Website Cookie Notices: What They Must Include to Be Valid Under Brazil’s LGPD

This page is a translation of the original Portuguese text, provided for convenience. It deals with Brazilian law. If there is any discrepancy, the Portuguese version prevails. Read the original in Portuguese

Cookie collection on Brazilian websites is no longer a technical footnote. It now sits at the center of enforcement of Brazil’s General Data Protection Law (LGPD). Tracking cookies, behavioral advertising cookies, and third-party analytics cookies may operate only after the visitor gives free, informed, and specific consent. Cookies that are strictly necessary for the page to work remain exempt from that requirement. Understanding exactly where that line falls is what separates a legally valid cookie banner from an open invitation to an enforcement action.

Which cookies require the user’s specific consent

The deciding factor is not the name of the cookie but the purpose of the data processing it makes possible. Whenever a cookie is used to monitor a person’s behavior, build profiles, or feed third parties information about browsing activity, prior consent becomes mandatory. This requirement follows directly from the legal basis that applies to that type of processing.

Tracking cookies fall into this category. They record pages visited, time spent, clicks, and the user’s path through the site and, often, across different sites. Because they make it possible to reconstruct an individual’s habits, they require an affirmative act of consent before any data is captured.

Behavioral advertising cookies go further: they cross-reference browsing data to display ads targeted to inferred interests. Because they intrude significantly on a person’s private sphere, they call for granular, clearly presented consent, never consent presumed from the mere act of visiting the page.

There are also third-party analytics cookies, installed by external audience-measurement tools. When these services receive identifiers capable of singling out the visitor, or combine data across different clients, they stop being merely statistical and require specific authorization, with clear information about who receives the data and for what purpose.

Which cookies are exempt from consent

Not every cookie needs authorization. Strictly necessary cookies, those without which the site cannot function, do not require consent because they support a service the user has expressly requested. Their legal basis is not consent but performance of what the visitor asked for by accessing the page.

This group includes session cookies that keep a login active, cookies that hold items in a shopping cart, cookies responsible for load balancing between servers, and cookies that store basic security preferences during browsing. Without them, the requested functionality simply cannot be delivered.

The exemption, however, is narrow and cannot be used as a shortcut. Labeling a cookie as necessary when in practice it feeds marketing or audience measurement is a misuse of purpose and weakens the entire privacy policy. A good rule is to reserve that label for what is technically indispensable.

Even when exempt from consent, these cookies do not escape the duty of transparency. Users have the right to know that they exist, what function they serve, and how long they remain stored. That information must appear in the site’s cookie policy in an accessible and understandable form.

This distinction between necessary and ancillary purposes shapes the entire architecture of a compliant cookie banner. Once you master it, you can build coherent layers of choice, offering acceptance by category and honoring refusals without impairing the essential browsing experience.

The exemption, however, is narrow and cannot be used as a shortcut.

What the consent record must contain for an audit by the ANPD (Brazil’s National Data Protection Authority)

Obtaining consent is only half of the obligation. The other half is being able to show, later on, that it was collected validly. The burden of proving consent falls on the data controller, and the consent record is precisely what provides that proof in the face of an inspection.

A robust consent record should store the session or user identifier, the exact date and time of the consent, and the categories of cookies actually accepted and declined. Without this category-by-category detail, it is impossible to prove that the choice was genuinely granular.

The record must also preserve the version of the banner and of the informational text in effect at the time of acceptance. Because privacy policies change over time, tying each consent to the wording presented at that moment shows that the person was informed about exactly what they authorized.

It is also advisable to store evidence of the mechanism used, that is, proof that acceptance required an affirmative action and that refusal was equally possible and simple. Together, these elements allow the consent to be reconstructed if the authority questions the integrity of the process.

Most common mistakes and the risk of enforcement action

The most frequent mistake is replacing prior consent with an opt-out approach, in which cookies fire as soon as the page loads and the user has to turn them off afterward. This model reverses the rule: processing begins without authorization, which strips consent of its character as a prior and free expression of will.

Another recurring error is the pre-checked box, with the acceptance option already ticked by default. Valid acceptance presupposes active conduct by the person. A box that is already filled in reflects not real intent but inertia, and so it does not produce legally effective consent.

Lack of granularity rounds out the three most common failures. Banners that offer only an “accept all” button, with no choice by category and no refusal on equal footing, take away the control the law was meant to guarantee and leave the collection open to challenge.

These defects have concrete consequences. The law provides for sanctions ranging from a warning, with a deadline to correct the problem, to a fine of up to two percent of the group’s revenue in Brazil, capped at fifty million reais per violation, as well as public disclosure of the penalty and blocking of data processed unlawfully.

The safe path combines three measures: block unnecessary cookies until the user accepts, offer a choice by category with simple refusal, and keep an auditable record of every consent. Periodically reviewing the banner and the cookie policy in light of the authority’s guidance keeps the site aligned with the law and significantly reduces exposure to penalties.

Frequently Asked Questions

Does a banner that offers only an accept button comply with the law?

No. A banner that presents only an “accept all” option, with no equivalent way to refuse or to choose by category, fails the requirement of free and granular consent. A person must be able to say no as easily as they say yes, and unnecessary cookies must remain inactive until a choice is made.

Do analytics cookies always require consent?

It depends on how they operate. When audience measurement is carried out by third parties that receive identifiers capable of singling out the visitor, or that cross-reference data across different clients, specific consent is required. In-house measurement solutions configured so that they do not identify the individual, by contrast, tend to allow more flexible treatment, always accompanied by transparency about the purpose.

How long must the consent record be kept?

The record must be kept for as long as the processing based on that consent lasts and for a reasonable period after consent is withdrawn, so that it can be proven if the authority questions the collection. Good practice is to preserve the full history of grants and withdrawals, with the date, categories, and banner version, so you can support an audit trail at any time.

As informações deste artigo são de caráter informativo e não substituem consulta jurídica individualizada. Cada caso possui particularidades que exigem análise específica.