LGPD (Brazil)
The law as we understand it on 5 November 2026. See the overview for what these pages are and are not.
What the law asks
Brazil's General Data Protection Law (LGPD, Law 13.709/2018) applies to processing in Brazil, of data collected in Brazil, or to offer goods or services to people in Brazil. The data protection authority (ANPD) explains how it applies to cookies in its guide "Cookies e proteção de dados pessoais" (October 2022).
Each cookie needs a legal basis from Article 7. The ANPD guide reads them like this:
- Strictly necessary cookies can rest on legitimate interest.
- Audience measurement (analytics) can rest on legitimate interest in some cases — when it only looks at aggregated patterns, is not combined with other tracking and is not used for profiling — with a way to object.
- Advertising cookies, third-party cookies, profiling and cross-site tracking hardly fit legitimate interest: consent is the appropriate basis.
Consent must be unequivocal and can be withdrawn at any time by a free and simple procedure (Article 8). The guide's banner advice:
- an easy-to-see button to reject all non-necessary cookies on the first and on the second layer, and a link for exercising rights;
- a second layer with categories, consent per purpose, and consent-based cookies off by default;
- to avoid: a single "OK" button, a less visible reject, cookies on by default, "continuing to browse means consent", consent tied to accepting all terms.
The ANPD enforces.
How ConnectWiz handles it
| The rule | In ConnectWiz |
|---|---|
| Reject all on the first and second layer | Reject all is on both layers, drawn exactly like Accept all. |
| Categories, consent per purpose, off by default | One row per category; every box starts empty. |
| Free and simple withdrawal | The cookie button stays on every page. |
| Proof of consent | Every choice is recorded. |
By default everything is denied in Brazil until the visitor chooses, the
same as everywhere. Brazil is not a locked region: if you rely on legitimate
interest for first-party, aggregated analytics, you can open analytics only
for BR with a region rule. The banner still
shows there, so visitors can refuse.
What you still need to do
- Decide your legal basis per category and write it in your privacy policy; if you use legitimate interest for analytics, document the balancing test and offer a way to object.
- Keep marketing on consent. Do not open marketing for Brazil with a region rule.
- Write your cookie policy in Portuguese; the ANPD lists a foreign-language policy among the things to avoid. The banner already speaks Portuguese (Brazil).