Brazil's LGPD for websites: cookies, consent and third-party scripts

Brazil's LGPD (Lei Geral de Proteção de Dados, Law No. 13,709/2018, the country's data protection law) never uses the word "cookie", but it applies to any cookie, pixel or script that collects personal data from site visitors. As the ANPD (Brazil's data protection authority) reads it, cookies necessary for the site to work can rely on legitimate interest; advertising, profiling and cross-site tracking cookies require consent; and audience measurement stays under legitimate interest only in narrow conditions. In practice, a site needs a banner with a reject button as visible as the accept button, non-necessary cookies switched off until the person chooses, clear information about purpose, retention and sharing, a simple way to change one's mind later and an accessible policy. Third-party scripts count too, because loading a script from another domain already sends visitor data to that domain.

This article explains Brazilian law and the ANPD guide based on the sources listed at the end, consulted on October 26, 2026. It is not legal advice: each site has its own purposes and vendors, and the analysis of a specific case belongs to the controller and its legal team.

What the LGPD says, and does not say, about cookies

The LGPD has no article about cookies. It regulates the processing of personal data, which Art. 5, I defines as "information related to an identified or identifiable natural person". Processing covers almost any operation with that data: collection, storage, use, sharing, deletion (Art. 5, X).

A cookie is a small file that the site writes to the visitor's browser and reads on later visits. Not every cookie carries personal data, but many do: a unique identifier that follows the same person across pages and visits can, combined with other information, lead to someone identifiable. The ANPD cookie guide (pp. 8 and 9) says exactly this and points out that the LGPD itself treats as personal data the data "used to build the behavioral profile" of an identified person (Art. 12, § 2).

A few terms from the law come up constantly on this subject (all in Art. 5):

• The data subject (titular) is the person the data refers to, in this case the site visitor.

• The controller makes the decisions about processing. As a rule, the company that owns the site.

• The processor (operador) processes data on the controller's behalf, following its instructions (Art. 39).

• The data protection officer (encarregado) is the person appointed as the communication channel between the controller, data subjects and the ANPD.

The ANPD, which enforces the law, is now called Agência Nacional de Proteção de Dados (National Data Protection Agency). The name came with Law No. 15,352 of February 25, 2026, which amended Art. 55-A of the LGPD. The cookie guide is older and was published when the body was still called Autoridade Nacional de Proteção de Dados (National Data Protection Authority).

The ANPD cookie guide: date and weight

The official document is the Guia Orientativo Cookies e Proteção de Dados Pessoais (guidance on cookies and personal data protection), version 1.0, digital publication of October 2022. The file on the gov.br portal is dated October 18, 2022. When checked on October 26, 2026, the ANPD list of publications still showed only that version.

The guide is not a regulation. In its closing remarks (p. 37), the ANPD says it "should be understood as a guide of good practices" and that it may be updated. That does not make it irrelevant: much of its guidance applies rules written in the law, such as the requirement for free and unambiguous consent, and the guide shows how the ANPD reads those rules. The text also says its guidance applies, in general, to tracking technologies similar to cookies, including on phones and tablets (p. 6).

The cookie types the guide uses

The guide (pp. 9 to 12) classifies cookies by four criteria, and the same cookie can fall into more than one category:

The split that matters most is necessary versus non-necessary, because it drives the choice of legal basis.

Legal bases: consent or legitimate interest

Art. 7 of the LGPD lists ten grounds that authorize processing, known as legal bases. For cookies, the ANPD guide covers the two most common ones, consent and legitimate interest, and notes that others may apply in specific cases (p. 17). It also says there is no "hierarchy or preference among the legal bases" (p. 20).

Consent

The law defines consent as a "free, informed and unambiguous expression" by the data subject for a specific purpose (Art. 5, XII). Art. 8 adds that "generic authorizations for the processing of personal data shall be null" (§ 4), that consent can be withdrawn at any time "through a free and facilitated procedure" (§ 5) and that "the burden of proof lies with the controller" to show that consent is valid (§ 2).

