> LGPD and cookies explained: legal bases, consent, ANPD cookie guide, banner rules, fines up to R$ 50 million and a checklist for sites with Brazilian users. > > Canonical: https://www.flowconsent.com/en/laws/lgpd-brazil Cookie law # LGPD and cookies: what Brazil's data protection law requires from your website LGPD and cookies explained: legal bases, consent, ANPD cookie guide, banner rules, fines up to R$ 50 million and a checklist for sites with Brazilian users. Updated October 9, 2026 · 10 min read [Scan my site for free](https://www.flowconsent.com/en/scan) · [Try FlowConsent for free](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=laws) ## Fact sheet - Full name Lei Geral de Proteção de Dados Pessoais (Law No. 13,709 of 14 August 2018) - Jurisdiction Brazil (also applies to foreign companies targeting people in Brazil) - In force since 2020 (sanctions applicable since 1 August 2021) - Authority ANPD (Agência Nacional de Proteção de Dados) - Maximum fine 2% of revenue in Brazil, capped at R$ 50 million per infraction - Consent model Mixed ## Key points - The LGPD applies to any processing of personal data of people located in Brazil, wherever your company is based. - Cookies that collect personal data need one of the legal bases in article 7, usually consent for advertising and other non-necessary cookies. - The ANPD cookie guide accepts legitimate interest for strictly necessary cookies and, in limited contexts, for aggregated audience measurement. - Consent must be free, informed and unambiguous: no pre-ticked boxes, no consent by continued browsing, and a visible button to reject non-necessary cookies. - The controller bears the burden of proving that consent was valid, and consent can be withdrawn at any time for free. - Fines reach 2% of revenue in Brazil, capped at R$ 50 million per infraction, alongside publication of the infraction and blocking or deletion of data. Contents > **In short:** The LGPD requires every website that places cookies collecting personal data to rely on a legal basis, which in practice means opt-in consent for advertising and other non-necessary cookies, with a clear option to reject them. It applies to any organisation, Brazilian or foreign, that offers goods or services to people in Brazil or processes data collected there. The ANPD can impose fines of up to 2% of revenue in Brazil (capped at R$ 50 million per infraction), publish the infraction and order data to be blocked or deleted. ## LGPD: what is it? The Lei Geral de Proteção de Dados Pessoais (LGPD) is Brazil's general data protection law, Law No. 13,709 of 14 August 2018. It governs any processing of personal data, online or offline, by individuals or by public and private organisations, with the stated aim of protecting freedom, privacy and the free development of personality. The law came into force in stages. Under article 65, the provisions creating the national authority applied from 28 December 2018, the sanction articles (52 to 54) from 1 August 2021, and the rest of the law 24 months after its publication, in 2020. Since 2021, the regulator can therefore fine companies that break it. The LGPD is often described as Brazil's GDPR, and the resemblance is real: similar definitions, a closed list of legal bases, data subject rights and a data protection officer (the "encarregado"). But there is one big difference for cookies. Brazil has no equivalent of the European ePrivacy Directive, so there is no rule saying "consent for every non-essential cookie". Instead, cookies fall under the general LGPD rules whenever they collect personal data, and the national authority has explained how those rules apply in a dedicated guide on cookies published in October 2022. **Territorial scope.** Article 3 applies the law to any processing, whatever the country where the organisation is based or where the data is stored, as long as one of three conditions is met: the processing takes place in Brazil, it aims to offer or supply goods or services to individuals located in Brazil (or processes their data), or the data was collected in Brazil. Data is considered collected in Brazil when the person was in the country at the time of collection. ## Who does the LGPD apply to? The LGPD applies to **controllers** (the people or organisations that decide on the processing) and **processors** (those who process data on a controller's behalf). For a website, the controller is usually the company that runs the site, while analytics, advertising and hosting providers act as processors or as separate controllers depending on how they use the data. In practice, you are concerned if: - your company is established in Brazil and runs a website or app; - you are based abroad but sell to customers in Brazil, run a site in Brazilian Portuguese, ship to Brazil or target Brazilian users with advertising; - your site collects data (including cookie identifiers and IP addresses) from visitors who are in Brazil when they browse. Article 