LGPD Compliance: Brazil's Data Protection Law, Handled
Brazil's LGPD reaches businesses worldwide that serve Brazilian visitors. ConsentPixel delivers geo-aware consent, documents, and audit-ready logs in one install.
Brazil's Lei Geral de Proteção de Dados (LGPD) governs how personal data of people in Brazil is collected and used — and it reaches businesses worldwide that serve Brazilian visitors. ConsentPixel — Privacy · Verified delivers geo-aware consent, auto-generated privacy documents, and audit-ready logs so LGPD compliance becomes a single pixel install.
What is the LGPD?
The Lei Geral de Proteção de Dados is Brazil's comprehensive privacy law, in force since 2020 and modeled closely on the EU's GDPR. It regulates the processing of personal data of individuals in Brazil and establishes the rights of data subjects and the duties of those who process their data.
The LGPD is enforced by the ANPD (Autoridade Nacional de Proteção de Dados). Like the GDPR, it is built around lawful bases for processing — consent being one of the most important for online tracking and marketing — and a set of strong individual rights.
For most websites, the practical core is this: if you use non-essential cookies, analytics, or advertising trackers on visitors in Brazil, you generally need a valid lawful basis (often consent) and you must be transparent about what you collect and why.
Who must comply
- Any organization that processes the personal data of individuals located in Brazil, regardless of where it's based.
- Businesses offering goods or services to people in Brazil, or processing data collected in Brazil.
- Both controllers and processors.
What the LGPD requires
- Lawful basis: Process only under one of the law's legal bases — consent, legitimate interest, legal obligation, and others.
- Consent: Where consent is the basis, it must be free, informed, and specific — and as easy to withdraw as to give.
- Transparency: Clearly inform individuals about your purposes and their rights.
- Data subject rights: Honor access, correction, deletion/anonymization, portability, and information about sharing.
- Security & accountability: Implement safeguards and be able to demonstrate compliance.
- International transfers: Meet the LGPD's transfer conditions.
The ANPD can impose warnings, corrective measures, and fines of up to 2% of a company's revenue in Brazil per violation, subject to a per-violation cap.
How ConsentPixel makes you LGPD-compliant
ConsentPixel — Privacy · Verified sits between your visitors and your trackers. It detects what's running, presents a geo-aware consent banner, enforces the visitor's choice, and keeps an immutable record of every decision. Here's how that maps to your obligations:Geo-aware consent banner. Brazilian visitors get a consent experience that captures free, informed, specific choices — and lets them withdraw consent as easily as they gave it.
Auto-detecting scanner finds every cookie and tracker on your site, so your disclosures and consent categories are complete and accurate — not guesswork.
Signal passthrough drives Google Consent Mode v2, Microsoft UET, Meta Pixel, and IAB TCF 2.3 from a single consent event, so every platform respects the same choice.
GPC honoring recognizes Global Privacy Control opt-out signals and applies them automatically.
Document generator auto-creates Privacy Policy, Cookie Policy, Terms, and DPA documents to support your transparency obligations.
Immutable, tamper-evident logs record every consent decision — audit-ready proof of what each visitor saw and chose.
One pixel, under 5 minutes. Everything above ships from a single pixel install, with a public trust badge and verification page.
Why ConsentPixel
- Auto-detection keeps your tracker inventory and disclosures accurate over time.
- One pixel handles consent, documents, and signal passthrough together.
- Audit-ready logs give defensible proof of consent and withdrawal.
- Multi-regulation: the same install also serves GDPR and US state laws — efficient for a global audience.
Frequently asked questions
Does the LGPD apply if my business is outside Brazil?
Yes, it can. The LGPD applies to processing the personal data of individuals located in Brazil and to organizations offering goods or services to people in Brazil, regardless of location.
Is consent always required under the LGPD?
No. Consent is one of several lawful bases. But for non-essential cookies, analytics, and advertising trackers, consent is commonly the appropriate basis, and ConsentPixel captures it properly when it applies.
How is the LGPD different from the GDPR?
The LGPD is closely modeled on the GDPR and shares many concepts, but has its own lawful bases, its own regulator (the ANPD), and its own penalty structure. A GDPR-ready setup is a strong starting point.
What are the penalties under the LGPD?
The ANPD can issue warnings, require corrective action, and impose fines of up to 2% of a company's revenue in Brazil per violation, subject to a cap.
Can visitors withdraw consent easily?
Yes. ConsentPixel lets visitors change or withdraw consent as easily as they gave it, which the LGPD requires, and logs the change.
The bottom line
If you've built for the GDPR, you're most of the way to the LGPD — but Brazil has its own lawful bases, regulator, and penalties. A geo-aware consent layer that captures free, informed, specific consent and logs every withdrawal is the practical foundation for serving Brazilian visitors lawfully.
Make LGPD compliance a one-pixel job
Install ConsentPixel to give Brazilian visitors compliant, geo-aware consent, generate your privacy documents, and keep audit-ready logs.
Scan your site free Start free trialThis page is informational and is not legal advice. The LGPD is a Brazilian federal law; consult qualified Brazilian counsel for advice on your specific obligations.