Pixels and Brazil's LGPD: what data leaves your website

A third-party pixel or tag sends visitor data to the vendor the moment it loads, before any click. According to each vendor's official documentation, the Meta Pixel can send what goes in the HTTP headers (IP address, browser, page, referrer), an identifier in a cookie, the buttons clicked and the names of form fields; the GA4 Google tag records page views, scrolls, outbound clicks, downloads and forms with a cookie identifier that lasts two years; the TikTok Pixel collects IP, user agent, timestamp, page metadata and clicks; and a session recorder such as Microsoft Clarity records mouse movements, clicks and scrolling to reconstruct the visit. Under Brazil's LGPD (Lei Geral de Proteção de Dados, the country's data protection law), this is personal data whenever it can lead to an identifiable person, and a per-browser identifier usually makes that possible. For advertising pixels, the guide from the ANPD (Brazil's data protection authority) points to consent. In practice, the script can only load after acceptance, and the site needs to know who receives the data, in which country and in what role each vendor acts.

This article explains Brazil's LGPD, ANPD regulations and guides, and vendor documentation based on the sources listed at the end, consulted on October 26, 2026. It is not legal advice: each site's configuration changes what is sent, and the analysis of a specific case belongs to the controller and its legal team.

What a pixel, a tag and a third-party script are

A third-party script is any JavaScript code loaded from a domain other than the site's own. Pixel is the name ad networks give their measurement script. Tag is the generic term used by Google and by tag managers, such as Google Tag Manager, which load several of these scripts from a single one.

They all work the same way: the visitor's browser sends requests to the vendor's server. The request alone carries the IP address and the user agent (a string that identifies the browser and operating system), and the script adds whatever it was programmed to send. The guide to the LGPD, cookies and consent explains why this already counts as data sharing. The focus here is what gets sent.

What each tool collects, according to the vendor

The table summarizes the categories described in each vendor's official documentation. It does not measure what your site sends: that depends on the configuration, the events you created and the features turned on.

Meta Pixel

The Meta Pixel documentation lists five categories the pixel "can collect": HTTP headers (with IP, browser information, page, document and referrer), pixel-specific data (pixel ID and the Facebook cookie), button clicks with labels and the pages visited afterward, optional values the site chooses to send, and form field names, such as email or address. Meta says it does not capture the values of those fields unless they are part of advanced matching or the optional values.

The _fbp cookie stores a unique identifier on the site's domain, with a random number generated by the pixel; _fbc stores the fbclid, a parameter Meta adds to the URL when someone clicks an ad on Facebook or Instagram (fbp and fbc documentation). Advanced matching sends email, phone, name, date of birth, gender, city, state, ZIP code and country, and the pixel applies a SHA-256 hash to the email before sending it.

Google tag and GA4

Google Analytics 4 collects the first_visit, session_start and user_engagement events with no extra code and, with enhanced measurement turned on, page view, scroll, outbound click, download, forms, video and site search. Every event carries language, page address, referring page, title and screen resolution (automatically collected events). The _ga and _ga_<id> cookies distinguish users and persist the session, with a default expiration of two years (GA4 cookie usage).

Two points in Google's documentation deserve attention:

• Google says that in GA4 IP addresses "are not logged or stored" (IP masking). The IP still reaches Google's server in the request; what changes is storage.

• The Analytics policy prohibits sending Google information it could use to identify a person, such as email and phone, and points to where this leaks by accident: URLs with parameters, page titles, text typed into search and forms, utm_ parameters (best practices to avoid sending PII). Google's concept of "PII" is narrower than the LGPD's concept of personal data. Following Google's policy does not settle the question in Brazil.

TikTok Pixel

The TikTok Pixel page (updated in June 2026) lists: information about the ad clicked or the event triggered, timestamp, IP address "to determine the geographic location of an event", user agent for make, model, operating system and browser, cookies, and page metadata with structured microdata, performance and button clicks. On cookies, the text says first-party cookies are optional and third-party cookies are on by default.

Session recorders: the Microsoft Clarity example

Session recording tools, such as Microsoft Clarity and Hotjar, reconstruct the visit so it can be watched later. Clarity is the example here because its documentation is public and detailed. It captures "how the page is being drawn" and interactions such as mouse movements, clicks and scrolling (Clarity FAQ). It uses the IP for geolocation, stores data in Azure and keeps recordings for 30 days, with favorites and a random sample kept for up to 9 months.

Masking happens in the browser, before sending. The default mode is balanced, which hides numbers and emails; strict hides all text; relaxed hides nothing beyond input fields and dropdowns, which are masked in every mode. Clarity sets its own cookies (_clck and _clsk, with a pseudonymous user ID) and cookies on Microsoft domains, among them MUID, which the documentation itself describes as used "for advertising, site analytics, and other operational purposes" (cookie list). Since October 31, 2025, Clarity has required a consent signal for visits from the European Economic Area, the United Kingdom and Switzerland. That requirement is the vendor's, for those regions; it says nothing about Brazil.

