Global privacy5 min read
LGPD and cookie consent in Brazil: what websites need to know
How Brazil's LGPD applies to cookies: legal bases, when consent is needed, what the ANPD expects from cookie banners and how it differs from EU cookie rules.
LGPD · Brazil
LGPD-ready cookie consent for your visitors in Brazil
Cookiesh shows Brazilian visitors a Portuguese banner with clear purposes and an easy way to refuse, blocks advertising cookies until they agree, and stores proof of every choice.
At a glance
- Applies to
- Processing of personal data of people in Brazil, including by foreign companies
- Consent model
- A legal basis per purpose; consent is the usual basis for advertising cookies
- Maximum fine
- 2% of revenue in Brazil, up to R$50 million per infraction
- Enforced by
- The ANPD, Brazil's national data protection authority
Requirements
What you need to get right
A legal basis for each purpose
Brazil has no separate cookie law, so each cookie purpose needs one of the LGPD's legal bases. Strictly necessary cookies can rely on legitimate interest or contract; advertising cookies usually need consent.
How Cookiesh handles it: Categories map to purposes, so you can keep necessary cookies on and require consent for analytics and marketing.
Free, informed and unequivocal consent
Consent must be a clear expression of the visitor's will, tied to specific purposes. Generic authorizations are void.
How Cookiesh handles it: The Brazil rule is opt-in, with plain-language purposes and per-category choices. Nothing non-essential runs until the visitor agrees.
Transparency in Portuguese
The ANPD's cookie guidance expects visitors to see which cookies are used, by whom and for what, in clear and accessible language.
How Cookiesh handles it: Reviewed Brazilian Portuguese banner copy and a cookie declaration with each cookie's provider, purpose and lifetime.
Easy refusal and revocation
Visitors must be able to refuse non-necessary cookies easily and revoke consent at any time, free of charge and through a simple procedure.
How Cookiesh handles it: Reject all sits on the first layer, and a footer link or floating button reopens the preference center at any time.
Proof of consent
Under the LGPD, the controller must prove that consent was obtained in line with the law.
How Cookiesh handles it: Each choice is recorded with its timestamp, region and banner version in a tamper-evident log you can export.
Setup
Compliant in three steps
Scan your site
Cookiesh lists every cookie and tracker, so you know which purposes need consent and which can rely on another legal basis.
Turn on the Brazil rule
The opt-in rule for Brazil is on by default on Pro. Review the Portuguese copy and link your privacy policy.
Install and verify
Add one script tag, then test as a visitor from Brazil with ?cookiesh_region=BR in debug mode.
In depth
What is the LGPD?
The Lei Geral de Proteção de Dados (Law 13.709/2018) is Brazil’s general data protection law. It took effect in 2020, and administrative sanctions have applied since August 2021. It is closely modeled on the GDPR: it defines personal data broadly, requires a legal basis for every processing purpose and gives people rights to access, correct and delete their data.
The law reaches foreign companies too. If you offer goods or services to people in Brazil, or process data collected there, the LGPD applies to you.
How do cookies fit in?
Cookies fall under the LGPD whenever they collect personal data or can be linked to a person, which covers most analytics and advertising cookies. Unlike the EU, Brazil has no separate law that requires consent for every non-essential cookie. Instead, you choose a legal basis for each purpose and document it.
In 2022, the ANPD published guidance on cookies. It recommends grouping cookies by purpose, blocking non-necessary cookies until the visitor agrees when you rely on consent, offering an easy way to reject them, and avoiding pre-ticked boxes and manipulative designs.
How is it different from the EU rules?
The main difference is flexibility on the legal basis: legitimate interest can cover some low-risk cookies that would need consent in the EU. In practice, the safest choice is to show Brazilian visitors the same opt-in model you use in Europe, in Portuguese. That meets the ANPD’s expectations and keeps one consistent setup.
This page is general information, not legal advice. Laws and regulator guidance change, so review your setup with your legal team.
FAQ
Common questions
Is a cookie banner mandatory in Brazil?
The LGPD does not mention cookie banners. In practice, if you rely on consent for analytics or advertising cookies, a banner is the most practical way to collect and record it, and the ANPD's guidance assumes one.
Can I use the same banner for Brazil and the EU?
An EU-grade opt-in banner usually meets or exceeds LGPD expectations, so many companies reuse it. Show it in Portuguese to Brazilian visitors and make sure your cookie policy reflects the legal bases you rely on in Brazil.
Does the LGPD apply to companies outside Brazil?
Yes. It applies when you process data collected in Brazil, or offer goods or services to people located there, wherever your company is based.
Do I need a data protection officer for the LGPD?
Controllers are generally expected to name a person in charge of data processing, the encarregado, and publish their contact details. The ANPD has relaxed this for some small processing agents, so check the current rules.
Related guides
GDPR5 min read
Can you rely on legitimate interest for cookies?
Legitimate interest cannot replace consent for non-essential cookies in the EU. Learn why, where it still applies, and what TCF 2.2 changed for publishers.
Guides5 min read
How to write a cookie policy: structure and examples
A practical guide to writing a cookie policy: what the law expects, a section-by-section outline, an example cookie table, and tips for keeping it current.
Ship compliant cookie banners in minutes, not sprints
Start free on one domain. Upgrade when you need more domains, geo-targeting or custom branding.
No credit card required · Cancel anytime