The LGPD and GDPR cookie consent checklist

#Why a checklist and not a template

Most cookie banners fail the same way: they look right and do the wrong thing. The text says that nothing is tracked until you agree, while Google Analytics, a Meta Pixel and a heatmap have already loaded in the background. Regulators in Europe and the Brazilian ANPD now test banners by opening the browser network panel, not by reading the wording, so the questions below are about behavior first and words second.

The list follows the life of a visit. First, what happens before anyone clicks. Then the banner itself, the choices it offers and the records you keep. Each check says what to verify and how cookieowl handles it, so you can see where the library ends and your own work begins.

#The interactive checklist

Tick a check once you have verified it on your own site, ideally in a private window with the developer tools open on the Network tab. The list is stored in this browser with localStorage, so you can come back to it later.

#How to verify prior blocking in five minutes

Open your site in a private window so there is no stored choice. Open the developer tools, select the Network tab and reload. Filter by the domains of your vendors: google-analytics.com, googletagmanager.com, connect.facebook.net, clarity.ms, hotjar.com. Before you touch the banner there should be no request to any of them, except the Consent Mode pings if you chose advanced mode on purpose.

Then open the Application tab and look at the cookies of your domain. Only necessary cookies should exist: a session, a CSRF token, the load balancer and, after a choice, the consent cookie itself. If you see _ga, _fbp or _hjSession before clicking anything, a tracker escaped.

<head>
  <!-- 1. cookieowl first, without async or defer -->
  <script src="https://cdn.jsdelivr.net/npm/cookieowl@0.1.0/dist/cookieowl.js"
    data-policy-url="/privacy" data-consent-mode data-auto-block></script>

  <!-- 2. every tracker waits for its category -->
  <script type="text/plain" data-cookieowl="analytics"
    src="https://www.googletagmanager.com/gtag/js?id=G-XXXXXXX"></script>
</head>

Now click Accept all and watch the same panel: the tracker requests appear right away, in the order of your markup. Reopen the preferences, switch analytics off and save. The analytics cookies disappear and the page reloads, so the script that already ran is gone too.

#What regulators look at on the banner

The European data protection authorities wrote down their shared position in the 2023 report of the cookie banner taskforce, and the ANPD guide says much the same. The points that come back every time: a Reject option on the first layer whenever there is an Accept option, no pre-ticked boxes, no consent from scrolling or from closing the banner, colors and sizes that do not push one answer, and purposes described in plain words.

cookieowl ships Reject all and Accept all with the exact same class, so neither button is bigger or brighter. The third button opens the preferences, where every optional category starts off. The banner text names the law (the LGPD template for Portuguese, the GDPR template otherwise) and links to your policy when you set policyUrl.

#After the choice: withdrawal, expiry and versions

Consent is not a one time event. Article 7(3) of the GDPR and article 8, paragraph 5 of the LGPD both say that withdrawing must be as easy as consenting. In practice that means a visible way back on every page. cookieowl adds a small floating owl button and turns any element with data-cookieowl-open into a Cookie settings link.

Choices also age. A common practice is to ask again after twelve months, which is the default expiresDays. And when you add a vendor or a new purpose, the old consent no longer covers it: bump version and every visitor sees the banner again. Adding a new category to the configuration has the same effect automatically.

#Records you can show an auditor

Both laws put the burden of proof on you. The record cookieowl stores holds a random consent id, the policy version, a timestamp, the expiry, the method and every category, which is enough to answer when, how and to what a visitor agreed. Keep a copy on your side with the onConsent hook:

cookieowl.init({
  version: '2026-10',
  onConsent(record) {
    navigator.sendBeacon('/api/consent-log', JSON.stringify(record));
  },
});

Do not store more than you need in that log. The record has no IP address and no user agent on purpose; add them only if your legal basis and retention policy cover them.

#Questions

#Keep reading

Chapter IIA cookie consent banner for the LGPD, in Portuguese, that really blocksAdd an LGPD cookie banner in Portuguese that blocks trackers before consent, follows the ANPD cookie guide and lets visitors revoke consent at any time.8 min readChapter IIIWhat makes a cookie banner GDPR compliantWhat makes a cookie banner GDPR compliant: prior blocking, Reject on the first layer, no pre-ticked boxes, easy withdrawal and proof. With a free, open source setup.9 min readChapter VHow to block Google Analytics until consentHow to block Google Analytics 4 until cookie consent: hold gtag.js and the config as text/plain, catch injected tags with auto mode, and verify it in DevTools.7 min read