When this data is personal under the LGPD

Personal data is "information related to an identified or identifiable natural person" (LGPD, Art. 5, I). Identifiable is the word that matters here: the vendor does not need to know the person's name. An identifier that follows the same browser across pages, visits and sites, added to the IP, the device and the browsing history, can lead to someone.

Three rules in the law set the boundary:

• Anonymized data is data that does not allow the data subject to be identified, "considering the use of reasonable technical means available at the time of its processing" (Art. 5, III).

• Anonymized data stops being personal data, unless the anonymization can be reversed with reasonable effort or with the means of whoever performed it (Art. 12).

• Data "used to build the behavioral profile of a given natural person, if identified" may also be considered personal data (Art. 12, § 2).

The ANPD cookie guide (pp. 8 and 9) applies this directly: information collected by cookies can allow indirect identification "by, for example, making inferences and cross-referencing with other information", and a behavioral profile associated with a person is personal data.

As this article reads the law, two common cases do not escape it:

• Hashed email. The SHA-256 hash of an email is always the same for the same address. Advanced matching exists precisely to match that value to an account on the platform, that is, to identify. This is not anonymization in the sense of Art. 12.

• An IP that is not stored. It still travels and can be used at the moment of collection, for example for geolocation. Not storing it reduces risk; it does not eliminate processing, which includes collection and use (Art. 5, X).

Controller, processor or both

The controller makes the decisions about processing; the processor (operador) processes data on the controller's behalf (Art. 5, VI and VII) and follows its instructions (Art. 39). The ANPD guide on processing agents (version 2.0, April 2022) says the role is defined by decision-making power in the specific case, not by the contract's label.

The site owner decides to install the pixel, chooses the events and decides what the data will be used for. So, for collection on its site, it is the controller. The open question is the vendor's role, and its documentation gives the first clue:

• The Meta Business Tools Terms (in effect since November 3, 2025) say that, outside the European and UK regimes, the advertiser is the controller and Meta acts as processor for matching, measurement and analytics services. The same terms allow Meta to use event data to improve ad delivery (after aggregating it with other data), personalize features and content, and improve its own products.

• Google's list of services puts Google Analytics among the services where Google acts as processor and Google Ads among those where it acts as controller, with exceptions such as enhanced conversions and Customer Match.

• The same Meta terms require the advertiser to publish, on every page where the pixel is used, a notice that third parties, including Meta, may use the data for ad measurement and targeting, and how the person can opt out. Where local law requires consent, the advertiser must obtain it verifiably before using the tools.

When the vendor also uses the data for its own purposes, it decides purposes for that part, which comes close to the definition of controller. Whether this creates joint controllership with the site depends, according to the ANPD, on three cumulative criteria: more than one controller with decision-making power, mutual interest with their own purposes in the same processing, and common or converging decisions on purposes and essential elements (processing agents guide, paragraphs 49 and 50). Under joint controllership, the directly involved controllers are jointly and severally liable for damages (Art. 42, § 1, II), except for the exceptions in Art. 43. In the sources consulted, the ANPD has not published specific guidance on advertising pixels; how each vendor is classified is left to the analysis of the case.

Consent: what the ANPD guide indicates for each type

The cookie guide separates situations by purpose, and its guidance also applies to tracking technologies similar to cookies (p. 6). The legal bases are covered in detail in the pillar guide for this category; for pixels, the summary is this:

The guide also says consent requires a clear, affirmative action and that consent-based cookies stay off by default (pp. 19 and 31). For a pixel, off means not loaded: if the script runs before the choice and only the cookie waits, the request with IP, page and user agent has already gone out.

International data transfer

Meta, Google, TikTok and Microsoft are foreign companies. Under Meta's terms, for example, the entity that processes data outside the European and UK regimes is Meta Platforms, Inc. The LGPD only allows international transfer under the grounds in Art. 33: a country or international body with an adequate level of protection recognized by the ANPD, safeguards such as standard contractual clauses, and "specific and highlighted" consent with prior information about the international nature of the operation, among others.

CD/ANPD Resolution No. 19 of August 23, 2024 regulated the subject and approved the ANPD standard contractual clauses. The points that matter for pixels:

• A transfer is an operation in which a processing agent "transmits, shares or provides access" to personal data to another agent (Art. 3, III, of the regulation). International collection is collection carried out "directly by the processing agent located abroad" (Art. 3, V), and the regulation says it does not constitute a transfer (Art. 6), although it remains subject to the LGPD.

