What should teams do about Cookies under the Brazil LGPD?
Teams should treat Cookies under the Brazil LGPD as a source-linked operating decision: confirm whether the issue affects controller/operator roles, lawful basis, data-subject rights, children data, international transfers, security incidents, DPO/encarregado duties, or ANPD enforcement exposure, assign the team that can change the process, and keep evidence showing the action and review trigger.
The safest first step is to identify the controller/operator role, purpose, lawful basis, data category, data-subject right, transfer, or incident trigger before assigning the LGPD action.
- Write the Cookies decision in one sentence before drafting controls.
- Attach the external source URL and a short source quote to the evidence record.
- Route unclear cases to legal, privacy, security, or compliance review before launch.
ANPD cookie guidance explains when cookies can collect personal data and how transparency, purpose limitation, consent, legitimate interest, and rights controls should be reflected in cookie banners and policies.
ANPD's announcement confirms the cookie guide is meant to support LGPD alignment for processing agents and transparent digital practices.
The current LGPD text supplies the principles, transparency duties, data-subject rights, and lawful-basis framework that ANPD applies to cookie and tracking technologies.