# LGPD and cookie consent in Brazil: what websites need to know

> How Brazil's LGPD applies to cookies: legal bases, when consent is needed, what the ANPD expects from cookie banners and how it differs from EU cookie rules.

Source: https://www.cookiesh.eu/blog/lgpd-cookie-consent-brazil  
Published: 2026-05-28

## Key takeaways

- Brazil's LGPD (Law 13.709/2018) applies to cookies whenever they collect or link to personal data of people in Brazil.
- Brazil has no separate cookie law, so each cookie purpose needs one of the LGPD's legal bases, with consent the usual choice for advertising.
- Consent under the LGPD must be free, informed and unequivocal, tied to specific purposes and revocable at any time.
- The ANPD's cookie guidance expects purpose-based categories, an easy way to reject non-necessary cookies and no manipulative design.
- The LGPD reaches foreign companies that offer goods or services to people in Brazil or process data collected there.

Brazil's General Data Protection Law (LGPD) applies to cookies whenever they collect personal data, such as identifiers linked to a person or device. Brazil has no separate cookie law, so each cookie purpose needs an LGPD legal basis. For advertising and most analytics cookies that basis is usually consent, which must be free, informed, unequivocal and revocable at any time.

## What is the LGPD and who does it apply to?

The LGPD is Brazil's Law 13.709/2018, the country's general data protection law, enforced by the national data protection authority (ANPD). It closely mirrors GDPR concepts: controllers and processors, legal bases, data subject rights and accountability.

Its reach is extraterritorial. The law applies when processing takes place in Brazil, when the processing aims to offer goods or services to people in Brazil or involves data of individuals located there, or when the personal data was collected in Brazil. A European or US company with Brazilian customers or visitors is typically in scope.

## Do cookies count as personal data under the LGPD?

Many do. The LGPD defines personal data as information related to an identified or identifiable natural person, and cookie IDs, IP addresses and advertising identifiers can make a person identifiable, especially when combined with other data.

Truly anonymized data falls outside the law, but the bar for anonymization is high. Treat analytics and advertising cookies as personal data unless you can show otherwise. A thorough [cookie audit](/blog/how-to-run-a-cookie-audit) tells you which cookies collect what, which is the starting point for choosing a legal basis.

## Which legal basis applies to cookies?

There is no single answer: each cookie purpose needs one of the LGPD's legal bases, and consent is only one of them. This is the biggest structural difference from the EU, where the ePrivacy Directive requires consent for non-essential cookies regardless of which GDPR legal basis covers later processing.

In practice, most organizations land in a familiar place:

- **Strictly necessary cookies**, such as session, security and load-balancing cookies, can usually rely on legitimate interest or on performing a contract the user asked for.
- **Analytics cookies** may sometimes rely on legitimate interest after a documented balancing test, but consent is the safer choice, especially when data goes to third parties.
- **Advertising and cross-site tracking cookies** generally call for consent, given how intrusive they are and how hard they are to justify under legitimate interest.

Legitimate interest under the LGPD is not a free pass. Processing must respect the person's legitimate expectations and fundamental rights, use only the data strictly necessary for the purpose, and the ANPD can request a data protection impact report when you rely on it. Our article on [legitimate interest and cookies](/blog/legitimate-interest-and-cookies) explains how European regulators approach the same question.

## What makes consent valid under the LGPD?

Consent must be a free, informed and unequivocal expression of will for a specific purpose. Generic authorizations are void, and the controller carries the burden of proving that consent was obtained properly.

For cookie banners, that translates into a practical checklist:

1. Explain each cookie purpose in clear language, in Portuguese for Brazilian audiences, before asking for consent.
2. Do not load non-necessary cookies until the person makes a choice.
3. Avoid pre-ticked boxes and do not treat silence or continued browsing as agreement.
4. Offer a reject option that is as easy to find and use as accept.
5. Let people change or withdraw consent later through a free and easy process, such as a persistent settings link.
6. Record when, how and for which purposes consent was given.

## What does the ANPD expect from cookie banners?

The ANPD has published guidance on cookies and personal data that reads much like European regulators' advice. Its main themes are transparency, granular choice and no manipulation.

The guidance favors categorizing cookies by purpose, a first layer with clear options that include rejecting non-necessary cookies, a second layer or cookie policy with more detail, and designs that do not nudge people toward accepting. It is guidance rather than statute, but it signals how the regulator reads the LGPD's principles in an investigation. See [how to design a cookie banner that is compliant and user-friendly](/blog/cookie-banner-design-best-practices) for patterns that satisfy both Brazilian and European expectations.

The enforcement toolkit is substantial. Sanctions under the LGPD include warnings, publicizing the violation, blocking or deleting the data concerned, and fines of up to 2% of a company's revenue in Brazil, capped at R$50 million per infraction.

## How does the LGPD compare with EU cookie rules?

The two regimes often produce similar banners but rest on different legal foundations. This table summarizes the differences that matter most for cookies.

| | EU (GDPR and ePrivacy) | Brazil (LGPD) |
| --- | --- | --- |
| Cookie-specific rule | Yes, ePrivacy Directive Art. 5(3) | No, general data protection law only |
| Legal basis for non-essential cookies | Consent | Any valid basis; consent is typical for advertising |
| Consent standard | Freely given, specific, informed, unambiguous | Free, informed, unequivocal, for specific purposes |
| Covers non-personal device storage | Yes | Only when personal data is involved |
| Regulator | National authorities, coordinated by the EDPB | ANPD |
| Maximum fine | €20M or 4% of worldwide annual turnover | 2% of revenue in Brazil, capped at R$50M per infraction |

If you already run a setup that meets [GDPR cookie consent requirements](/blog/gdpr-cookie-consent-requirements), adapting it for Brazil is mostly about language, documenting your legal basis per purpose and keeping good records.

## Bottom line

Treat the LGPD as a close cousin of GDPR. It lacks a cookie-specific rule, but consent remains the practical default for advertising cookies and the safer option for most analytics aimed at people in Brazil. Document your legal basis for each purpose, give visitors a clear reject option and keep consent records you can produce on request. Tools like Cookiesh can show a geo-targeted LGPD banner to Brazilian visitors alongside your GDPR and CCPA experiences.

*This article is general information, not legal advice. For decisions about your specific situation, consult a qualified privacy professional.*

## FAQ

### Is a cookie banner mandatory in Brazil?

The LGPD does not mention cookie banners explicitly. In practice, if you rely on consent for analytics or advertising cookies, a banner or similar interface is the most practical way to collect and record that consent, and the ANPD's guidance assumes one.

### Can I use the same cookie banner for Brazil and the EU?

An EU-grade opt-in banner usually meets or exceeds LGPD expectations, so many companies reuse it for Brazil. Offer the text in Portuguese and make sure your cookie policy reflects any Brazil-specific legal bases you rely on.

### Who enforces the LGPD?

The Autoridade Nacional de Proteção de Dados (ANPD) is Brazil's national data protection authority. It issues regulations and guidance, handles complaints, runs investigations and can impose administrative sanctions.

### Does the LGPD require a data protection officer?

Controllers are generally expected to name a person in charge of data processing, known as the encarregado, and publish their contact details. The ANPD has issued rules that relax this for some small processing agents, so check the current requirements.

## Sources

- [Brazil Law 13.709/2018 (LGPD)](https://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/l13709.htm)
- [Regulation (EU) 2016/679 (GDPR), EUR-Lex](https://eur-lex.europa.eu/eli/reg/2016/679/oj)
- [Directive 2002/58/EC (ePrivacy Directive), EUR-Lex](https://eur-lex.europa.eu/eli/dir/2002/58/oj)