LGPD stands for Lei Geral de Proteção de Dados, Brazil's General Data Protection Law (Law No. 13.709/2018). It is Brazil's first comprehensive data protection law, it applies to any organisation that processes the personal data of people in Brazil wherever the organisation is based, and it is enforced by the ANPD. For websites, the LGPD means a valid legal basis for every use of personal data and, under the ANPD's guidance, consent before non-necessary cookies are set.
The law was enacted on 14 August 2018, entered into force on 18 September 2020, and its sanctions have applied since 1 August 2021. It was modelled on the EU's General Data Protection Regulation (GDPR) but is not a copy: it has ten legal bases instead of six, its own fine ceiling and its own rules on transfers. The consolidated text on Planalto, the Brazilian presidency's legislation site, is the reference for every article cited below.
LGPD at a glance
Before the LGPD, Brazilian data protection was spread across sector laws such as the Consumer Defence Code and the Marco Civil da Internet. The LGPD set one framework for the public and private sectors, online and offline.
The law is enforced by the ANPD, now the Agência Nacional de Proteção de Dados (National Data Protection Agency). Law 15.352 of 25 February 2026 made it a regulatory agency with functional, technical, decision-making, administrative and financial autonomy (Article 55-A). The ANPD issues regulations, supervises and imposes sanctions.
The LGPD from enactment to 2026
Who the LGPD applies to
Under Article 3, the LGPD applies to any person or organisation, public or private, that processes personal data, wherever it is based and wherever the data is stored, when at least one of these is true:
- The processing takes place in Brazil
- The processing aims to offer or supply goods or services to people in Brazil, or processes the data of people located in Brazil
- The personal data was collected in Brazil, meaning the person was in Brazil when it was collected
This extraterritorial reach is similar to the GDPR's. If your website serves visitors in Brazil, sets cookies on their devices or collects their form submissions, the LGPD applies. The location of your servers or your headquarters does not change that.
Article 4 excludes processing by individuals for purely private, non-economic purposes, processing for exclusively journalistic or artistic purposes, and processing for public security, national defence, state security or criminal investigations. Academic processing is excluded in part, but Articles 7 and 11 on legal bases still apply to it.
What counts as personal data
Article 5 defines personal data as information related to an identified or identifiable natural person. Names, email addresses and ID numbers qualify, and so do IP addresses, device identifiers, cookie IDs and behavioural profiles that can be linked back to a person.
The law also creates a category of sensitive personal data: racial or ethnic origin, religious belief, political opinion, trade union or religious, philosophical or political membership, health or sex life, and genetic or biometric data. Sensitive data has its own, shorter list of legal bases in Article 11. Legitimate interest and protection of credit are not on it, and contracts appear only as part of the regular exercise of rights.
Anonymised data falls outside the LGPD, but only if the anonymisation cannot be reversed with reasonable technical means available at the time. Pseudonymised data is still personal data.
Ten legal bases instead of six
The GDPR has six lawful bases. The LGPD has ten legal bases in Article 7, with no hierarchy between them.
| Legal basis (Article 7) | What it covers | For sensitive data (Article 11)? |
|---|---|---|
| Consent | Free, informed and unambiguous agreement for a specific purpose | Yes, specific and prominent consent |
| Legal or regulatory obligation | Processing required by law or regulation | Yes |
| Public policy | Public policies carried out by the public administration | Yes |
| Research | Studies by research bodies, anonymised where possible | Yes |
| Contract | Performing or preparing a contract the data subject asked for | Only as the exercise of rights in a contract |
| Exercise of rights | Judicial, administrative or arbitration proceedings | Yes |
| Protection of life | Protecting the life or physical safety of the data subject or a third party | Yes |
| Protection of health | Procedures by health professionals, health services or health authorities | Yes |
| Legitimate interest | The controller's or a third party's interests, unless the data subject's rights prevail | No |
| Protection of credit | Credit protection, including under credit legislation | No |
Protection of credit has no GDPR equivalent and reflects Brazil's credit-scoring framework. For cookies and tracking, consent and legitimate interest are the two bases that matter, and Article 11 adds one more option for sensitive data only: fraud prevention and the data subject's security in identification and authentication.
