Under Brazil's General Data Protection Law (LGPD), consent is valid only when it is free, informed and unambiguous and given for a specific purpose. The controller must be able to prove it was obtained that way, generic authorisations are void, and the data subject can revoke consent at any time through a free and easy procedure. Sensitive data and children's data need consent that is also specific and prominent, and for children it comes from a parent.
Those rules sit in Articles 5, 8, 9, 11 and 14 of the LGPD's official text. Consent is one of the 10 legal bases in Article 7 and has no priority over the others, but for websites it is the one that decides what a cookie banner must do.
Four conditions make consent valid
Article 5(XII) defines consent as a free, informed and unambiguous expression of will by which the data subject agrees to the processing of their personal data for a given purpose. Silence and implied actions do not meet that standard: the person has to do something that shows agreement.
Being informed depends on what you show first. Article 9 gives data subjects easy access to clear, adequate and visible information about the purpose, form and duration of processing, the controller's identity and contact details, any data sharing, and their rights. If that information is misleading or abusive, or was not presented clearly and in advance, the consent is void under Article 9(1).
Consent must also be specific. Article 8(4) declares generic authorisations void, and Article 8(3) prohibits processing based on consent obtained through a defect such as error or coercion. Two later events can undo it:
- A change of purpose that the original consent does not cover, which you must announce in advance so the data subject can revoke consent (Article 9(2))
- Sharing with another controller, which needs specific consent for that sharing (Article 7(5))
The controller carries the burden of proof
Article 8(2) puts the burden of proving valid consent on the controller. A written consent clause must stand out from the other clauses of a contract (Article 8(1)), and online that translates into records.
The ANPD (Agência Nacional de Proteção de Dados, Brazil's data protection authority) calls it good practice to record and document everything needed to show that consent had no defect and came with all the required information. For a website, a usable record holds the date and time of the choice, the version of the banner text and policy shown, the categories accepted and rejected, and every later change. Consent records you can export, like the Kukie.io consent log, are built for that question.
Cookie consent under the ANPD's 2022 guide
The LGPD has no article on cookies. The ANPD filled the gap with its guide on cookies and personal data, published in October 2022, and it remains the authority's reference on banners as of October 2026.
The guide says consent is the most appropriate legal basis for non-necessary cookies, such as those used for advertising or behavioural profiles, and not appropriate for cookies strictly necessary for the site to work. It allows that some audience measurement can rest on legitimate interest instead: its own example is a public body whose statistics cookies produce aggregated, anonymous figures that are neither shared nor combined with other data.
On banner design the guide is specific. Pre-ticked boxes and consent by continued browsing are not compatible with the LGPD, a banner with a single "I agree" button does not give a free choice, and its model banner offers "Accept all cookies", "Reject all cookies" and "Manage cookies" in the same format and prominence, with consent-based cookies off by default. Withdrawing must work through a procedure as simple as the one used to agree.
Sensitive data and children's data need more
For sensitive personal data (racial or ethnic origin, religious belief, political opinion, trade union or religious, philosophical or political membership, health or sex life, genetic or biometric data), Article 11(I) requires consent given in a specific and prominent way, for specific purposes, by the data subject or their legal representative. The ANPD's guide suggests placing that authorisation apart from the main text and saying which sensitive data is collected and why.
Children's data follows Article 14. All processing of children's and adolescents' data must be in their best interest, but the parental consent rule in Article 14(1) applies to children only, meaning those under 12 under Brazilian law. At least one parent or legal guardian must give specific and prominent consent, the controller must make reasonable efforts with available technology to check it came from them, and the information must be simple enough for the child to understand. Adolescents (12 to 17) are covered by the best-interest rule, not by the parental consent requirement.
A second law now applies alongside. The Digital Statute of Children and Adolescents (Law 15.211 of 17 September 2025, the "Digital ECA") has been in force since 17 March 2026. It covers online products and services aimed at children and adolescents or likely to be used by them, wherever the provider is based, and its Article 22 prohibits profiling to target commercial advertising at children and adolescents.
| Data | Consent standard | Key requirement |
|---|---|---|
| Ordinary personal data | Free, informed, unambiguous (Article 5(XII)) | A specific purpose, as generic requests are void (Article 8(4)) |
| Sensitive personal data | Specific and prominent (Article 11(I)) | Separate from general terms, for specific purposes |
| Children's data (under 12) | Specific and prominent (Article 14(1)) | Given by at least one parent or legal guardian, with reasonable checks |
Revocation must be free and as easy as consent
Under Article 8(5), data subjects can revoke consent at any time by an express request, through a free and facilitated procedure. Processing carried out before the revocation stays valid unless the data subject also asks for erasure. Revocation ends the processing that relied on that consent (Article 15(III)), and the data is then deleted, except where Article 16 allows it to be kept, for example to meet a legal obligation.
Data subjects also have the right to revoke their consent alongside the right to know they can refuse it and what refusing means (Article 18(VIII)). On a website, that means a visible way to reopen the choice at any time, such as a link in the footer or a revisit button, and trackers that stop when consent is withdrawn.
Mistakes that undo LGPD consent
Most failures are not about the banner text. They come from how consent is used afterwards:
- Making data processing a condition of a product or service without saying so. Article 9(3) requires the data subject to be told prominently, along with how to exercise their rights.
- Passing consent-based data to partners without specific consent for that sharing (Article 7(5)).
- Forgetting the people you shared with. When a data subject has data corrected, erased, anonymised or blocked, Article 18(6) requires you to tell the agents you shared it with so they do the same, unless that is impossible or disproportionate.
- Keeping one broad consent for every future purpose, which Article 8(4) voids.
Getting it wrong has a price beyond fines. Under Article 42, a controller or processor that causes material, moral, individual or collective damage in breach of data protection law must compensate for it. Brazil's rules sit alongside many others on the privacy laws by region overview.
Short answers on LGPD consent
Can I use pre-ticked boxes for LGPD consent?
No. Consent must be an unambiguous expression of will, and the ANPD's 2022 cookie guide says pre-selected options and consent by continued browsing are not compatible with the LGPD.
Does consent last forever under the LGPD?
No. The data subject can revoke it at any time by an express request, through a free and facilitated procedure, and a change of purpose the consent did not cover requires telling them in advance.
What happens if my privacy policy is confusing?
Consent is void if the information given to the data subject is misleading or abusive, or was not presented beforehand in a transparent, clear and unambiguous way (Article 9(1)).
Do I need a parent's permission to process a teenager's data?
Not under the LGPD itself. Article 14(1) requires parental consent for children under 12. Adolescents' data must be processed in their best interest, and the Digital ECA (Law 15.211/2025) adds duties for online services likely to be used by them.
Can I ask for consent to process data for general, future uses?
No. Consent must refer to specific purposes, and generic authorisations for processing personal data are void under Article 8(4).
Keep proof of every choice your Brazilian visitors make
Because the burden of proof is yours, the record matters as much as the banner. Under an opt-in rule, the default for visitors from Brazil on new sites, Kukie.io shows a banner with equal Accept all and Reject all buttons, blocks non-necessary cookies until a visitor chooses and logs each consent record with the date, the banner version and the categories accepted.
