In this article we will specifically address cookie consent under the LGPD and what organizations need to be careful about.
What is Cookie Consent under LGPD
Tracking technologies such as cookies, pixels, and tags are commonly used by websites for marketing campaigns and data collection. To comply with LGPD cookie regulations, website owners must take responsibility for informing users and obtaining their consent for the use of these technologies.
The new data protection law of Brazil known as the LGPD (Lei Geral de Proteção de Dados Pessoais) will provide a comprehensive and overall regulatory framework which offers individuals with a set of rights which can be exercised. This is a huge upgrade from previous sectoral federal laws that offered partial protection. The LGPD is greatly influenced by the EU’s GDPR.
The LGPD contains sixty-five articles and was passed in August, 2018, sanctioned by President Bolsonaro in July 2019. The enforcement date for the LGPD is set to be August 15, 2020.
Under the LGPD, there are certain requirements with regards to cookie consent. LGPD requires organizations to take freely given consent before collecting consumer data. This can be done by implementing a cookie banner on your website. Under the LGPD, organizations need to make sure that the cookie banner should support the following:
- Consent should be affirmative, specific and unambiguous
- Details of the recipients and the data controller must be stated
- Purpose of processing and notification of profiling must be clear
- Ability to withdraw consent must be provided
- Link to complain, correct and transfer data must be available
- Ability to decline consent must be just as easy as granting consent
LGPD Cookie Banner Example
It is vital that data controllers provide consumers with the right to withdraw their consent. This option should be available in plain language and made clearly visible. In case a consumer wants to withdraw their consent, the data controller must provide the consumer with a free of charge procedure and facilitated procedure to revoke consent. if this is done, the controller cannot process data for which consent was previously given..
A compliant LGPD Cookie Banner requires:
- Consent must be specific, affirmative and unambiguous
- Identification of the data controller and recipient
- Documentation of purpose as well as notification of profiling
- Duration length
- Clear withdraw consent
- A link to complain, correct, and transfer data
- An option to decline
What is the correct way to use cookies in the LGPD?
Under article 5 of the LGPD defines consent as "free, informed and unambiguous manifestation whereby the data subject agrees to her/his processing of personal data for a given purpose.” This clearly states that LGPD requires opt-in consent, much like the GDPR. Before the consumers data is collected, the consumer must consciously give consent to the organization for storing cookies.
Although cookies have not been specifically addressed by the LGPD, it is possible to assume that the use of cookies is not prohibited and can be done if the following articles are respected:
- Article 3(III)
- Article 7(VI), (VIII), and (IX) of the Internet Law
- Principles of Processing
- One of the nine legal bases for processing
The LGPD has brought legal certainty with regards to a consumer's personal data, and the ANPD is responsible for providing the guidelines towards compliance as well as enforcing the laws under the LGPD. This includes defining and clarifying what constitutes as a controversial use of internet cookies.
Conclusion
A cookie banner is merely a script that you can embed into your website and it shows up as a banner when a user visits your website. Securiti is offering organizations a free cookie banner script that they can integrate into their website in mere seconds. This cookie banner has benefits such as:
- Global Web Footprint: Highly optimized front-end for low-latency page performance for global traffic.
- Configurable Cookie Banner: Customize and style the look & feel to align with your brand.
- Global-Regulation Support: Reverse IP detection to present the appropriate compliance type for global compliance.
- Maximize Optin Rate: Capture granular consent by processing purpose.
