ANPD’s viewLegitimate interests is hardly ever the best fit; consent generally is. | Practical setupKeep off until the visitor opts in. |
Practical tip: assess each tool by what it does, not by its label. Analytics that shares identifiers with an advertising platform is no longer the low-risk measurement ANPD describes.
What valid consent requires
LGPD requirement: consent must be free, informed, unambiguous and given for a specific purpose; generic authorizations are void (Articles 5 and 8). The controller must be able to prove it, and misleading or unclear prior information voids it (Articles 8 and 9).
LGPD requirement: people can revoke consent at any time through a free and facilitated procedure (Article 8, §5).
ANPD’s recommended banner design
ANPD guidance: the guide presents these as good practices, not as a format fixed by law:
- A visible option to reject all non-necessary cookies on the first and second layer. ANPD’s examples treat an “I agree”-only banner as not giving a free choice.
- Consent-based cookies off by default: no pre-ticked boxes and no “continued browsing means yes”.
- A second layer that groups cookies by purpose, with consent per purpose.
- A direct way to withdraw consent and object, beyond browser settings.
- Information that is not only in a foreign language and not so granular that it overwhelms.
Practical tip: use these points as the default for optional cookies. If a tool relies on another legal basis, record why and still explain it.
Information in Portuguese that visitors can follow
LGPD requirement: information about the purpose, the form and duration of processing, who the controller is, data sharing and people’s rights must be clear, adequate and prominent (Article 9).
ANPD guidance: cookie information offered only in a foreign language is a practice to avoid. Keep the first layer short, with purposes and retention periods one step away.
Practical tip: for visitors in Brazil, show the banner and cookie declaration in Portuguese and keep the translations in line with the tools you run. In Passiro, edit the wording per language under Translations.
Example: an online shop with remarketing
An online shop selling to customers in Brazil uses basket and checkout cookies, an analytics tool and an advertising pixel for remarketing. A visitor rejects optional cookies.
The basket and checkout cookies support the purchase, so they stay on. Measurement-only analytics may rest on legitimate interests under ANPD’s guidance, unless it also feeds advertising audiences. The pixel relies on consent, so it stays off and the visitor is left out of audience uploads.
LGPD requirement: if the advertising platform receives the data outside Brazil, the transfer needs an Article 33 route, such as standard contractual clauses or specific, highlighted consent to the transfer. An accepted advertising cookie does not cover that.
Practical tip: test the rejection in a fresh browser session: no pixel requests, no advertising cookies and no customer-list upload based on the refused consent.
Sensitive data, children and new tools
LGPD requirement: sensitive data, such as health or religious data, needs specific and highlighted consent or another Article 11 basis. Children’s and adolescents’ data must serve their best interest, and children’s data generally needs a parent’s or guardian’s specific consent (Article 14).
Practical tip: assess these cases before enabling profiling or advertising, and treat each new marketing tool as a fresh assessment. See Keep consent up to date when adding a new tracking tool.
Website checklist
- Legal basis: record the purpose and basis of every cookie and pixel.
- First visit: confirm consent-based cookies and requests stay off.
- Reject and withdraw: confirm tags and audience uploads stop.
- Language: check the Portuguese banner matches the live setup.
- Vendors: confirm each recipient’s role and transfer route.
FAQ
Is LGPD the same as GDPR?
No. They share concepts, but the legal bases, definitions and regulator differ, so an EU policy needs a Brazil-specific review.
Is ANPD’s cookie guide legally binding?
ANPD calls it a good-practice guide that may be updated. The obligations come from the LGPD; the guide shows how the authority reads them, so document any deliberate departure.
Do we need to keep proof of consent?
Yes, in practice: the controller bears the burden of proving valid consent (Article 8, §2). Passiro keeps consent records for the history period of your plan; see consent records by plan.
Does withdrawing consent delete the data?
Not automatically. Revocation stops future consent-based processing; earlier processing stays valid. People can separately ask for deletion of data processed with consent, subject to Article 16 (Article 18, VI).
What penalties can ANPD impose?
Article 52 lists warnings, fines of up to 2% of revenue in Brazil (capped at R$50 million per infringement), daily fines, publication of the infringement and blocking or deletion of the data.