The guide (pp. 17 to 20) translates this into cookie banner terms:

• Free means the person can refuse without negative consequences. Making access conditional on accepting all cookies, with no real option, is not compatible with the LGPD, although the guide says this is assessed case by case.

• Informed means the person knows the specific purpose, the retention period and the other Art. 9 information before deciding.

• Unambiguous means a clear, affirmative action. The guide says that "the use of cookie banners with pre-selected authorization options is not recommended", and neither is treating continued browsing as acceptance.

• Withdrawal should be as simple as giving consent was, and recording and documenting how consent was obtained is good practice.

If cookies collect sensitive data (health, religion, sexual orientation and the other categories in Art. 5, II), consent must be given "in a specific and highlighted way" (Art. 11, I).

The guide also makes the opposite point: consent is not the right basis for strictly necessary cookies, because the person has no real choice about something the site cannot work without (p. 20).

Legitimate interest

Legitimate interest (Art. 7, IX) allows processing non-sensitive data to serve the legitimate interests of the controller or a third party, except where the data subject's rights and freedoms prevail. The law limits its use: "only the personal data strictly necessary for the intended purpose may be processed" (Art. 10, § 1), the controller must make the processing transparent (Art. 10, § 2) and the data subject can object if the law is not complied with (Art. 18, § 2). Art. 37 requires records of processing operations, "especially when based on legitimate interest".

Before using this basis, the controller has to assess whether the data subject's rights prevail. In February 2024 the ANPD published a guide on legitimate interest with a three-phase balancing test template: purpose, necessity, and balancing and safeguards.

For cookies, the 2022 guide points to three situations (pp. 24 and 25):

• Strictly necessary cookies: legitimate interest "may be the appropriate legal basis", in general.

• Audience measurement: it can rely on legitimate interest "in certain contexts", when processing is limited to identifying patterns with aggregated data, without combining it with other tracking mechanisms and without building profiles.

• Advertising: "legitimate interest will hardly be the most appropriate legal basis", especially with third-party cookies, behavioral profiles and cross-site tracking. Here the guide points to consent.

Summary by cookie type

The table summarizes the guide; it does not replace the analysis. The guide itself repeats that each concrete situation needs to be assessed.

What the cookie banner should do, according to the ANPD

The guide (pp. 30 to 33) presents these points as non-exhaustive good practices. Some follow directly from the law, such as the possibility of refusing and acceptance that is not pre-ticked; others are design recommendations.

First layer (the notice that appears on arrival)

• A button to reject all non-necessary cookies, easy to see, also on the second layer.

• An easy-to-reach link for the person to exercise their rights: learn how the data is used and for how long, request deletion, object or withdraw consent.

Second layer (the preferences screen)

• Group cookies into categories and describe each one by use and purpose, in plain language.

• Allow separate consent for each purpose, where applicable.

• Keep consent-based cookies off by default.

• Explain how to block cookies in the browser settings and say if any tracker cannot be blocked that way.

The guide adds a caveat about the browser: managing cookies there has a "complementary function" and does not replace the site's own mechanism for managing cookies and exercising rights (p. 15).

What to avoid

• A single button ("I agree", "accept", "got it") with no option to manage, when the basis is consent.

• A reject or settings button that is hidden or hard to understand, with only the accept button highlighted.

• Blocking or hindering refusal of all non-necessary cookies.

• Non-necessary cookies already on, waiting for the person to switch them off one by one.

• No second layer.

• No direct way to withdraw consent and object to processing, other than blocking in the browser.

• Bundling different purposes into a single option.

• Cookie information only in a foreign language.

• A list so detailed that it wears the person out and prevents a clear decision.

• Making consent conditional on accepting all cookies, with no effective option.

In the guide's examples, the banner considered adequate has three buttons with the same format and prominence ("accept all", "reject all", "manage"), a second layer by category and non-necessary cookies off by default. Even so, in one of the examples (p. 22), the ANPD notes that the simple withdrawal mechanism was missing for the page to be compatible with the LGPD. A permanent footer link that reopens the preferences is one way to meet that point.