4 excludes some processing, for example by an individual for purely private, non-economic purposes, or for exclusively journalistic, artistic, public security or national defence purposes. A commercial website does not fit these exceptions. The key notion is **personal data**: under article 5, any information relating to an identified or identifiable natural person. Cookie identifiers, device IDs and browsing histories linked to a user generally fall into that category, which is why cookie banners matter under the LGPD. ## What the LGPD requires for cookies and consent ### A legal basis for every cookie that touches personal data Article 7 lists ten legal bases for processing personal data, including consent, compliance with a legal obligation, performance of a contract and the legitimate interests of the controller or a third party. The LGPD does not rank them, and the ANPD guide confirms there is no hierarchy between them. What matters is choosing the right one for each purpose: - **Strictly necessary cookies** (login, shopping cart, security, load balancing): the ANPD considers consent inappropriate here, because users have no real choice. Legitimate interest (article 10) is generally the appropriate basis. - **Audience measurement cookies**: legitimate interest can be acceptable in certain contexts, when measurement is limited to identifying patterns and trends from aggregated data, without combining it with other tracking or building user profiles. - **Advertising cookies**, especially third-party ones used for profiling or tracking users across sites: the ANPD says legitimate interest will hardly ever be appropriate, and that consent is the more suitable basis. This is why the LGPD is best described as a **mixed model**: opt-in consent for non-necessary cookies, but no blanket consent requirement for every cookie. ### What valid consent looks like Article 5 defines consent as a free, informed and unambiguous expression of will by which the data subject agrees to processing for a specific purpose. The ANPD guide translates this into concrete rules: - **Free:** visitors must be able to accept or refuse cookies without negative consequences. "Forced" consent, where using the site depends on accepting every cookie without real options, is not compatible with the LGPD. - **Informed:** before deciding, users must receive clear, precise and easily accessible information on the purposes, the form of processing and the retention period, in line with article 9. Under article 9, consent is void if the information was misleading or abusive, or not presented transparently beforehand. - **Unambiguous:** consent needs a clear, positive action. Pre-ticked options and "consent by continuing to browse" are not recommended because they are incompatible with the law. - **Specific:** article 8 says consent must refer to defined purposes, and generic authorisations are void. ### Retention, withdrawal and proof **Retention.** The LGPD has no fixed cookie lifetime. The ANPD says retention must be compatible with the purpose and limited to what is strictly necessary, so indefinite or excessive lifetimes are not compatible with the law. **Withdrawal.** Under article 8(5), consent can be withdrawn at any time, by an express request, through a free and easy procedure. The ANPD adds that withdrawing should be as simple as giving consent. Article 18 also gives users rights of access, correction, deletion, information about the possibility of refusing consent and its consequences, and withdrawal. **Proof.** Article 8(2) places the burden of proof on the controller: you must be able to show that consent was obtained in line with the law. The ANPD recommends recording and documenting every element needed to show that consent was valid. A consent log with timestamp, banner version and choices made is the simplest way to do it. ## An LGPD-compliant cookie banner The ANPD guide contains practical recommendations for cookie banners, presented as good practice. They are close to what European regulators expect, so a well-built GDPR banner is a solid starting point. Our [guide to compliant cookie banners](https://www.flowconsent.com/en/blog/cookie-banner-gdpr-compliance-guide) covers the design details. **On the first layer**, the banner should: - show an easy-to-see button to **reject all non-necessary cookies**, alongside the accept button and an option to manage choices; - give an easily accessible link where users can exercise their rights, learn how their data is used and for how long, object to processing or withdraw consent. **On the second layer**, the banner should: - group cookies into categories and describe each category's purpose in simple, clear terms; - allow consent for each specific purpose, by category; - keep consent-based cookies **disabled by default**; - explain how to block cookies through browser settings, and say so when a tracker cannot be disabled that way. **Practices to avoid**, according to