← ALL REGULATIONS
LGPD cookie consent for sites with visitors in Brazil.
Under Brazil’s LGPD, the ANPD’s cookie guide treats consent as the usual legal basis for non-essential cookies, with a clear option to reject them and nothing pre-ticked. Cookies that are necessary for the site can rely on other bases.
LGPD at a glanceOpt-in before tracking
- Applies to
- Processing in Brazil, of people in Brazil, or of data collected in Brazil, wherever the business is based
- In force
- September 2020, with sanctions since August 2021
- Enforced by
- ANPD, the National Data Protection Authority
- Guidance
- ANPD guide on cookies and personal data, 2022
- Penalties
- Up to 2% of revenue in Brazil, capped at R$50 million per violation
WHAT LGPD REQUIRES
What the ANPD expects from a cookie banner.
THE RULEConsent for non-essential cookiesThe ANPD’s guide expects consent for cookies that are not necessary for the service, and allows legitimate interest only after a careful assessment.
WITH KATLAChoose GDPR mode for the site: nothing outside the functional category is set until the visitor opts in. Auto mode treats timezones in the Americas as opt-out, which is weaker than the ANPD expects.
THE RULEA reject option, and nothing pre-tickedThe guide recommends a banner with an option to reject non-essential cookies, and treats pre-selected choices as invalid consent.
WITH KATLAAccept, Reject and Customise sit together on the first layer of the banner, and nothing is pre-selected.
THE RULEClear information for each categoryVisitors must be told the purpose of each category of cookies, in clear language, before they choose.
WITH KATLAKatla scans the site, classifies every cookie it finds and generates the cookie policy from that list, in 13 languages. The banner’s Portuguese is European Portuguese; there is no Brazilian Portuguese locale yet.
THE RULEProvable, and free to withdrawConsent must be provable, and the data subject can withdraw it at any time, free of charge.
WITH KATLAEach decision is stored with its categories, its time and a truncated IP address, and can be queried and exported through the API, CLI or MCP server. Katla keeps the latest decision per visitor. A floating settings icon, or your own "Cookie settings" link calling katla.open(), reopens the choice on any page.
LGPD questions, answered
A summary for website owners, not legal advice. Reviewed against the sources below.
- Does the LGPD require a cookie banner?
- The law does not name cookies, but the ANPD’s cookie guide expects consent for most non-essential cookies, and a banner is how sites collect it.
- Does the LGPD apply to companies outside Brazil?
- Yes, when they process the personal data of people in Brazil, offer goods or services to them, or collect the data in Brazil (Article 3).
- What are the LGPD fines?
- Up to 2% of the company’s revenue in Brazil in its previous financial year, limited to R$50 million per violation, alongside daily fines, publication of the violation and suspension of processing.
- Is the LGPD the same as GDPR?
- It is similar in structure, with consent, legitimate interest and data subject rights, but it has its own regulator, the ANPD, and its own guidance on cookies.
See what your site sets before anyone asks.
The free plan scans your site, classifies every cookie and generates the policy, without a card. The cookie checker needs no account at all.