Privacy policy and cookie policy

Art. 9 of the LGPD gives the data subject the right to information presented "in a clear, adequate and conspicuous manner" about:

1. the specific purpose of the processing;

2. the form and duration of the processing;

3. the identity of the controller;

4. the controller's contact information;

5. "information about the shared use of data by the controller and its purpose";

6. the responsibilities of the agents that will carry out the processing;

7. the data subject's rights, with explicit mention of those in Art. 18.

If consent is requested with misleading or abusive information, or without prior transparency, it is null (Art. 9, § 1).

The guide (pp. 28 and 29) recommends a cookie policy and says it can be a section of the privacy policy, a separate page or part of the banner's own layers, as long as the essential information is there. It distinguishes the two: the banner is the short notice with the controls; the policy is the detailed text. In example 7, the ANPD notes that keeping cookie information only in the privacy policy may not be enough, because not everyone opens that page. The privacy policy as a whole has its own article: what the LGPD requires in a privacy policy.

Two items deserve a check in the cookie policy:

• Retention period. For the guide, "indefinite, excessive or disproportionate retention periods" relative to the purpose are not compatible with the LGPD (p. 17).

• Data protection officer contact. The identity and contact details of the data protection officer must be made public, "preferably on the controller's website" (Art. 41, § 1). Small processing agents, such as microenterprises and startups, may skip appointing one, but they must provide a communication channel for data subjects (CD/ANPD Resolution No. 2/2022, Art. 11).

Third-party scripts are data sharing too

When a page loads a script, pixel, font, video or widget from another domain, the visitor's browser sends a request to that domain. The request carries the visitor's IP address (without it the response cannot arrive), usually carries the address of the originating page in the Referer header (MDN) and carries any cookies that domain has already stored in the browser. All of this happens before any new cookie is created. That is why looking only at the cookie list does not show a site's full data flow.

The European Data Protection Board describes a tracking pixel as a resource, usually an image, whose only purpose is often to make the browser communicate with the pixel's owner (EDPB, Guidelines 2/2023, paragraph 47). The technical description holds in any country; the legal consequence in Brazil comes from the LGPD.

What the LGPD says about this:

• The data subject has the right to know about the shared use of data and its purpose (Art. 9, V) and to be told which public and private entities the controller shared data with (Art. 18, VII).

• A controller that obtained consent and needs to share the data with other controllers must obtain specific consent for that, except where the law waives it (Art. 7, § 5).

• The processor handles data according to the controller's instructions, and the controller checks whether the instructions and the rules are being followed (Art. 39).

Whether each script vendor is a processor or another controller depends on who decides the purposes. A service that only processes data for the site, under its instructions, tends to be a processor. An ad network that also uses the data for its own purposes decides purposes and comes closer to being a controller. This is a reading of the definitions in Art. 5, VI and VII, not a fixed rule; each vendor's contracts and documentation need to be read. The article Pixels and Brazil's LGPD: what data leaves your website covers the most common cases.

The practical consequence for the banner: rejecting or not responding has to stop the third-party script from loading, not just hide the notice. If the ad pixel loads before the click, the data has already left, and the "off by default" the guide asks for did not happen.

Practical checklist

The items below are recommendations built from the law and the ANPD guide. The reference for each one is in the previous sections.

1. Take inventory. For each relevant page, list cookies, local storage items (localStorage) and third-party scripts, with domain, purpose, retention and who receives the data. Plugins, themes and tag managers load scripts too and belong on the list.

2. Classify each item as necessary or non-necessary and by purpose.

3. Set the legal basis per purpose. If it is legitimate interest, run and keep the balancing test.

4. Block before acceptance. Non-necessary scripts load only after consent for their category.

5. Build the first layer with accept, reject non-necessary and manage, all with the same prominence, plus a link to data subject rights.

6. Build the second layer with categories described in plain language, non-necessary cookies off and necessary ones marked as always active.

7. Keep a permanent link, in the footer for example, that reopens the preferences to withdraw or change the choice.

8. Record consent: what was accepted, when and with which version of the text, because the burden of proof is on the controller.