Cookie consent under the LGPD
The LGPD has no separate cookie rule like the EU's ePrivacy Directive. Cookies that identify or profile people, such as _ga or _fbp, involve personal data, so they need a legal basis like any other processing.
The ANPD's guide on cookies and personal data, published in October 2022, sets out how. As of October 2026 it is still the authority's reference on the subject. Its main points:
- Consent is not the appropriate basis for strictly necessary cookies, such as a session cookie like
PHPSESSIDthat keeps a cart alive. Those can rest on another basis, for example legitimate interest. - Consent is the most appropriate basis for non-necessary cookies such as advertising and behavioural profiling. The guide also accepts legitimate interest for some audience measurement that produces aggregated, anonymous statistics and is not shared.
- A banner should offer accept, reject and manage options with the same format and prominence, and consent-based cookies must be off by default. Pre-selected options and consent by continued browsing are not compatible with the LGPD.
- Withdrawing consent must be as simple as giving it, through a direct mechanism on the site, not only the browser's settings.
- Among the practices to avoid, the guide lists presenting cookie policy information only in a foreign language, so a site aimed at Brazilian visitors needs it in Portuguese.
The LGPD consent requirements article covers the general consent rules behind these points.
What the banner looks like in practice
A first layer that names the purposes, offers Accept all and Reject all with equal weight and links to a cookie policy in Portuguese. A second layer where visitors switch categories on and off, all optional ones off until chosen. A link or button on every page to reopen the choice. With geo-targeting rules, visitors from Brazil can see that version while visitors elsewhere see the banner their own rules call for.
Data subject rights
Article 18 gives individuals a list of rights they can exercise at any time on request, free of charge:
- Confirmation that processing exists, and access to the data
- Correction of incomplete, inaccurate or outdated data
- Anonymisation, blocking or deletion of unnecessary, excessive or unlawfully processed data
- Portability to another provider, under ANPD rules
- Deletion of data processed with consent, except where the law allows it to be kept
- Information about who the data was shared with
- Information about the option to refuse consent and what refusing means
- Revocation of consent
Article 20 adds the right to ask for a review of decisions made solely by automated processing, including profiling. Under Article 19, a simplified confirmation or access is given immediately and a full statement within 15 days. The right to be told what happens if you refuse consent has no direct GDPR equivalent.
Enforcement and penalties
The ANPD spent its first years building the regulatory base, including its sanctions dosimetry regulation, Resolution CD/ANPD No. 4 of 24 February 2023, which sets how fines are calculated. Its first fine, in 2023, went to a small telemarketing company, and it has since sanctioned public bodies and acted against large platforms, including over the use of Brazilian users' data to train AI. The LGPD enforcement article covers the cases in detail.
Article 52 lists the sanctions in force:
- A warning, with a deadline for corrective measures
- A simple fine of up to 2% of the company's or group's revenue in Brazil in its last financial year, excluding taxes, capped at R$50 million per infringement
- A daily fine, within the same cap
- Publication of the infringement once confirmed
- Blocking or deletion of the personal data involved
- Partial suspension of the database for up to 6 months, renewable once
- Suspension of the processing activity for up to 6 months, renewable once
- A partial or total ban on processing activities
Public bodies can receive warnings, publication, blocking, deletion, suspensions and bans, but not fines (Article 52(3)). Beyond the ANPD, individuals and consumer bodies can bring claims under the Consumer Defence Code, and courts can award damages under Article 42.
LGPD and GDPR side by side
If you already follow the GDPR, most of the LGPD will feel familiar. The differences that matter for a website:
| Area | GDPR | LGPD |
|---|---|---|
| Legal bases | 6 | 10, adding research, health protection, credit protection and public policy among others |
| Data protection officer | Required in specific circumstances | Required for controllers, with an exemption for small processing agents (Resolution CD/ANPD No. 2/2022) |
| Breach notification | 72 hours to the supervisory authority | 3 working days to the ANPD and data subjects |
| Maximum fine | EUR 20 million or 4% of worldwide turnover | R$50 million per infringement or 2% of revenue in Brazil |
| Transfers to the other side | Brazil adequate since January 2026 | EU adequate since January 2026 |
The DPO duty is broader than under the GDPR. Article 41 asks every controller to appoint one, called the encarregado, and to publish their contact details. Small processing agents without high-risk processing are exempt under Resolution CD/ANPD No. 2/2022, provided they offer another channel for data subjects.
