Brazil’s LGPD may apply when a website offers goods or services to people in Brazil or processes personal data of individuals located there. This guide explains how the law affects cookies, analytics, advertising, consent, and practical privacy controls.
Brazil does not impose one universal EU-style cookie banner format. However, when the LGPD applies and cookies process personal data, the website operator needs an appropriate legal basis and must clearly explain the processing.
Consent is often the safer choice for advertising, profiling, cross-site tracking, and other optional technologies. Strictly necessary cookies may not require consent, but they should still be explained.
The sections below help you identify which cookies process personal data, choose an appropriate legal basis, and decide whether your website needs a consent banner or another privacy control.
What Is the LGPD?
The LGPD is Brazil’s general data protection law. It regulates the processing of personal data in both online and offline environments. The law is supervised by Brazil’s data protection authority, the Autoridade Nacional de Proteção de Dados, usually called the ANPD.
Personal data under the LGPD is information related to an identified or identifiable person. A cookie name alone may look anonymous, but cookies can be connected with IP addresses, device identifiers, account information, browsing behavior, or advertising profiles. When this information can relate to a person, the LGPD may apply.
The LGPD is broader than a cookie law. It covers collection, storage, use, sharing, analysis, and deletion of personal data. Cookies, pixels, software development kits, local storage, and similar technologies are simply different ways in which personal data may be processed.
Does Brazil Require a Cookie Banner?
Not every Brazilian website automatically needs a cookie consent banner. The first question is not simply whether the website uses cookies. The more useful questions are:
- Does the technology process personal data?
- What is the purpose of the processing?
- Is the technology necessary to provide a service requested by the visitor?
- Which LGPD legal basis supports the processing?
- Would the visitor reasonably expect the processing?
- Can the visitor refuse or withdraw consent without being pressured?
If your website uses only essential technologies for security, login sessions, shopping carts, or other functions requested by the visitor, a consent banner may not be necessary. You should still provide clear information about these technologies in your privacy or cookie notice.
If your website uses advertising trackers, remarketing pixels, detailed profiling, or optional third-party cookies, a genuine consent mechanism is often the more appropriate approach. A banner may also help provide the transparency and user controls expected under the LGPD.
A website can require a privacy notice or cookie policy even when prior cookie consent is not required. Transparency and consent are related, but they are not the same obligation.
When Does the LGPD Apply to a Website?
The LGPD can apply even when the website owner is not based in Brazil. Its territorial scope can include personal data processing when:
- the processing takes place in Brazil;
- the processing aims to offer or provide goods or services to people located in Brazil;
- the processing concerns individuals located in Brazil; or
- the personal data was collected in Brazil.
This means a foreign online store, software company, publisher, or service provider may fall within the LGPD when it actively serves or tracks visitors in Brazil. A website does not avoid the law merely because its company or server is located elsewhere.
At the same time, a small number of accidental visits from Brazil does not automatically answer every territorial question. Website owners should consider their audience, language, currency, delivery options, campaigns, customer base, and actual processing activities.
Which LGPD Legal Bases Can Apply to Cookies?
The LGPD provides several legal bases for processing personal data. Consent is one of them, but it is not the only one. The correct basis must match the real purpose and circumstances of the processing.
Consent
Consent may be appropriate when the visitor has a real choice about optional tracking. This is especially relevant for advertising, profiling, remarketing, cross-site tracking, and other technologies that are not needed for the website to work.
Under the LGPD, consent must be free, informed, and unambiguous, and it must relate to specified purposes. A vague statement such as “By continuing to browse, you accept all cookies” is unlikely to provide the clear positive choice expected for valid consent.
Legitimate Interest
Legitimate interest may sometimes support processing that is necessary for a legitimate purpose and compatible with the visitor’s reasonable expectations. It is not a shortcut that automatically allows every analytics or marketing cookie.
The organization should assess necessity, benefits, possible harm, reasonable expectations, safeguards, and the rights of the individual. The ANPD’s cookie guidance indicates that legitimate interest can be difficult to justify for intrusive advertising, third-party profiling, preference prediction, and tracking across websites.
Other Legal Bases
Other LGPD legal bases may apply in specific situations. For example, certain processing may be necessary to perform a contract, comply with a legal obligation, or protect against fraud. However, a business should not label every operational or commercial preference as “necessary.”
