LGPD Cookie Banner: The Definitive Technical Implementation Guide

LGPD Cookie Banner: The Right Way to Implement

Implementing a cookie banner in compliance with the General Data Protection Law (LGPD) is a technical challenge that goes beyond simply displaying a notice on your website. Many businesses fail to meet legal requirements due to a lack of understanding of the technical demands, resulting in potential fines and loss of user trust. This post is your practical guide to implementing a cookie banner that truly protects data and complies with the law, addressing the technical aspects that most overlook.

Navigating data privacy regulations can seem complex, especially when legal guidelines don't detail the 'how-to.' The LGPD, for instance, doesn't have a specific article on cookies, but the National Data Protection Authority (ANPD) has made its expectations clear in its Guidance Document on Cookies and Personal Data Protection, published in October 2022. Here, we will focus on the essential technical nuances for compliance.

Key Points

• Understand the technical requirements of LGPD for cookies.
• Implement prior blocking and Google Consent Mode v2 correctly.
• Offer granular consent and clear action buttons.
• Ensure detailed consent logging.
• Know the prohibited practices and how to avoid them.

What Does the Law Say About Cookies and LGPD?

The LGPD establishes fundamental principles for the processing of personal data, which directly apply to the use of cookies. Although there isn't a specific article for cookies, the law requires that user consent be obtained freely, informedly, and unequivocally, as per Article 5, item XII. This means the user must have real control over what data is collected and for what purpose.

The withdrawal of consent must be as easy as granting it, as determined by Article 8, paragraph 5. Furthermore, information about cookie usage must be presented in clear and accessible language (Article 9), ensuring transparency. The principle of accountability (Article 6, item X) implies that you must be able to prove that consent was obtained validly.

Cookies That Do Not Require Consent

Not all cookies require explicit consent. Those strictly necessary for the website's functionality, such as session cookies (to keep the user logged in during navigation), security cookies (like CSRF – Cross-Site Request Forgery, which prevents attacks), and login cookies, can be used without prior approval. These are essential for the basic user experience and platform security.

Cookies That Require Consent

On the other hand, cookies used for purposes such as analytics (collecting browsing data for analysis), marketing (tracking for campaigns), personalization (remembering user preferences), and social embeds (social media widgets) require the user's informed consent. For these, the correct implementation of the banner is crucial.

Essential Technical Requirements Ignored by Many Banners

Compliance with LGPD goes beyond a generic notice. There are technical requirements that most Brazilian banners ignore. Implementing them correctly is what makes your banner truly effective and legal.

1. Prior Cookie Blocking

This is one of the most critical points. Prior blocking means that no non-essential cookies should be triggered in the user's browser before they give their consent. In the context of Google Consent Mode v2, this translates to starting with analytics_storage and ads_storage in the denied state. Only after explicit consent can these and other cookies be activated.

2. Granular Consent by Category

Offering only 'Accept All' or 'Reject All' options does not meet the requirement for free and informed consent. The user must be able to choose which categories of cookies they accept (e.g., only necessary ones, or necessary and marketing). This requires an interface that allows for this detailed selection.

3. Prominent Reject Button

The 'Reject' or 'Manage Preferences' button must have the same visual prominence as the 'Accept' button on the first layer of the banner. Hiding the reject option in a discreet link or making it less visible is a prohibited practice and undermines transparency.

4. Detailed Consent Logging

For accountability purposes, it is crucial to log consent robustly. This includes: the exact date and time of consent, the cookie categories the user accepted, an anonymous user identifier, the version of the implemented banner, and the user's hashed (encrypted) IP address. This log serves as proof of compliance.

Practices Prohibited by LGPD

There are common web practices that are explicitly forbidden by LGPD and ANPD guidelines:

• Pre-checked boxes: The consent option should never come pre-selected.
• Cookie Walls: Blocking access to the entire website content until the user accepts all cookies.
• Continuing to Browse as Acceptance: Simply browsing the site cannot be interpreted as consent.
• Intrusive Banners: Repeatedly presenting the banner until the user gives in, in a way that tires the visitor.
• Hidden Rejection: Hiding the reject button or link in a hard-to-access or difficult-to-see location.

