Cookies and Consent: How a Website Must Handle Visitor Data

This page is a translation of the original Portuguese text, provided for convenience. It deals with Brazilian law. If there is any discrepancy, the Portuguese version prevails. Read the original in Portuguese

Tracking users through cookies is a form of personal data processing and is subject to Brazil’s General Personal Data Protection Law. To comply, websites must obtain valid consent before installing non-essential cookies, be transparent about their purposes, and give visitors an effective way to refuse.

Cookies as personal data: the legal framework

Cookies are small text files stored in a user’s browser to record preferences, login sessions, browsing behavior, and other settings. When they are tied to an identifiable individual, they become personal data within the meaning of Article 5, item I, of Law 13.709/2018, and the full protection regime of that law applies to them.

The distinction that matters legally is between strictly necessary cookies and non-essential cookies. The former keep the site working technically, as with authentication and session security, and do not require consent, because the processing rests on the legal basis of contract performance or on properly documented legitimate interest. All the others, such as analytics, behavioral advertising, and personalization cookies, may be installed only with the visitor’s prior, free, informed, and unambiguous consent.

The Marco Civil da Internet (Law 12.965/2014), Brazil’s internet civil rights framework, had already established respect for privacy as a foundation of internet use in Brazil. The LGPD (Brazil’s General Personal Data Protection Law) deepened that requirement by demanding a specific legal basis for each processing operation, including the simple reading of cookies by third-party scripts embedded in a site’s pages.

Valid consent: requirements the law does not relax

Article 8 of the LGPD provides that consent must be given in a free, informed, and unambiguous manner. For cookies, this means a banner or preference panel cannot use pre-checked boxes, and it cannot bury the option to refuse in secondary menus or display it with reduced visual contrast. Accepting and refusing must be equally easy. Otherwise, the consent obtained is invalid.

Blanket consent, which lumps every category of cookie into a single acceptance without distinguishing their purposes, violates the granularity required by the purpose principle in Article 6, item I, of the LGPD. Visitors must be able to accept only analytics cookies, for example, without having to authorize advertising trackers. This separation by category is the practical expression of the principle of adequacy between the data collected and the stated purpose.

A banner that covers the screen and offers only an “Accept all” button is not a request for consent. It is digital coercion, and the LGPD does not allow it.

Another frequently overlooked requirement is documenting the consent. The controller must be able to show that consent was validly obtained, with a record of the date, the version of the cookie policy in force, and the categories the user accepted. Without that record, the presumption in an administrative or civil dispute runs against the website.

The controller’s obligations and the risks of noncompliance

The party responsible for the website must prepare and publish a clear cookie policy, written in accessible language and updated whenever the purposes of collection change. The policy must identify which cookies are used, their purposes, the retention period and, where applicable, the third parties that will receive the data generated by tracking, including advertising platforms and external analytics tools.

Withdrawing consent must be as simple as giving it. Paragraph 5 of Article 8 of the LGPD is explicit: the data subject may revoke consent at any time by express statement, without any detriment. Sites that let users revoke cookies only through advanced browser settings, without offering their own management panel, do not meet this requirement and expose the controller to liability.

Penalties for violating the consent rules for cookies range from a warning with a deadline to come into compliance, up to a fine of 2% of the legal entity’s revenue in its last fiscal year, capped at fifty million reais per violation, under Article 52 of the LGPD. In addition to the administrative penalties imposed by Brazil’s National Data Protection Authority, the harmed data subject may seek damages in civil court under Article 42 of the same law, which considerably increases the controller’s legal exposure.

Frequently Asked Questions

Does every website, regardless of size, have to display a cookie banner?

The obligation arises from the use of cookies that process personal data, not from a website’s size or revenue. A personal blog that embeds code from a traffic analytics platform is already processing visitors’ personal data and must ask for consent before installing those cookies. The LGPD provides no exemption for microenterprises or individuals when the processing involves third parties’ data, even if the number of visitors is small.

Can a visitor withdraw consent for cookies after giving it?

Yes. This is a right guaranteed by Article 8, paragraph 5, read together with Article 18, item IX, of the LGPD. The site must offer an accessible way to revoke consent, such as a cookie preference panel reachable from any page. After revocation, the controller must stop any processing based on that consent and, to the extent technically feasible, delete the data already collected, subject to any legal retention period that may apply.

What are the legal consequences for a website that ignores the consent rules for cookies?

Noncompliance can lead to administrative penalties imposed by the ANPD (Brazil’s National Data Protection Authority), including a warning, public disclosure of the violation, blocking of the data involved, and a fine of up to 2% of annual revenue, capped at fifty million reais per violation. On the civil side, a data subject who can show concrete harm from the unlawful processing may demand compensation under Article 42 of the LGPD, regardless of the outcome of the administrative proceedings. There is also the risk of a class action brought by consumer protection organizations or by the Public Prosecutor’s Office when the violation affects a significant number of users.

— 17/05/2026, 13h00min

As informações deste artigo são de caráter informativo e não substituem consulta jurídica individualizada. Cada caso possui particularidades que exigem análise específica.