The chosen legal basis should be documented and used consistently in the website’s notices, internal records, vendor agreements, and consent settings.
| Cookie purpose | Common LGPD consideration | Likely website action |
|---|---|---|
| Security and fraud prevention | May be necessary for a legitimate and expected website function | Explain clearly; consent may not be required |
| Login session or shopping cart | Often necessary to provide a service requested by the visitor | Keep limited to the necessary purpose and disclose it |
| Basic audience measurement | Depends on configuration, data, necessity, expectations, and safeguards | Assess the legal basis; use consent when the justification is uncertain |
| Personalized advertising | Optional, intrusive, and often involves profiling or third parties | Prior consent is commonly the safer approach |
| Cross-site tracking | Difficult to reconcile with ordinary visitor expectations | Do not activate before a valid choice |
What Makes Cookie Consent Valid Under the LGPD?
A banner is not compliant merely because it has an Accept button. If consent is the legal basis, the visitor must receive understandable information and be able to make a genuine choice.
LGPD consent should be:
- Free: the visitor should not be unfairly pressured or misled into accepting.
- Informed: the website should explain the relevant purposes and processing.
- Unambiguous: consent should result from a clear positive action.
- Specific: consent should relate to defined purposes rather than an unlimited authorization.
- Provable: the organization should be able to demonstrate how and when consent was obtained.
- Withdrawable: the visitor should be able to change the decision through an accessible method.
Pre-ticked boxes, hidden rejection links, confusing button colors, or cookie walls can undermine the quality of consent. The website should also avoid loading optional cookies before the visitor has made the required choice.
Necessary and Non-Necessary Cookies
The ANPD describes non-necessary cookies as cookies whose disabling does not prevent the website, application, or requested service from functioning. Understanding the main types of website cookies helps website owners decide which technologies should be necessary and which should remain optional.
Cookies that may be necessary include:
- authentication and login session cookies;
- shopping cart and checkout cookies;
- security and fraud-prevention cookies;
- load-balancing cookies; and
- cookies needed to remember a visitor’s privacy choice.
Cookies used for advertising, detailed analytics, personalization, social media tracking, or audience profiling are usually not essential to the service requested by the visitor. They should not be placed in the necessary category merely because they are useful to the business.
Do not rely only on the cookie name or the category selected by a plugin. Review what the technology actually does, which data it sends, who receives the data, and whether the website can provide the requested service without it.
Do Analytics Cookies Require Consent in Brazil?
The answer depends on the analytics setup. The LGPD does not create a simple rule that every analytics cookie always requires consent or that analytics is always covered by legitimate interest. If your website uses Google Analytics, read our separate guide to Google Analytics cookie consent.
A limited first-party measurement tool with short retention, restricted data, no advertising reuse, no cross-site tracking, and effective safeguards may present a different risk from a service that combines analytics data with advertising profiles across many websites.
Before using analytics without consent, consider:
- whether the tool uses cookies or other persistent identifiers;
- whether IP addresses or user IDs are collected;
- whether the provider uses the data for its own purposes;
- whether data is combined across services or websites;
- whether the visitor would reasonably expect the measurement;
- whether the same purpose can be achieved with less data; and
- whether visitors have an effective objection or preference control.
If the assessment does not provide a reliable legal basis, keep analytics disabled until the visitor gives consent. This is also easier to manage when the same website serves visitors in both Brazil and regions with stricter prior-consent rules.
Advertising, Pixels, and Profiling
Advertising technologies commonly create the strongest case for prior consent. Meta Pixel, Google Ads tags, remarketing tools, affiliate tracking, social media pixels, and data-management platforms may observe behavior, combine information, create profiles, or share identifiers with third parties. Our guide to tracking pixels explains how these technologies collect information without relying only on traditional cookies.
These practices are usually optional from the visitor’s perspective. They may also be difficult to justify through legitimate interest when the tracking is extensive or unexpected. A safer setup is to block advertising technologies until the visitor actively accepts the relevant category.
Your banner and cookie policy should name the purposes clearly. Labels such as “improve your experience” are not enough when the actual purpose is personalized advertising or cross-site measurement.
What Does the ANPD Recommend for Cookie Banners?
The ANPD has published an official Cookies and Personal Data Protection guide. The guide is educational guidance rather than a separate cookie law, but it provides a useful picture of the authority’s expectations.
