What is LGPD and how does it affect cookie consent?

Brazil (LGPD + ANPD Cookies Note) is a privacy regulation applicable in Brazil. LGPD lawful bases apply to tracking. It requires websites to obtain explicit user consent before placing non-essential cookies (opt-in model).

Does LGPD require cookie consent banners?

Yes. Under LGPD, websites must display a cookie consent banner that includes: concise purpose summary, accept all, reject all or link, manage preferences, and more. The banner must be shown before any non-essential cookies are set.

How long does cookie consent last under LGPD?

Under LGPD, cookie consent is valid for 6 months. After this period, websites must request consent again from users.

What records must I keep for LGPD cookie consent?

LGPD requires maintaining consent records that include: timestamp iso, choices, policy version, jurisdiction detected. Records must be retained for at least 18 months.

What Are the LGPD Cookie Consent Requirements?

Q: Is LGPD opt-in or opt-out for cookies?

LGPD follows an opt-in consent model. This means websites must obtain explicit user consent BEFORE placing any non-essential cookies or tracking technologies.

Everything you need to know about LGPD cookie consent compliance in 2026. Complete guide covering opt-in consent requirements, cookie banner elements, consent records, and technical implementation for Brazil.

Opt-in Translation Required Children's Privacy Rules Cookie Walls Restricted

Summary

This guide provides comprehensive technical implementation requirements for Brazil (LGPD + ANPD Cookies Note). LGPD lawful bases apply to tracking.

This jurisdiction requires an opt-in consent model (prior consent), meaning websites must obtain explicit user consent before placing non-essential cookies or similar tracking technologies. Users must actively accept cookies through clear consent mechanisms.

Additional requirements for this jurisdiction include: providing consent banners and privacy information in all required languages, and special protections and consent mechanisms for children's personal data.

Website owners and operators subject to these regulations must implement compliant cookie consent banners, maintain proper consent records, and ensure their tracking technologies respect user privacy choices. This guide outlines all technical requirements needed to achieve compliance.

Key Requirements Overview

Consent Model

Opt-in (Prior Consent)

Consent Lifespan

6 months

Default State

Off (Non-Essential Cookies)

Cookie Walls

Restricted

Technical Requirements

Prior consent for non-essential cookies

Purpose granularity required

Equal prominence for accept/reject buttons

No pre-checked boxes allowed

Dark patterns prohibited

Proof of consent required

Local storage covered by regulation

Implementation Guidance

ANPD 2023 guidance confirms LGPD principles apply to cookies. Consent is most straightforward legal basis for advertising/tracking cookies (though legitimate interest may apply for certain analytics if properly justified and documented). Follow EU-style opt-in banner approach. No pre-ticked consent boxes. Clear purpose specification required. ANPD guidance emphasizes transparency and user control.

Special Protections

Children's Privacy

Parental consent when applicable to children

Sensitive Data

Explicit consent for sensitive data unless exception applies

Record Keeping Requirements

Required Consent Record Fields

For each consent action, you must maintain records containing:

Timestamp ISO
Choices
Policy Version
Jurisdiction Detected

Retention Period: 18 months minimum

Re-consent Trigger: New Purpose Or Material Change

CookieChimp handles all of this automatically. Our platform maintains comprehensive consent records including all required fields, timestamps, consent strings, IP addresses, user agents, and more. Records are securely stored and easily exportable for compliance audits. Learn more about our consent management

Legal References & Resources

Official legal documents and regulatory guidance for this jurisdiction:

ANPD guidance/notes on cookies

https://www.gov.br/anpd/pt-br

Frequently Asked Questions About LGPD Cookie Consent

Legal Disclaimer: For engineering implementation guidance only. Not legal advice. This guide provides technical implementation guidance only and should not be considered legal advice. Privacy laws are complex and frequently updated. We recommend consulting with qualified legal counsel to ensure full compliance with applicable regulations.

Found an issue or have feedback on this page?