In short: The LGPD requires every website that places cookies collecting personal data to rely on a legal basis, which in practice means opt-in consent for advertising and other non-necessary cookies, with a clear option to reject them. It applies to any organisation, Brazilian or foreign, that offers goods or services to people in Brazil or processes data collected there. The ANPD can impose fines of up to 2% of revenue in Brazil (capped at R$ 50 million per infraction), publish the infraction and order data to be blocked or deleted.
LGPD: what is it?
The Lei Geral de Proteção de Dados Pessoais (LGPD) is Brazil's general data protection law, Law No. 13,709 of 14 August 2018. It governs any processing of personal data, online or offline, by individuals or by public and private organisations, with the stated aim of protecting freedom, privacy and the free development of personality.
The law came into force in stages. Under article 65, the provisions creating the national authority applied from 28 December 2018, the sanction articles (52 to 54) from 1 August 2021, and the rest of the law 24 months after its publication, in 2020. Since 2021, the regulator can therefore fine companies that break it.
The LGPD is often described as Brazil's GDPR, and the resemblance is real: similar definitions, a closed list of legal bases, data subject rights and a data protection officer (the "encarregado"). But there is one big difference for cookies. Brazil has no equivalent of the European ePrivacy Directive, so there is no rule saying "consent for every non-essential cookie". Instead, cookies fall under the general LGPD rules whenever they collect personal data, and the national authority has explained how those rules apply in a dedicated guide on cookies published in October 2022.
Territorial scope. Article 3 applies the law to any processing, whatever the country where the organisation is based or where the data is stored, as long as one of three conditions is met: the processing takes place in Brazil, it aims to offer or supply goods or services to individuals located in Brazil (or processes their data), or the data was collected in Brazil. Data is considered collected in Brazil when the person was in the country at the time of collection.
Who does the LGPD apply to?
The LGPD applies to controllers (the people or organisations that decide on the processing) and processors (those who process data on a controller's behalf). For a website, the controller is usually the company that runs the site, while analytics, advertising and hosting providers act as processors or as separate controllers depending on how they use the data.
In practice, you are concerned if:
- your company is established in Brazil and runs a website or app;
- you are based abroad but sell to customers in Brazil, run a site in Brazilian Portuguese, ship to Brazil or target Brazilian users with advertising;
- your site collects data (including cookie identifiers and IP addresses) from visitors who are in Brazil when they browse.
Article 4 excludes some processing, for example by an individual for purely private, non-economic purposes, or for exclusively journalistic, artistic, public security or national defence purposes. A commercial website does not fit these exceptions.
The key notion is personal data: under article 5, any information relating to an identified or identifiable natural person. Cookie identifiers, device IDs and browsing histories linked to a user generally fall into that category, which is why cookie banners matter under the LGPD.
What the LGPD requires for cookies and consent
A legal basis for every cookie that touches personal data
Article 7 lists ten legal bases for processing personal data, including consent, compliance with a legal obligation, performance of a contract and the legitimate interests of the controller or a third party. The LGPD does not rank them, and the ANPD guide confirms there is no hierarchy between them. What matters is choosing the right one for each purpose:
- Strictly necessary cookies (login, shopping cart, security, load balancing): the ANPD considers consent inappropriate here, because users have no real choice. Legitimate interest (article 10) is generally the appropriate basis.
- Audience measurement cookies: legitimate interest can be acceptable in certain contexts, when measurement is limited to identifying patterns and trends from aggregated data, without combining it with other tracking or building user profiles.
- Advertising cookies, especially third-party ones used for profiling or tracking users across sites: the ANPD says legitimate interest will hardly ever be appropriate, and that consent is the more suitable basis.
This is why the LGPD is best described as a mixed model: opt-in consent for non-necessary cookies, but no blanket consent requirement for every cookie.
What valid consent looks like
Article 5 defines consent as a free, informed and unambiguous expression of will by which the data subject agrees to processing for a specific purpose. The ANPD guide translates this into concrete rules:
- Free: visitors must be able to accept or refuse cookies without negative consequences. "Forced" consent, where using the site depends on accepting every cookie without real options, is not compatible with the LGPD.
- Informed: before deciding, users must receive clear, precise and easily accessible information on the purposes, the form of processing and the retention period, in line with article 9. Under article 9, consent is void if the information was misleading or abusive, or not presented transparently beforehand.
- Unambiguous: consent needs a clear, positive action. Pre-ticked options and "consent by continuing to browse" are not recommended because they are incompatible with the law.
- Specific: article 8 says consent must refer to defined purposes, and generic authorisations are void.
Retention, withdrawal and proof
Retention. The LGPD has no fixed cookie lifetime. The ANPD says retention must be compatible with the purpose and limited to what is strictly necessary, so indefinite or excessive lifetimes are not compatible with the law.
Withdrawal. Under article 8(5), consent can be withdrawn at any time, by an express request, through a free and easy procedure. The ANPD adds that withdrawing should be as simple as giving consent. Article 18 also gives users rights of access, correction, deletion, information about the possibility of refusing consent and its consequences, and withdrawal.
Proof. Article 8(2) places the burden of proof on the controller: you must be able to show that consent was obtained in line with the law. The ANPD recommends recording and documenting every element needed to show that consent was valid. A consent log with timestamp, banner version and choices made is the simplest way to do it.
An LGPD-compliant cookie banner
The ANPD guide contains practical recommendations for cookie banners, presented as good practice. They are close to what European regulators expect, so a well-built GDPR banner is a solid starting point. Our guide to compliant cookie banners covers the design details.