A practical two-layer banner based on the guide can work as follows:
First Layer
- Provide brief, clear information about cookie use.
- Offer an Accept all choice.
- Offer a visible Reject non-necessary cookies choice.
- Provide access to cookie settings or preference management.
- Link to more detailed cookie information.
Second Layer
- Separate cookies into understandable categories.
- Keep non-necessary categories disabled by default when consent is required.
- Allow the visitor to choose specific categories.
- Explain the purpose of each category.
- Keep a prominent option to reject non-necessary cookies.
- Provide a clear way to save the selected preferences.
The interface should not make acceptance much easier than rejection. A visitor should not need to navigate through several screens to refuse cookies when all cookies can be accepted with one click. See our cookie banner examples for a practical comparison of clear and misleading banner designs.
What Should a Brazilian Cookie Policy Include?
Your cookie policy should help an ordinary visitor understand what happens on the website. It should be consistent with the technologies that actually load, not copied from a generic template without verification.
Include:
- the categories and purposes of cookies and similar technologies;
- whether each technology is necessary or optional;
- the legal basis relied on for relevant processing;
- the duration or retention period;
- the third parties that receive or access data;
- information about international data transfers where relevant;
- instructions for changing preferences or withdrawing consent;
- the rights available under the LGPD; and
- contact information for privacy questions.
Review the notice whenever you add a plugin, advertising campaign, embedded service, chat widget, video platform, or analytics tool. A cookie scanner can help identify technologies that may otherwise be missed, although scanner results still need human review.
Does the LGPD Apply to Foreign Websites?
Yes, it can. A company does not need a Brazilian office for the LGPD to become relevant. A foreign website that offers goods or services to people in Brazil or processes data relating to individuals located in Brazil may fall within the law’s scope.
Signs that a website may be directing activities toward Brazil include Portuguese content, Brazilian real pricing, delivery to Brazilian addresses, local advertising campaigns, Brazilian customers, or customer support intended for the market.
If your website serves several regions, you can use one strict global consent model or configure regional behavior. The global model is simpler and offers consistent control. Regional configuration can reduce unnecessary prompts, but it requires dependable geolocation, careful testing, and ongoing legal maintenance.
Cookies and Children’s Personal Data
The LGPD gives special protection to children’s and adolescents’ personal data. Processing must be carried out in their best interests, and the website should use clear information appropriate to the audience.
Websites aimed at children should avoid unnecessary profiling and advertising trackers. They should assess age, consent, transparency, data minimization, and parental or guardian involvement carefully rather than relying on an ordinary adult-facing banner.
This area is especially sensitive. A child-directed service should obtain advice based on its particular audience, technology, and processing activities.
Practical Brazil Cookie Consent Examples
| Website setup | Likely approach | Why |
|---|---|---|
| Online store using only cart, checkout, and security cookies | A consent banner may not be required | The cookies may be necessary for the service, but they should still be disclosed |
| Business site using a privacy-focused first-party analytics tool | Assess the legal basis and safeguards | The answer depends on identifiers, configuration, necessity, expectations, and data sharing |
| WordPress site using Google Analytics and Google Ads remarketing | Use prior consent for optional categories | Advertising and cross-service tracking create greater privacy risks |
| Shopify store using Meta Pixel and personalized ads | Block marketing tags until acceptance | The tools can support profiling and third-party advertising |
| Portfolio with no cookies, pixels, forms, or embedded trackers | A cookie banner may not be needed | No relevant cookie processing may occur, but verify the hosting and platform |
| International website serving Brazil and the EU | Use a strict global model or regional configuration | Several privacy regimes may apply to the same website |
Brazil Cookie Compliance Checklist
Check your website before publishing the banner
Use this list as a practical starting point for an LGPD cookie review.
Scan the website and list cookies, pixels, local storage, embeds, and third-party scripts.
Document the purpose, provider, duration, data, and recipients for each technology.
Separate genuinely necessary technologies from analytics, advertising, and personalization.
Choose and document an appropriate LGPD legal basis for each processing purpose.
Keep optional technologies disabled until consent when consent is the legal basis.
Provide visible accept, reject non-necessary, and preference-management controls.
Make withdrawal as accessible as the original consent choice.
Update the cookie policy and check that it matches the website’s actual behavior.
Test the website before consent, after acceptance, after rejection, and after withdrawal.
