Cookie consent banner for LGPD (Brazil): a free setup

What the LGPD asks of cookies

The Brazilian General Data Protection Law, Lei 13.709/2018, applies whenever you process personal data of people in Brazil. Cookies and similar identifiers count as personal data as soon as they can single out a visitor: an analytics client id, an advertising id or a session recording does. For those, the usual legal basis is consent, which article 5, XII defines as a free, informed and unambiguous manifestation for a specific purpose.

Article 8 adds two rules that shape the banner. Consent must be given for specific purposes, so a single Accept for everything with no way to choose is weak, and paragraph 5 says the data subject can revoke consent at any time, through a free and facilitated procedure. The burden of proving consent is on the controller (article 8, paragraph 2).

In October 2022 the Autoridade Nacional de Proteção de Dados (ANPD) published its guide on cookies and personal data protection. Its recommendations will look familiar to anyone who has read European guidance: classify cookies by purpose, show a banner on the first visit, offer a button to reject optional cookies on the first layer, do not pre-select categories, explain purposes and retention in plain Portuguese, and give a permanent way to manage preferences.

Setup with one script tag

cookieowl ships the LGPD wording in Portuguese. With data-lang="pt-BR" (or auto on a page with lang="pt-BR") the banner says that necessary cookies keep the site running and that preferences, statistics and marketing cookies are used only with consent, citing the LGPD. Put the tag first in <head>:

index.html

<!doctype html>
<html lang="pt-BR">
<head>
  <meta charset="utf-8">
  <script src="https://cdn.jsdelivr.net/npm/cookieowl@0.1.0/dist/cookieowl.js"
    data-lang="pt-BR"
    data-template="lgpd"
    data-policy-url="/politica-de-privacidade"
    data-consent-mode
    data-auto-block></script>
  <!-- seus outros scripts depois -->
</head>

The banner shows Rejeitar todos, Aceitar todos and Personalizar. The first two have the same style and size, as the ANPD guide recommends, and Personalizar opens a dialog with Necessários (always on), Preferências, Estatísticas and Marketing, all switched off until the visitor turns them on.

Blocking what loads before the choice

The most common LGPD problem is not the text, it is timing. A tag manager or a pixel in the head fires on page load, before anyone reads the banner. Mark each tracker with the category it belongs to and change its type to text/plain, which the browser does not execute:

index.html

<!-- Estatísticas: só depois do consentimento -->
<script type="text/plain" data-cookieowl="analytics"
  src="https://www.googletagmanager.com/gtag/js?id=G-XXXXXXX"></script>
<script type="text/plain" data-cookieowl="analytics">
  window.dataLayer = window.dataLayer || [];
  function gtag() { dataLayer.push(arguments); }
  gtag('js', new Date());
  gtag('config', 'G-XXXXXXX');
</script>

<!-- Marketing: vídeo do YouTube com carregamento sob demanda -->
<iframe data-cookieowl="marketing" data-cookieowl-src="https://www.youtube-nocookie.com/embed/VIDEO_ID"
  width="560" height="315" title="Vídeo"></iframe>

After Aceitar todos, both scripts run in the order they appear, the second waiting for the first to load. With data-auto-block you are also covered for trackers that a plugin or a vendor snippet injects later, such as the Meta Pixel or Microsoft Clarity.

Revocation that is as easy as consent

Article 8, paragraph 5 is where many Brazilian sites fall short: the banner disappears forever after the first click. cookieowl keeps a small owl button in the corner that reopens the preferences, and you can add a link in the footer:

footer.html

<footer>
  <a href="/politica-de-privacidade">Política de privacidade</a>
  <a href="#" data-cookieowl-open>Configurar cookies</a>
</footer>

When a category is revoked, its cookies are erased and, if its scripts already ran on the page, the page reloads so they stop. The new choice is stored with the same consent id and a new timestamp.

Proof of consent and the encarregado

Because the controller has to prove consent, keep the records. Every choice produces a record with a random id, the policy version, the timestamp, the method (aceitar todos, rejeitar todos, personalizado or a browser signal) and the categories. Send it to your own endpoint with onConsent and keep it as long as your retention policy says.

The banner links to your privacy policy, and that page is where the rest of the LGPD transparency duties live: the identity of the controller, the contact of the encarregado (the data protection officer, article 41), the list of cookies and vendors, international transfers and how to exercise the rights of article 18.

Questions

Does the LGPD require a cookie banner?

The LGPD does not use the word banner, but when cookies collect personal data for purposes that rely on consent (analytics, advertising, profiling) you need consent that is free, informed and unambiguous, and the ANPD cookie guide describes a banner as the usual way to get it.

Can I use legitimate interest instead of consent for analytics?

Article 7, IX of the LGPD allows legitimate interest in some cases, and the ANPD guide discusses it for some cookies. For third party analytics and advertising most counsel still recommend consent, which is also what you need for visitors from the European Union.

Which language should the banner use for Brazilian visitors?

Portuguese. cookieowl picks pt-BR automatically when the page or the browser is in Portuguese and uses the LGPD wording, which cites Law 13,709/2018 and the right to revoke consent.

What are the LGPD fines?

Article 52 allows a warning, publication of the infraction, blocking or deleting the data and fines of up to 2 percent of the revenue in Brazil, limited to 50 million reais per infraction.

#What the LGPD asks of cookies

#Setup with one script tag

#Blocking what loads before the choice

#Revocation that is as easy as consent

#Proof of consent and the encarregado

#Questions

#Keep reading