Privacy
Brazil's LGPD (Lei Geral de Proteção de Dados, Law No. 13,709/2018) never mentions cookies, but it applies to any cookie, pixel or script that collects personal data from site visitors. As the ANPD (Brazil's data protection authority) reads it, cookies needed for the site to work can rely on legitimate interest, while advertising and cross-site tracking require consent. The guides below show what the banner needs to do, what pixels collect and what the privacy policy should say.
Brazil's LGPD for websites: cookies, consent and third-party scripts
What Brazil's LGPD and the ANPD guide require of a site with cookies, analytics and pixels: legal bases, banner, cookie policy and a checklist.
Go deeper
- Privacy
Website privacy policy: what Brazil's LGPD requires
What Brazil's LGPD requires in a website privacy policy: purposes, third parties, rights, DPO, cookies, where to link it and how to keep it up to date.
- Privacy
Pixels and Brazil's LGPD: what data leaves your website
What Meta Pixel, Google tag, TikTok Pixel and session recorders collect, when that is personal data under Brazil's LGPD and how to load them after consent.
Frequently asked questions
- Does every site need a cookie banner?
- Only when the site uses cookies or scripts that are not necessary for it to work and that depend on consent, such as advertising and cross-site tracking. Strictly necessary cookies can rely on legitimate interest, according to the ANPD cookie guide.
- Does the reject button need to be as visible as the accept button?
- Yes. As the ANPD guide reads it, consent has to be free, and the person needs to be able to refuse as easily as they accept. Non-necessary cookies stay off until they choose.
- Does an ad pixel count as collecting personal data?
- In general, yes. Pixels such as Meta's and Google's send the vendor browser identifiers and browsing data that the LGPD treats as personal data when they make it possible to identify someone, even indirectly.
- Does the privacy policy replace the banner?
- No. The policy explains how the site processes data as a whole. The banner is where the person makes a choice about the cookies that depend on consent. Both are needed when the site uses that kind of cookie.
Other topics
Accessibility
If your company has its headquarters or a commercial representative in Brazil, its website must be accessible to people with disabilities: that is what article 63 of Brazil's Inclusion Law (Lei Brasileira de Inclusão, Law 13,146/2015) requires.
5 guidesPerformance
Core Web Vitals are three Google metrics that measure the real experience of visitors: LCP measures loading, INP measures responsiveness to clicks and taps, and CLS measures visual stability.
6 guidesSecurity
The first security step on a public website is to check what any visitor can see from the outside: whether every request goes to HTTPS with a valid certificate, whether the security headers are present, whether any files are exposed, whether the CMS and plugins are up to date and which third-party scripts run on the page.
3 guidesTechnical SEO
Google shows a page only after crawling it, processing the content and deciding to store it in the index.
5 guides
Partners
Partner benefits with one coupon.
WPLIGHT20% OFFGet the offer from WP Rocket (opens in a new tab)
25% OFFGet the offer from Perfmatters (opens in a new tab)
Partner links. We may earn a commission at no extra cost to you.