the ANPD: - a single button on the first layer ("I agree", "I accept", "Got it") with no way to manage choices when you rely on consent; - making the reject or settings buttons hard to see or understand, or highlighting only the accept button; - making it impossible or difficult to reject all non-necessary cookies; - non-necessary cookies switched on by default, forcing users to turn them off; - no second layer, or no direct and simple way to withdraw consent and object (beyond browser settings); - a cookie policy available only in a foreign language, which matters for sites aimed at Brazil; - an overly granular list of cookies that drowns users in information and causes fatigue; - making consent conditional on accepting all cookie terms without real options. Several of these patterns are the same dark patterns European authorities have sanctioned, as explained in our article on [dark patterns in consent banners](https://www.flowconsent.com/en/blog/cookie-dark-patterns-cnil-prohibited). ## Penalties and enforcement The LGPD is enforced by the **ANPD**, now called Agência Nacional de Proteção de Dados (national data protection agency) under article 55-A, as amended in 2026. It receives complaints, runs monitoring and inspection procedures, and opens sanctioning proceedings. Article 52 lists the administrative sanctions: - a warning, with a deadline for corrective measures; - a simple fine of up to 2% of the revenue of the private legal entity, group or conglomerate in Brazil in its last financial year, excluding taxes, **capped at R$ 50 million per infraction**; - a daily fine, within the same overall cap; - publication of the infraction once confirmed; - blocking or deletion of the personal data concerned; - partial suspension of the database, or suspension of the processing activity, for up to six months, extendable once; - partial or total prohibition of processing activities. Sanctions are applied after an administrative procedure, taking into account criteria such as the seriousness of the infringement, good faith, the advantage gained, recidivism, cooperation and the prompt adoption of corrective measures. The ANPD states on its enforcement page that, so far, every sanctioning proceeding it has opened stemmed from a non-cooperative attitude of the organisation concerned. Real cases published by the ANPD: - **Telekall Infoservice (2023), the first LGPD fine.** After a complaint that the company was offering lists of voters' WhatsApp contacts for election campaign messages, the ANPD issued a warning for failing to appoint a data protection officer and two simple fines of R$ 7,200 each: one for processing personal data without a legal basis (article 7) and one for failing to respond to the authority's requests. As a microenterprise, each fine was limited to 2% of its gross revenue, for a total of R$ 14,400. ([ANPD press release](https://www.gov.br/anpd/pt-br/assuntos/noticias/anpd-aplica-a-primeira-multa-por-descumprimento-a-lgpd/comunicado-a-imprensa-jul-2023.pdf/@@display-file/file)) - **INSS, the national social security institute (2024).** In a first-instance decision published on 1 February 2024, the ANPD sanctioned the INSS with publication of the infraction for failing to notify individuals of a 2022 security incident (article 48). The INSS had to display a notice on its homepage and send a notification to all users of its app for 60 days. The INSS appealed, and the coordinating division upheld its decision and referred the case to the ANPD's Board. ([ANPD case file](https://www.gov.br/anpd/pt-br/assuntos/fiscalizacao/saiba-como_fiscalizamos/arquivos/pas_inss_principal_publica-processo-00261001888_2023-21-principal.pdf/@@display-file/file)) - **RaiaDrogasil (ongoing).** The ANPD lists an open sanctioning proceeding against the pharmacy chain to investigate alleged behavioural profiling based on sensitive personal data, without a proper legal basis, to offer targeted advertising in exchange for payment. No decision has been published yet. ([ANPD enforcement page](https://www.gov.br/anpd/pt-br/assuntos/fiscalizacao-2/saiba-como_fiscalizamos/atividades-fiscalizatorias/)) The last case shows where ad tracking and the LGPD meet: monetising data for targeted advertising without a valid legal basis is exactly what a consent banner is meant to prevent. ## Compliance checklist 1. **Map your cookies and trackers**, including third-party tags, and note their purpose, provider and lifetime. 2. **Assign a legal basis to each purpose**: legitimate interest for strictly necessary cookies, consent for advertising and other non-necessary cookies, and a documented balancing test if you rely on legitimate interest for analytics. 3. **Block non-necessary scripts until consent** is given, and keep them off by default. 4. **Show a first-layer banner** with accept, reject non-necessary cookies and manage options of comparable visibility. 5. **Offer a second layer** with cookie categories, plain-language purposes, retention periods and a choice per category. 