Google Consent Mode v2: Technical Implementation

Google Consent Mode v2 is an essential tool for companies using Google products, such as Google Analytics and Google Ads. It allows Google to adjust tag behavior based on user consent. To implement prior blocking correctly, you must configure Consent Mode v2 so that analytics_storage and ads_storage (and others, depending on usage) start as denied. Only after explicit consent can these and other cookies be activated.

// Conceptual example of how Google Consent Mode v2 can be configured
// This should be integrated into your tag management system or code

window.dataLayer = window.dataLayer || [];

function gtag() {
  dataLayer.push(arguments);
}

gtag('consent', 'update', {
  'analytics_storage': 'denied',
  'ad_storage': 'denied',
  'personalization_storage': 'denied',
  // Add other categories as needed
});

gtag('consent', 'default', {
  'analytics_storage': 'denied',
  'ad_storage': 'denied',
  'personalization_storage': 'denied',
});

// When the user accepts, you update the consent:
function handleUserConsent(acceptedCategories) {
  const consentSettings = {
    'analytics_storage': acceptedCategories.includes('analytics') ? 'granted' : 'denied',
    'ad_storage': acceptedCategories.includes('marketing') ? 'granted' : 'denied',
    'personalization_storage': acceptedCategories.includes('personalization') ? 'granted' : 'denied',
    // ... other categories
  };
  gtag('consent', 'update', consentSettings);
}

This configuration ensures that, before consent, browsing data is not sent to Google for advertising or analysis purposes, respecting the user's decision.

Regulation and Penalties in Practice

It is important to be aware of the regulatory framework. Resolution CD/ANPD No. 2/2022 provides for simplified treatment for small-sized agents, but this does not exempt them from the obligation of consent. Penalties can be severe: Resolution CD/ANPD No. 1, of October 28, 2021, established the regulation for inspection and sanctioning processes, and Resolution CD/ANPD No. 4, of February 24, 2023, defined the dosimetry of fines. Infringing LGPD can result in fines of up to 2% of revenue, capped at R$ 50 million per infraction, as detailed in the official ANPD sources.

Frequently Asked Questions

What are strictly necessary cookies?

Strictly necessary cookies are those essential for the basic and secure functioning of a website. They ensure functionalities such as keeping the user logged in, protecting against fraud (CSRF), and enabling navigation. As they are indispensable for providing the service requested by the user, they generally do not require explicit consent under LGPD.

How to ensure consent revocation?

Withdrawing consent must be as easy as granting it. This means there should be a permanent and accessible link on all pages of the site, usually in the footer, that leads the user to an interface where they can manage their cookie preferences and revoke consent at any time. Avoid hidden links or complicated processes.

What is the difference between Google Consent Mode v1 and v2?

Consent Mode v1 allowed Google to adjust its tag behavior based on user consent preferences, but it was more basic. Google Consent Mode v2 introduces greater granularity and additional requirements for data collection, especially for compliance with regulations like the Digital Markets Act (DMA) in Europe, but its best practices are valuable globally. It requires consent for ad_storage and analytics_storage more explicitly and distinguishes between consent for advertising and personalization.

Do MEI and SMEs need a cookie banner?

Yes, all websites that use non-essential cookies need a cookie banner compliant with LGPD, regardless of the company's size. Resolution CD/ANPD No. 2/2022 offers simplified treatment for small-sized agents, which may reduce the complexity of some processes, but it does not exempt them from the need to obtain and log appropriate consent for cookies that affect data privacy.

What is a cookie wall?

A cookie wall is a practice where access to the main content of a website is blocked or severely restricted until the user accepts all cookies. The ANPD considers this practice abusive and prohibited, as it prevents the user from accessing the service without consenting to non-essential tracking, violating the principle of free and informed consent. The ideal approach is always to offer a clear alternative to refuse or manage preferences.

Conclusion

Implementing an effective LGPD cookie banner is a technical process that requires attention to detail, from prior blocking to granular consent logging. By focusing on these technical aspects, you not only comply with the law but also build a trusting relationship with your users. Invest time in the correct configuration, as compliance protects your business from fines and strengthens your reputation.

Start today by reviewing your banner's configuration and ensuring it meets all prior blocking and granularity requirements.