LGPD compliance for websites
Brazil’s LGPD needs consent before the trackers run.
Brazil’s privacy law applies to any website that offers goods or services to people in Brazil. Non-essential cookies wait for consent, refusing has to be as easy as accepting, and you have to be able to prove the choice. ConsentBit does all three.
Google-certified CMP · IAB Europe registered CMP (ID 502) · 9 languages · Webflow, Framer, WordPress and any website builder
First visit to your site
We value your privacy
We use necessary cookies to run this site. With your permission, we’d also like to measure traffic and show relevant ads.
Until they choose, only necessary cookies run. The floating icon reopens their settings any time.
Accept and Reject, side by side, as the ANPD asks.
Nothing non-essential runs until the visitor agrees.
Brazil’s privacy law, enforced by the ANPD.
The Lei Geral de Proteção de Dados (LGPD), Law No. 13.709/2018, protects the personal data of people in Brazil. It applies wherever your company is based, as long as you process data in Brazil or offer goods or services to people there. The Autoridade Nacional de Proteção de Dados (ANPD) enforces it.
Maximum fine
R$50 million
per infraction, or 2% of your Brazilian revenue, whichever is lower.
In force since
18 September 2020, with fines possible since 1 August 2021
Default model
Consent. Non-essential cookies wait until the visitor agrees.
Five things LGPD expects from your website
Each requirement in plain terms, next to how ConsentBit covers it.
What LGPD requires
Ask before non-essential cookies are set
How ConsentBit handles it
Analytics and Marketing scripts stay blocked until the visitor agrees.
What LGPD requires
Make refusing as easy as accepting
How ConsentBit handles it
The banner shows Accept all and Reject all together on the first screen.
What LGPD requires
Let visitors choose by purpose
How ConsentBit handles it
The preferences panel splits cookies into categories the visitor can accept one by one.
What LGPD requires
Let visitors change their mind, free and easily
How ConsentBit handles it
A preferences link reopens the panel at any time, and the new choice applies straight away.
What LGPD requires
Keep proof of every consent
How ConsentBit handles it
Every choice is logged with the date and time, ready to export.
The burden of proof sits with you. Article 8 §2 puts it on the controller to show that consent was obtained properly.
What a visitor sees, step by step
Nothing non-essential runs until the visitor decides.
They land on your site
The banner appears. Analytics and Marketing scripts are blocked, so no non-essential cookies are set yet.
They choose
Accept all, Reject all, or pick categories in the preferences panel.
The choice takes effect
Allowed categories run. Anything they didn’t allow stays blocked.
They can change their mind
A preferences link reopens the panel, free and in a couple of clicks, as Article 8 §5 requires.
WHAT THE ANPD ASKS OF A COOKIE BANNER
Brazil’s regulator wrote down what a banner should look like.
In October 2022 the ANPD published a guide on cookies and data protection. It isn’t a law, but it is the regulator setting out what it expects to see, and it is specific about banners. Here is its list of what to avoid, and what ConsentBit does instead.
The ANPD guide is guidance, not a statute. It carries weight because the regulator wrote it, and it reads as a checklist a regulator would use.
Blocked until they agree
For visitors in Brazil, ConsentBit holds non-essential scripts until a choice is made, on every plan including the free one. Here’s what runs before and after.
Necessary cookies don’t need consent
The ANPD guide says strictly necessary cookies can rely on legitimate interest rather than consent, which is why they keep running. Everything else waits.
The fine is measured in Brazil
LGPD fines are capped at 2% of your revenue in Brazil for the last financial year, up to R$50 million per infraction. GDPR, by contrast, counts global revenue.
Selling into Europe as well? See what GDPR requires →
Add an LGPD-ready banner to your site, free.
Records
A record of every consent, ready if the ANPD asks
Every choice is recorded with when it was made and which categories the visitor accepted or rejected. You can export the log as a CSV file whenever you need it.
The visitor opted out, so advertising scripts were blocked.
The visitor didn’t opt out, so scripts ran as normal.
Consent log
Article 8 §2 puts the burden of proof on you, so the log is the part that matters if anyone asks.
FAQ
Brazil privacy questions, answered
Can't find what you need? Talk to our team at web@consentbit.com.
It applies if you process personal data in Brazil, or if you offer goods or services to people in Brazil, whatever country your company is based in and wherever the data is stored. There is no revenue or size threshold, so a small website selling into Brazil is covered.
The LGPD doesn’t name cookie banners, but it does require a legal basis before you process personal data, and consent is the usual basis for analytics and advertising cookies. The ANPD’s cookie guide treats a banner as the normal way to collect and record that consent.
It has to be free, informed and unambiguous, given for a specific purpose. Blanket authorisations are void, silence or a pre-ticked box doesn’t count, and the visitor has to be able to withdraw it at any time through a free and easy process.
Up to 2% of your revenue in Brazil for the last financial year, excluding taxes, capped at R$50 million per infraction. The ANPD can also issue warnings, daily fines, publicise the violation, and block or delete the data involved.
They are close relatives. Both ask for a legal basis, both give people rights over their data, and both expect consent before non-essential cookies. The LGPD has ten legal bases rather than six, its fines are capped in reais and measured on Brazilian revenue, and its regulator has published its own cookie banner guidance.
See what GDPR requires →
No. The ANPD’s guide says strictly necessary cookies, the ones a site needs to work, can rely on legitimate interest instead. You still have to tell visitors about them, and they can object.
Article 41 says controllers have to appoint one, called an encarregado, and publish their contact details, preferably on the website. The ANPD has since relaxed this for small businesses, so check where yours sits before you decide.
Yes. ConsentBit has a free plan, and every paid plan comes with a 14-day free trial. See pricing for what each plan includes. See pricing →
Meet Brazil’s rules without rebuilding anything
Hold the trackers until a visitor agrees, make refusing as easy as accepting, and keep a record of every choice.
This page is a general overview of Brazil’s Lei Geral de Proteção de Dados, not legal advice. The LGPD covers far more than cookies, including data subject requests, international transfers and security incidents, which sit outside what a consent banner handles.