Repeat the audit whenever plugins, vendors, campaigns, or website features change.
Brazil LGPD vs EU Cookie Rules
The LGPD and the EU GDPR share principles such as transparency, purpose limitation, data minimization, accountability, and data subject rights. However, their cookie frameworks should not be treated as identical.
| Question | Brazil | European Union |
|---|---|---|
| Main framework | LGPD plus ANPD guidance | GDPR plus national rules implementing the ePrivacy Directive |
| Universal prior consent for all non-essential cookies? | No single blanket cookie rule; assess personal data, purpose, and legal basis | Prior consent is commonly required unless a storage or access exception applies |
| Can another legal basis be considered? | Yes, depending on the processing and LGPD requirements | GDPR legal bases do not remove a separate ePrivacy consent requirement |
| Recommended banner controls | Accept all, reject non-necessary, and granular settings | Accept and reject choices with valid, granular consent where required |
| Withdrawal | Consent should be revocable through an accessible process | Withdrawal must be as easy as giving consent |
A banner designed for valid EU prior consent will often provide useful controls for Brazilian visitors as well. However, using the same interface does not replace a Brazil-specific assessment of legal bases, notices, vendors, and data subject rights.
What Happens If a Website Violates the LGPD?
LGPD problems can lead to complaints, ANPD investigations, corrective measures, contractual problems, reputational damage, and sanctions available under the law. Risk is not limited to the visual banner. A website may also have problems if its optional trackers load too early, its policy is inaccurate, consent cannot be demonstrated, or withdrawal does not work.
The best approach is to treat cookie compliance as an ongoing process. Scan, classify, configure, document, test, and repeat. A banner cannot fix undisclosed technologies or poor data practices on its own.
Conclusion
Brazil cookie consent laws do not produce a simple rule that every website must use an identical cookie banner. The LGPD requires you to understand whether cookies process personal data, define each purpose, select an appropriate legal basis, provide clear information, and respect visitor rights.
Strictly necessary cookies may often be used without prior cookie consent. Optional advertising, profiling, and cross-site tracking technologies are much more likely to require a genuine consent choice. Analytics must be assessed according to its real configuration rather than its label.
If consent is used, the banner should offer a clear positive choice, a visible way to reject non-necessary cookies, granular settings, and an accessible method for changing preferences later.
This guide provides general information about Brazilian privacy and cookie consent requirements. It does not constitute legal advice.
Recommended Next Step
Now that you understand the main LGPD requirements, the next question is whether your own website needs a cookie banner, an opt-out control, or another privacy mechanism.
Frequently Asked Questions
Common questions about this topic
Brazil does not have one universal rule requiring the same banner on every website. A banner or another control may be needed when cookies process personal data, particularly when consent is the appropriate LGPD legal basis. Necessary cookies may often be used without prior consent, but clear information is still important.
No. Consent is one of several legal bases under the LGPD. The correct basis depends on the purpose, necessity, visitor expectations, risks, and safeguards. Optional advertising and profiling cookies are stronger candidates for consent than essential security or shopping-cart cookies.
Necessary cookies are generally technologies needed to provide the website or a service requested by the visitor. Examples may include security, authentication, shopping-cart, load-balancing, and privacy-preference cookies. Each cookie must be assessed by its actual function.
Possibly, but not automatically. The organization should assess necessity, reasonable expectations, impact on individuals, data sharing, retention, and safeguards. Intrusive or cross-service analytics may make legitimate interest difficult to justify. When the assessment is uncertain, prior consent is often the safer choice.
Advertising cookies are often optional and may involve profiling, third-party disclosure, or cross-site tracking. These features make consent a commonly appropriate basis. Website owners should not assume that a commercial interest alone is enough to activate advertising trackers without a visitor choice.
ANPD guidance presents a first layer with clear information, an Accept all option, a Reject non-necessary cookies option, and access to cookie settings. The detailed layer should allow granular category choices and keep non-necessary categories disabled by default when consent is required.
It can. The LGPD may apply when a foreign website offers goods or services to people in Brazil, processes data concerning individuals located in Brazil, or meets another territorial condition in the law. The company’s physical location is not the only factor.
Yes. When consent is the legal basis, visitors should have an accessible way to withdraw or change it. A persistent privacy settings link or cookie icon can provide access after the banner has closed. Optional trackers should respond correctly to the updated choice.
