LGPD: Clear cookie choices and responsible data use for customers in Brazil

The key takeaway: a cookie category is not a legal basis. Assess what each tool does, explain the purpose and make any consent-based choice effective.

Does LGPD apply to your website?

The law can apply where processing takes place in Brazil, where activities aim to offer goods or services to people located in Brazil, or where relevant personal data was collected there. An overseas business can therefore be covered.

There is no general US-style revenue or visitor threshold that exempts all smaller websites. Specific exemptions and differentiated rules need separate assessment.

The LGPD statutory text sets out territorial scope and the legal bases. Start with your audience, collection points and processing activities rather than only where your company is registered.

How cookies fit into the law

Cookies can support login, remember preferences, measure activity or build advertising profiles. When the information relates to an identified or identifiable person, LGPD may apply.

A name is not required for data to be personal. Review identifiers and information that can be linked with other records. Do not assume that “pseudonymous” or “first-party” means outside the law.

Brazil’s regulator, ANPD, publishes a guide to cookies and personal data. It explains how to approach legal bases, transparency and cookie choices. Distinguish the law’s binding requirements from the guide’s practical recommendations.

Five things to get right

1. Assess the purpose and legal basis

List each tool, what it collects and why. LGPD includes several legal bases; consent is one, and legitimate interests may be relevant in appropriate circumstances.

Do not use legitimate interests as a default label for every analytics or advertising activity. Necessity, reasonable expectations, potential impact and safeguards matter, and sensitive data has separate rules.

For optional advertising and behavioural tracking, a clear consent-based setup is a practical starting point. Keep the rationale specific to the actual use rather than claiming all cookies must follow one universal rule.

2. Make consent specific and usable

Where relying on consent, explain the purpose clearly and obtain an appropriate positive choice. Avoid a broad authorisation for undefined future uses.

Keep consent-dependent categories off until permission is given. Offer meaningful choices, including a clear rejection route and access to settings. Do not make people work harder to refuse than to understand the offer.

ANPD’s recommendations on cookie collection illustrate the importance of identifying purposes and legal bases and improving rejection controls. Use the current cookie guide when applying those principles to your own site.

3. Explain the data journey in the visitor’s language

Describe the purposes, relevant technologies, recipients and how people can exercise their rights. For an audience in Brazil, provide an experience that people can readily understand, including appropriate Portuguese information.

Keep the first layer concise, with useful detail one step away. A long list of technical cookie names does not explain why the information is collected.

Check that retention periods and supplier descriptions match the live configuration. Avoid copying a generic cookie policy that refers to tools your site does not use.

4. Make withdrawal and rights work

Consent can be revoked through a facilitated, free procedure. Make settings easy to reopen and ensure a changed choice reaches the relevant tools.

LGPD also provides rights such as confirmation, access, correction and applicable deletion, anonymisation or blocking, depending on the information and circumstances. Do not reduce the entire rights process to a cookie toggle.

Prepare a route for requests and identify the systems involved. If a visitor withdraws advertising consent, check future audience exports as well as browser activity.

5. Review suppliers, retention and international data flows

Using a third-party platform does not remove your own responsibilities. Identify the parties’ roles, permitted uses and safeguards.

If information goes abroad, assess the applicable transfer requirements. Consent to a cookie is not automatically a solution for every international transfer or unrelated recipient use.

Review retention against the purpose and remove information that no longer has a justified use, subject to applicable obligations. Keep this review linked to tool changes so old integrations do not remain active unnoticed.

A practical ecommerce example

A store serving Brazil uses one tool for checkout and another for remarketing. A customer rejects optional advertising.

The checkout should remain usable where its processing has an appropriate legal basis. The advertising tool should not continue building a profile through a different script or a later audience upload that relies on the refused consent.

For reporting, record the distinction between completed orders and consent-dependent tracking. Fewer observed advertising events can reflect a working choice rather than a drop in sales.

Keep the setup manageable

Start with a current inventory and remove unused tools. Fewer recipients and clearer purposes make the banner easier to explain and the underlying system easier to test.

Before launching a new campaign tool, check what information it receives, whether the existing notice covers the purpose and whether a new choice is needed. Reusing an old consent record is not a substitute for assessing a new use.

For services involving children or adolescents, review the additional applicable protections separately before enabling profiling or advertising features.

Website checklist

Check scope: consider collection in Brazil and activities aimed at people there.
Check purposes: document the legal basis for each actual use.
Test initial loading: keep consent-dependent activity off before permission.
Test rejection: inspect storage, requests and relevant downstream uses.
Test withdrawal: update tools and stop future consent-based activity.
Check information: make explanations accessible and appropriate for your audience.
Check suppliers: review roles, retention and international transfers.
Review changes: reassess new tools, purposes and uses involving younger audiences.

FAQ

Is LGPD the same as GDPR?

No. They share some concepts, but their wording, legal bases, rights and regulatory context differ. Do not relabel an EU policy and assume it is complete.

Does LGPD apply only to Brazilian companies?

No. Overseas businesses can be covered by the territorial tests, including relevant activities directed at people in Brazil.

Are all cookies subject to LGPD?

The key question is whether personal data is processed and whether the law applies. Assess the information and context, not just the technology’s name.

Must every cookie rely on consent?

No. LGPD provides several legal bases. The appropriate basis depends on the purpose and circumstances, with separate treatment for sensitive data.

Can we treat continued browsing as blanket consent?

Do not rely on that as a broad permission for optional tracking. A clear, specific affirmative choice is a more appropriate consent design.

Is a “Reject” option useful?

Yes. A clear rejection route is part of the practical consent approach in ANPD’s cookie guidance and helps make the choice meaningful.

Does first-party tracking avoid the law?

No. Data collected directly by your business can still be personal data subject to LGPD.

Can customers withdraw consent later?

Yes. Provide an accessible, free route and ensure future consent-based activity responds to the change.

Does a cookie banner cover international transfers?

No. Transfers require their own assessment under the applicable rules and mechanisms.

What should we do when adding a new marketing tool?

Review its data, purpose, recipients, legal basis and controls before launch. Update the information and obtain a fresh choice where the change requires it.