International data transfers
Article 33 limits transfers of personal data out of Brazil. The ANPD's international transfer regulation, Resolution CD/ANPD No. 19 of 23 August 2024, introduced Brazil's own standard contractual clauses, which organisations had to adopt by 23 August 2025 for transfers based on them.
Since 26 January 2026, transfers between Brazil and the EU need no extra mechanism. The ANPD's Resolution CD/ANPD No. 32 recognises the EU as providing adequate protection, and the European Commission's list of adequacy decisions now includes Brazil. For other destinations, the ANPD's standard clauses remain the usual route. The LGPD international transfers article covers the mechanisms in detail.
What changed in 2026
Three changes stand out. The ANPD became a regulatory agency under Law 15.352. The mutual adequacy decisions with the EU took effect in January 2026. And the Digital Statute of Children and Adolescents (Law 15.211/2025, the "Digital ECA") has applied since 17 March 2026. It covers online products and services aimed at children and adolescents or likely to be used by them, wherever the provider is based, requires parental supervision tools and age-appropriate settings, and bans profiling to target commercial advertising at children and adolescents (Article 22).
The ANPD's regulatory agenda for 2025 to 2026 continues to add rules, so check its list of regulations before relying on any guide written earlier. Brazil sits alongside other countries on the privacy laws by region overview.
Practical steps for website owners
- Scan your site to find every cookie and tracker, including those added by Google Analytics 4, Meta Pixel and embedded videos.
- Sort the cookies into strictly necessary ones, which do not need consent, and the rest, which need opt-in consent from Brazilian visitors before they are set.
- Set up a banner with equal accept and reject options, optional categories off by default, a way to reopen the choice, and its text and cookie policy in Portuguese.
- Appoint an encarregado, or check whether you qualify as a small processing agent, and publish the contact details on your website.
- Review your privacy policy against Articles 9 and 18, and check the legal basis for each transfer of personal data out of Brazil.
Questions about the LGPD
What does LGPD stand for?
Lei Geral de Proteção de Dados, Portuguese for General Data Protection Law. It is Brazil's Law No. 13.709/2018.
Does the LGPD apply to websites outside Brazil?
Yes. If your website processes the personal data of people located in Brazil, or offers goods or services to people in Brazil, the LGPD applies wherever your business is based.
Do I need a cookie consent banner for Brazilian visitors?
If your site uses non-necessary cookies such as analytics or advertising trackers, the ANPD's 2022 cookie guide points to consent before they are set, with equal options to accept or reject and optional cookies off by default.
What is the maximum fine under the LGPD?
A simple fine of up to 2% of the company's or group's revenue in Brazil in its last financial year, excluding taxes, capped at R$50 million per infringement. Daily fines are possible within the same cap.
Can I use legitimate interests instead of consent for cookies under the LGPD?
For strictly necessary cookies, and in the ANPD's guide for some aggregated audience measurement. For advertising and behavioural profiling, the guide says consent is the most appropriate basis.
Does my cookie banner need to be in Portuguese for Brazil?
For a site aimed at Brazilian visitors, in practice yes. The ANPD's cookie guide lists presenting cookie policy information only in a foreign language among the practices to avoid, and consent must be informed.
What happens if I transfer personal data from Brazil to another country?
You need a mechanism under Article 33. Since 26 January 2026, transfers to the EU need none beyond the adequacy decisions. For other countries, the ANPD's standard contractual clauses, mandatory for transfers based on them since 23 August 2025, are the usual route.
Give Brazilian visitors their own banner
Kukie.io shows each region the banner its rules call for. Under an opt-in rule, the default for visitors from Brazil on new sites, they get Accept all and Reject all side by side and non-necessary cookies blocked until they choose. The text can be in Brazilian Portuguese, one of more than 70 banner languages, once you add it in the Banner Editor.