6. **Publish a cookie policy in Portuguese** if you target Brazil, linked from the banner, explaining how users can exercise their rights. 7. **Make withdrawal as easy as consent**, with a permanent link or button to reopen the preferences. 8. **Keep proof of consent** (date, choices, banner version) so you can meet the burden of proof in article 8. 9. **Shorten excessive cookie lifetimes** and review them at least once a year. 10. **Appoint a data protection officer (encarregado)** and publish their contact details, as article 41 requires of controllers. ## How FlowConsent helps you comply with the LGPD FlowConsent gives you a banner that follows the ANPD's recommendations out of the box: accept, reject and settings buttons on the first layer, cookie categories on the second, and non-necessary cookies off by default. Scripts are blocked before consent, so advertising tags only fire once a visitor opts in, and Google Consent Mode v2 is built in. The automatic scan detects the cookies on your site so you can assign each one a category and a legal basis, as explained in our documentation on [services and legal basis](https://www.flowconsent.com/en/doc/services-and-legal-basis). Every choice is logged as exportable proof of consent. Setup takes about ten minutes, the service is hosted in Europe, and it is free up to 25,000 sessions per month. Start with our [free scanner](https://www.flowconsent.com/en/scan), then [create your account](https://app.flowconsent.com/auth/register). ## Further reading If your site serves several markets, our overview of [cookie rules outside Europe](https://www.flowconsent.com/en/blog/lgpd-popia-pdpa-dpdpa-cookies-outside-europe) compares the LGPD with South Africa's POPIA, Singapore's PDPA and India's DPDPA. The articles below go deeper into banner design, cookie categories, proof of consent and measuring your audience without cookies, all useful for building an LGPD-ready setup. Further reading ## Go further on LGPD. Practical guides from our blog to put these rules into practice on your site. [Blog](https://www.flowconsent.com/en/blog/lgpd-popia-pdpa-dpdpa-cookies-outside-europe) ### [LGPD, POPIA, PDPA, DPDPA: Managing Cookies Outside Europe](https://www.flowconsent.com/en/blog/lgpd-popia-pdpa-dpdpa-cookies-outside-europe) [Read the article ](https://www.flowconsent.com/en/blog/lgpd-popia-pdpa-dpdpa-cookies-outside-europe)· [Blog](https://www.flowconsent.com/en/blog/cookie-banner-gdpr-compliance-guide) ### [GDPR-compliant cookie banner: the complete guide](https://www.flowconsent.com/en/blog/cookie-banner-gdpr-compliance-guide) [Read the article ](https://www.flowconsent.com/en/blog/cookie-banner-gdpr-compliance-guide)· [Blog](https://www.flowconsent.com/en/blog/cookie-dark-patterns-cnil-prohibited) ### [Cookie dark patterns: what the CNIL prohibits in consent banners](https://www.flowconsent.com/en/blog/cookie-dark-patterns-cnil-prohibited) [Read the article ](https://www.flowconsent.com/en/blog/cookie-dark-patterns-cnil-prohibited)· [Blog](https://www.flowconsent.com/en/blog/proof-of-cookie-consent-what-to-store) ### [Proof of cookie consent: what to store and for how long](https://www.flowconsent.com/en/blog/proof-of-cookie-consent-what-to-store) [Read the article ](https://www.flowconsent.com/en/blog/proof-of-cookie-consent-what-to-store)· [Blog](https://www.flowconsent.com/en/blog/gdpr-cookie-categories-guide) ### [The 4 GDPR cookie categories: a complete guide](https://www.flowconsent.com/en/blog/gdpr-cookie-categories-guide) [Read the article ](https://www.flowconsent.com/en/blog/gdpr-cookie-categories-guide)· [Blog](https://www.flowconsent.com/en/blog/cookieless-analytics-complete-guide) ### [Cookieless analytics and tracking: a complete guide to measuring without consent](https://www.flowconsent.com/en/blog/cookieless-analytics-complete-guide) [Read the article](https://www.flowconsent.com/en/blog/cookieless-analytics-complete-guide) Questions ## LGPD and cookies: your questions Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### Does the LGPD apply to my website if my company is not in Brazil? Yes, in many cases. Article 3 applies the LGPD wherever the controller is based when the processing aims to offer goods or services to people in Brazil, or processes data of individuals located there, or when the data was collected in Brazil. Data counts as collected in Brazil if the person was there at the time. If you sell to Brazilian customers or run a Portuguese version aimed at Brazil, plan for LGPD compliance. ### Does the LGPD always require consent for cookies? No. Unlike the European ePrivacy rules, the LGPD has no cookie-specific article, so cookies that process personal data need one of the legal bases listed in article 7. The ANPD guide says consent is the most appropriate basis for non-necessary cookies such as advertising, while legitimate interest can cover strictly necessary cookies and, in some