On the first layer, the banner should:
- show an easy-to-see button to reject all non-necessary cookies, alongside the accept button and an option to manage choices;
- give an easily accessible link where users can exercise their rights, learn how their data is used and for how long, object to processing or withdraw consent.
On the second layer, the banner should:
- group cookies into categories and describe each category's purpose in simple, clear terms;
- allow consent for each specific purpose, by category;
- keep consent-based cookies disabled by default;
- explain how to block cookies through browser settings, and say so when a tracker cannot be disabled that way.
Practices to avoid, according to the ANPD:
- a single button on the first layer ("I agree", "I accept", "Got it") with no way to manage choices when you rely on consent;
- making the reject or settings buttons hard to see or understand, or highlighting only the accept button;
- making it impossible or difficult to reject all non-necessary cookies;
- non-necessary cookies switched on by default, forcing users to turn them off;
- no second layer, or no direct and simple way to withdraw consent and object (beyond browser settings);
- a cookie policy available only in a foreign language, which matters for sites aimed at Brazil;
- an overly granular list of cookies that drowns users in information and causes fatigue;
- making consent conditional on accepting all cookie terms without real options.
Several of these patterns are the same dark patterns European authorities have sanctioned, as explained in our article on dark patterns in consent banners.
Penalties and enforcement
The LGPD is enforced by the ANPD, now called Agência Nacional de Proteção de Dados (national data protection agency) under article 55-A, as amended in 2026. It receives complaints, runs monitoring and inspection procedures, and opens sanctioning proceedings.
Article 52 lists the administrative sanctions:
- a warning, with a deadline for corrective measures;
- a simple fine of up to 2% of the revenue of the private legal entity, group or conglomerate in Brazil in its last financial year, excluding taxes, capped at R$ 50 million per infraction;
- a daily fine, within the same overall cap;
- publication of the infraction once confirmed;
- blocking or deletion of the personal data concerned;
- partial suspension of the database, or suspension of the processing activity, for up to six months, extendable once;
- partial or total prohibition of processing activities.
Sanctions are applied after an administrative procedure, taking into account criteria such as the seriousness of the infringement, good faith, the advantage gained, recidivism, cooperation and the prompt adoption of corrective measures. The ANPD states on its enforcement page that, so far, every sanctioning proceeding it has opened stemmed from a non-cooperative attitude of the organisation concerned.
Real cases published by the ANPD:
- Telekall Infoservice (2023), the first LGPD fine. After a complaint that the company was offering lists of voters' WhatsApp contacts for election campaign messages, the ANPD issued a warning for failing to appoint a data protection officer and two simple fines of R$ 7,200 each: one for processing personal data without a legal basis (article 7) and one for failing to respond to the authority's requests. As a microenterprise, each fine was limited to 2% of its gross revenue, for a total of R$ 14,400. (ANPD press release)
- INSS, the national social security institute (2024). In a first-instance decision published on 1 February 2024, the ANPD sanctioned the INSS with publication of the infraction for failing to notify individuals of a 2022 security incident (article 48). The INSS had to display a notice on its homepage and send a notification to all users of its app for 60 days. The INSS appealed, and the coordinating division upheld its decision and referred the case to the ANPD's Board. (ANPD case file)
- RaiaDrogasil (ongoing). The ANPD lists an open sanctioning proceeding against the pharmacy chain to investigate alleged behavioural profiling based on sensitive personal data, without a proper legal basis, to offer targeted advertising in exchange for payment. No decision has been published yet. (ANPD enforcement page)
The last case shows where ad tracking and the LGPD meet: monetising data for targeted advertising without a valid legal basis is exactly what a consent banner is meant to prevent.
Compliance checklist
- Map your cookies and trackers, including third-party tags, and note their purpose, provider and lifetime.
- Assign a legal basis to each purpose: legitimate interest for strictly necessary cookies, consent for advertising and other non-necessary cookies, and a documented balancing test if you rely on legitimate interest for analytics.
- Block non-necessary scripts until consent is given, and keep them off by default.
- Show a first-layer banner with accept, reject non-necessary cookies and manage options of comparable visibility.
- Offer a second layer with cookie categories, plain-language purposes, retention periods and a choice per category.
- Publish a cookie policy in Portuguese if you target Brazil, linked from the banner, explaining how users can exercise their rights.
- Make withdrawal as easy as consent, with a permanent link or button to reopen the preferences.
- Keep proof of consent (date, choices, banner version) so you can meet the burden of proof in article 8.
- Shorten excessive cookie lifetimes and review them at least once a year.
- Appoint a data protection officer (encarregado) and publish their contact details, as article 41 requires of controllers.
How FlowConsent helps you comply with the LGPD
FlowConsent gives you a banner that follows the ANPD's recommendations out of the box: accept, reject and settings buttons on the first layer, cookie categories on the second, and non-necessary cookies off by default. Scripts are blocked before consent, so advertising tags only fire once a visitor opts in, and Google Consent Mode v2 is built in. The automatic scan detects the cookies on your site so you can assign each one a category and a legal basis, as explained in our documentation on services and legal basis. Every choice is logged as exportable proof of consent. Setup takes about ten minutes, the service is hosted in Europe, and it is free up to 25,000 sessions per month. Start with our free scanner, then create your account.
Further reading
If your site serves several markets, our overview of cookie rules outside Europe compares the LGPD with South Africa's POPIA, Singapore's PDPA and India's DPDPA. The articles below go deeper into banner design, cookie categories, proof of consent and measuring your audience without cookies, all useful for building an LGPD-ready setup.