9. Publish the cookie policy with purposes, retention periods, third parties that receive data, rights and the contact of the data protection officer or service channel, in Portuguese.

10. Shorten retention: prefer session cookies when they are enough and shorten persistent ones.

11. Review with every new tag, plugin or campaign. If the purpose changed, the old consent does not cover it (guide, p. 18; LGPD, Art. 9, § 2).

Differences from the European cookie rule

In the European Union, the cookie rule is in Art. 5(3) of the ePrivacy Directive (2002/58/EC), not only in the GDPR. According to the EDPB Guidelines 2/2023 (version 2.0, adopted on October 7, 2024), that rule protects any "information" stored on or read from the user's device, whether personal data or not (paragraphs 6 to 12, which cite the Court of Justice of the EU). The exceptions to consent, according to the text of the article reproduced in the guidelines, are storage or access used only to transmit the communication and what is strictly necessary to provide a service the user explicitly requested.

Brazil has no separate rule about storing information on a device. The LGPD only comes in when there is personal data, and the legal bases are those of Art. 7, including legitimate interest, which the ANPD guide accepts for necessary cookies and, in narrow conditions, for audience measurement.

Two practical consequences. If everything on the site that is not strictly necessary waits for consent, the legal basis question is also covered in Brazil; the banner design still needs to be checked against the ANPD list. The reverse does not hold: measuring audience on legitimate interest, as the guide accepts in certain contexts, does not automatically carry over to European visitors. The EDPB says exceptions to consent are analyzed case by case, depending on each country's transposition and the guidance of national authorities (paragraph 4).

When some of this does not apply

• Personal sites with no economic purpose. The LGPD does not apply to processing by a natural person "for exclusively private and non-economic purposes" (Art. 4, I). A personal blog with ads or product sales already has an economic purpose.

• Exclusively journalistic, artistic or academic purposes (Art. 4, II). The exclusion refers to the purpose of the processing. Advertising or analytics cookies on a news site serve another purpose, so they are unlikely to fall outside the law. This is an interpretation of the legal text, not an express rule.

• Foreign sites. The law applies regardless of the country of incorporation when processing takes place in Brazil, when the offer targets people in Brazil or when the data is collected in Brazil, which includes a data subject who is in the country at the time of collection (Art. 3 and § 1).

• Truly anonymized data is not personal data (Art. 12), unless the anonymization can be reversed with reasonable effort. A persistent unique identifier is not anonymization.

• Necessary cookies do not need consent, but they still require transparency and respect for data subject rights (Art. 7, § 6).

• Small size is not an exemption. CD/ANPD Resolution No. 2/2022 simplifies obligations, such as the one about the data protection officer, but the LGPD still applies.

• The public sector and sites aimed at children follow additional rules (guide, pp. 20 and 24; LGPD, Art. 14) that this article does not cover.

What sanctions the law provides

Art. 52 of the LGPD lists the administrative sanctions the ANPD can apply, including a warning, a simple fine of up to 2% of revenue in Brazil in the last fiscal year, "limited, in total, to R$50,000,000.00 (fifty million reais) per infraction", publicizing the infraction, and blocking and deleting the data. Sanctions follow an administrative proceeding with the right of defense and take into account criteria such as severity, good faith, recidivism and cooperation (§ 1). The data subject can also file a petition against the controller with the ANPD (Art. 18, § 1). This article does not cite specific cookie cases: no ANPD decision on the subject appeared in the official sources consulted.

How to check your site

You can do a first check by hand. Open the site in an incognito window, without clicking the banner, and look in Chrome DevTools at the list of stored cookies (Application panel) and at the requests to other domains (Network panel). If advertising cookies or calls to ad networks show up before any choice, the setup does not block what it should.

The free WebVyze cookie consent checker runs this check automatically: it shows the cookies stored before any click, the trackers found in the HTML, whether there is a consent tool and whether there is a link to the privacy policy. The free check looks at privacy and accessibility risks on the home page. On the paid plans, WebVyze monitors sites and keeps an inventory of third-party scripts. The tools show evidence; they do not make a site compliant and do not replace legal analysis.