• The controller must check whether the operation is an international transfer and whether it has a valid legal basis and mechanism; the processor helps with the information it has (Art. 4).

• Anyone using contractual clauses to transfer data had up to 12 months from publication to adopt the ANPD standard clauses (Art. 2, sole paragraph, of the resolution). That deadline ended on August 23, 2025.

• With standard clauses, the controller publishes on its site a document in Portuguese, in plain language, with the form, duration and purpose of the transfer, destination country, controller identity and contact, shared use, responsibilities, security measures and data subject rights. This document can sit within the privacy policy, highlighted (Art. 17, §§ 2 and 3, of the regulation).

• The ANPD recognized the European Union as a body with adequate protection (CD/ANPD Resolution No. 32 of January 26, 2026, according to the ANPD list of regulations). That does not cover vendors that process data in the United States.

How a pixel fits this split is not settled in the sources consulted. The visitor's browser sends the data straight to the vendor, which resembles international collection. But the site installs the script and defines what is sent, and, when the vendor acts as the site's processor, the data is processed on behalf of a Brazilian controller, which resembles a transfer. This article recommends treating the flow as a transfer for transparency purposes, stating the destination country in the privacy policy and checking each vendor's contract for which Art. 33 mechanism it offers.

Step by step to put your pixels in order

The steps below are recommendations built from the law, the ANPD guide and vendor documentation. On payment pages, third-party scripts also fall under the PCI DSS 4.0 requirements for checkout scripts.

1. Take inventory. Open the site in an incognito window, without touching the banner, and look at requests to other domains in the Chrome DevTools Network panel. Then check the tag manager, CMS plugins, the ecommerce platform and widgets (chat, video, map), which load scripts too.

2. Record each item with domain, vendor, purpose, data sent, country, vendor role (processor or controller, based on the contract and actual use) and legal basis.

3. Cut what is not used. A pixel from a finished campaign keeps sending data as long as it is on the page.

4. Load only after consent. Each category's script loads after that category is accepted, not when the page opens. At Google, basic consent mode blocks tags from loading until the person interacts with the banner, and if they refuse, nothing is sent. In advanced mode, tags load when the page opens and, with consent denied, send cookieless signals with data such as timestamp, user agent and referrer. Anyone who picks advanced mode needs to assess that sending under the legal basis they use.

5. Reduce what is sent. Turn off advanced matching if there is no basis for it, remove personal data from URLs, titles and utm_ parameters, prefer strict masking mode in the session recorder and mark areas with account, order and payment data as masked.

6. Shorten retention. GA4 lets you change its cookie expiration; the ANPD guide recommends limiting the duration of persistent cookies as much as possible (p. 12).

7. Update the privacy policy with vendors, purposes, countries and how to opt out. The article on what the LGPD requires in a privacy policy covers this.

8. Repeat the inventory with every new campaign, plugin or tag. A single new tag without review is enough for the site to start sending data before consent again.

Server-side tagging: what changes and what does not

With server-side tagging, the browser sends data to a server the site controls, and that server forwards it to vendors. Google describes the benefit this way: the data stays with the site "until you choose to send it elsewhere", and the site controls the format and destination (introduction to server-side tagging). Meta has a similar route, the Conversions API, which sends events from the advertiser's server to Meta.

This helps minimize data, because fields can be removed before forwarding. It does not change the rest:

• The legal basis stays the same. If the purpose is advertising, sending from the server also depends on consent.

• The vendor still receives personal data. According to the Conversions API parameters, email, phone and name are hashed; IP, user agent, fbp and fbc are not.

• The flow disappears from the browser. An audit that only looks at page requests no longer sees the sending, so the inventory needs to include the server configuration.

What not to do

• Load the pixel in the <head> and only then show the banner.

• Treat "reject" as hiding the notice while the tags keep running.

• Combine analytics and advertising into a single banner option.

• Turn on advanced matching or automatic form collection without knowing what it sends.

• Leave the session recorder in relaxed mode on account, checkout or form pages.

• Put email, CPF (Brazilian taxpayer ID) or phone in the URL of thank-you pages or in campaign parameters.

• Install the same pixel two ways (code in the theme and in the tag manager) and block only one of them.

• Conclude that hashing, unstored IPs or server-side tagging take processing outside the LGPD.

How to check your site

The free WebVyze cookie consent checker shows the cookies stored before any click, the trackers found in the HTML, whether there is a consent tool and whether there is a link to the policy. The free check looks at privacy and accessibility risks on the home page. The paid plans include monitoring with scheduled audits and alerts, and each problem becomes an issue with the law, the evidence and a fix guide. The tools read only public pages and show evidence; they cannot see data sent from the server and do not replace legal analysis.