contexts, aggregated audience measurement without profiling. ### Can I use an "I understand" button with no reject option? Not if you rely on consent. The ANPD guide lists a single button on the first layer, such as "I agree" or "I accept", among the practices to avoid. It recommends an easy-to-see button to reject all non-necessary cookies on both the first and second layers, plus a way to manage preferences by category. Non-necessary cookies should be disabled by default. ### Is Google Analytics allowed under the LGPD without consent? It depends on how you configure it. The ANPD accepts that audience measurement can rely on legitimate interest in certain contexts, when it is limited to identifying patterns and trends from aggregated data, without combining it with other tracking or building user profiles. Once analytics data feeds advertising, remarketing or cross-site profiling, consent becomes the safer basis, and you must still document your balancing test. ### How long can cookies be kept under the LGPD? The LGPD does not set a fixed lifetime such as 13 months. The ANPD guide says the retention period must match the purpose and be limited to what is strictly necessary, so indefinite, excessive or disproportionate retention is not compatible with the law. Review the expiry of every cookie on your site, shorten long ones, and state retention periods in your cookie policy and second-layer banner. ### What are the fines for breaking the LGPD? Article 52 lets the ANPD issue warnings, a simple fine of up to 2% of the revenue of the company, group or conglomerate in Brazil for its last financial year, excluding taxes, capped at R$ 50 million per infraction, and daily fines within the same cap. It can also publish the infraction, block or delete the data concerned, and suspend or prohibit processing activities. ## Official sources The texts and guidance this page is based on. - [Law No. 13,709/2018 (LGPD), consolidated text on Planalto ](https://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/l13709compilado.htm)www\.planalto.gov.br - [ANPD, Guia orientativo: Cookies e proteção de dados pessoais (October 2022) ](https://www.gov.br/anpd/pt-br/centrais-de-conteudo/materiais-educativos-e-publicacoes/guia-orientativo-cookies-e-protecao-de-dados-pessoais.pdf)www\.gov.br - [ANPD, enforcement activities and sanctioning proceedings ](https://www.gov.br/anpd/pt-br/assuntos/fiscalizacao-2/saiba-como_fiscalizamos/atividades-fiscalizatorias/)www\.gov.br - [ANPD, press release on its first sanction (Telekall Infoservice) ](https://www.gov.br/anpd/pt-br/assuntos/noticias/anpd-aplica-a-primeira-multa-por-descumprimento-a-lgpd/comunicado-a-imprensa-jul-2023.pdf/@@display-file/file)www\.gov.br - [ANPD, public record of sanctioning proceeding 00261.001888/2023-21 (INSS) ](https://www.gov.br/anpd/pt-br/assuntos/fiscalizacao/saiba-como_fiscalizamos/arquivos/pas_inss_principal_publica-processo-00261001888_2023-21-principal.pdf/@@display-file/file)www\.gov.br Other laws ## Other cookie and privacy laws. [GDPR · Opt-in](https://www.flowconsent.com/en/laws/gdpr) ### [GDPR and cookies: what the law requires from your website](https://www.flowconsent.com/en/laws/gdpr) [Read the guide ](https://www.flowconsent.com/en/laws/gdpr)· [ePrivacy Directive · Opt-in](https://www.flowconsent.com/en/laws/eprivacy-directive) ### [ePrivacy Directive and cookies: the rule behind every consent banner](https://www.flowconsent.com/en/laws/eprivacy-directive) [Read the guide ](https://www.flowconsent.com/en/laws/eprivacy-directive)· [CCPA / CPRA · Opt-out](https://www.flowconsent.com/en/laws/ccpa-cpra) ### [CCPA and CPRA cookies: what California law requires from your website](https://www.flowconsent.com/en/laws/ccpa-cpra) [Read the guide ](https://www.flowconsent.com/en/laws/ccpa-cpra)· [UK GDPR / PECR · Opt-in](https://www.flowconsent.com/en/laws/uk-gdpr-pecr) ### [UK GDPR, PECR and cookies: what UK law requires from your website](https://www.flowconsent.com/en/laws/uk-gdpr-pecr) [Read the guide ](https://www.flowconsent.com/en/laws/uk-gdpr-pecr)· [TDDDG · Opt-in](https://www.flowconsent.com/en/laws/tdddg) ### [TDDDG and cookies: what Germany's section 25 requires from your website](https://www.flowconsent.com/en/laws/tdddg) [Read the guide ](https://www.flowconsent.com/en/laws/tdddg)· [nFADP · Opt-out](https://www.flowconsent.com/en/laws/nfadp-switzerland) ### [Swiss nFADP and cookies: what the revised Data Protection Act requires from your website](https://www.flowconsent.com/en/laws/nfadp-switzerland) [Read the guide ](https://www.flowconsent.com/en/laws/nfadp-switzerland)· [LOPDGDD · Opt-in](https://www.flowconsent.com/en/laws/lopdgdd-spain) ### [LOPDGDD and cookies: what Spanish law requires from your website](https://www.flowconsent.com/en/laws/lopdgdd-spain) [Read the guide](https://www.flowconsent.com/en/laws/lopdgdd-spain) [See all laws](https://www.flowconsent.com/en/laws) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)