What should teams do about Cookies under the Brazil LGPD?
ANPD's 2022 cookie guide is non-binding guidance on how the binding LGPD principles, legal bases, transparency duties, consent conditions, and rights apply online. Its scope includes and similar tracking technologies on websites, applications, phones, and tablets when personal data is collected.
Start with a technical scan and owner interview. Separate from , and classify each item by first or third party, session or persistent duration, and purpose: authentication or requested functionality, preferences, audience measurement, advertising, profiling, or another stated use.
Choose the legal basis only after classification. Legitimate interest may fit a necessary authentication or shopping-cart cookie, or limited audience measurement using aggregate data without third-party sharing, cross-service combination, or user profiles. The test remains fact-specific. ANPD says legitimate interest will generally be difficult to support for third-party advertising, cross-site tracking, preference prediction, or behavioral profiles; consent is usually more appropriate in those examples.
Where consent is the basis, the visitor needs a real and informed choice. Do not infer consent from continued browsing, silence, or preselected settings. Keep consent-based off until an affirmative choice, make rejecting all as easy to find as accepting them, permit purpose-level choices, and provide a free, simple withdrawal route comparable to the consent route.
- Owner: inventory each cookie or tracker by name, provider, first- or third-party status, purpose, data, duration, recipients, service necessity, legal basis, and transfer destination.
- Privacy and product: document the Article 7 or 11 basis, any legitimate-interest test, the notice and banner design, retention rule, data-subject channel, and approval.
- Engineering: test a clean session for no consent, accept all, reject all, purpose-level selection, later withdrawal, expiry, and tag-manager changes; record the and outbound requests observed in each state.
- Reassess after a new vendor, tag, purpose, recipient, retention period, cross-site combination, profile use, or sensitive-data inference. A change to the premises of consent requires a new valid basis and, where consent remains the basis, a new choice.
ANPD cookie guidance explains when cookies can collect personal data and how transparency, purpose limitation, consent, legitimate interest, and rights controls should be reflected in cookie banners and policies.
ANPD's announcement confirms the cookie guide is meant to support LGPD alignment for processing agents and transparent digital practices.
The current LGPD text supplies the principles, transparency duties, data-subject rights, and lawful-basis framework that ANPD applies to cookie and tracking technologies.