Join our webinar on democratizing data in the cloud with Forrester, Snowflake and TIAA - Sign up here

Start Now

When a person logs on to a website, the server assigns them a distinctive, user-specific identity. This identity is stored on the mobile or computer on which the browser is running. In case the user enters the website again, the browser sends cookie information to the server, allowing the website to remember the user.

In other words, cookies function as a kind of memory of the internet running through protocols that provide data flow. As sneaky as they can be, they were not created with malicious intent in mind. In 1994, Netscape Communications was developing an e-commerce application, and computer programmer Lou Montulli coined an idea which would hold great value to the e-commerce sector.

By remembering the information in the user's shopping cart, organizations can benefit from better user experience, and this is where cookies were used for the first time. With cookie consent becoming front and center, it is important for company websites that drop cookies or use other online tracking technologies to comply with various consent requirements.

In order to stay compliant, organizations need to have a cookie banner in place to obtain explicit, freely given consent to obtain these cookies. Failure to do so can lead to non-compliance amongst various data privacy laws.

In this article we will specifically address cookie consent under the LGPD and what organizations need to be careful about.

What is Cookie Consent under LGPD

The new data protection law of Brazil known as the LGPD (Lei Geral de Proteção de Dados Pessoais) will provide a comprehensive and overall regulatory framework which offers individuals with a set of rights which can be exercised. This is a huge upgrade from previous sectoral federal laws that offered partial protection. The LGPD is greatly influenced by the EU’s GDPR.

The LGPD contains sixty-five articles and was passed in August, 2018, sanctioned by President Bolsonaro in July 2019. The enforcement date for the LGPD is set to be August 15, 2020.

Under the LGPD, there are certain requirements with regards to cookie consent. LGPD requires organizations to take freely given consent before collecting consumer data. This can be done by implementing a cookie banner on your website. Under the LGPD, organizations need to make sure that the cookie banner should support the following:

    • Consent should be affirmative, specific and unambiguous
    • Details of the recipients and the data controller must be stated
    • Purpose of processing and notification of profiling must be clear
    • Ability to withdraw consent must be provided
    • Link to complain, correct and transfer data must be available
    • Ability to decline consent must be just as easy as granting consent

LGPD Cookie Banner Example

It is vital that data controllers provide consumers with the right to withdraw their consent. This option should be available in plain language and made clearly visible. In case a consumer wants to withdraw their consent, the data controller must provide the consumer with a free of charge procedure and facilitated procedure to revoke consent. if this is done, the controller cannot process data for which consent was previously given..

A compliant LGPD Cookie Banner requires:

    1. Consent must be specific, affirmative and unambiguous
    2. Identification of the data controller and recipient
    3. Documentation of purpose as well as notification of profiling
    4. Duration length
    5. Clear withdraw consent
    6. A link to complain, correct, and transfer data
    7. An option to decline

What is the correct way to use cookies in the LGPD?

Under article 5 of the LGPD defines consent as "free, informed and unambiguous manifestation whereby the data subject agrees to her/his processing of personal data for a given purpose.” This clearly states that LGPD requires opt-in consent, much like the GDPR. Before the consumers data is collected, the consumer must consciously give consent to the organization for storing cookies.

Although cookies have not been specifically addressed by the LGPD, it is possible to assume that the use of cookies is not prohibited and can be done if the following articles are respected:

    1. Article 3(III)
    2. Article 7(VI), (VIII), and (IX) of the Internet Law
    3. Principles of Processing
    4. One of the nine legal bases for processing

The LGPD has brought legal certainty with regards to a consumer's personal data, and the ANPD is responsible for providing the guidelines towards compliance as well as enforcing the laws under the LGPD. This includes defining and clarifying what constitutes as a controversial use of internet cookies.

Conclusion

A cookie banner is merely a script that you can embed into your website and it shows up as a banner when a user visits your website. Securiti is offering organizations a free cookie banner script that they can integrate into their website in mere seconds. This cookie banner has benefits such as:

    • Global Web Footprint: Highly optimized front-end for low-latency page performance for global traffic.
    • Configurable Cookie Banner: Customize and style the look & feel to align with your brand.
    • Global-Regulation Support: Reverse IP detection to present the appropriate compliance type for global compliance.
    • Maximize Optin Rate: Capture granular consent by processing purpose.
Scan your website and maintain LGPD/GDPR/CCPA compliant cookie consent - FREE

Provide a simple and secure way for your visitors to exercise their right to opt out of the sale of their information to advertisers.

With data collection exponentially increasing online, automation is necessary, now more than ever, for any organization that is hoping to comply with privacy regulations in a scalable way.

Securiti has created a free service that will enable organizations to simplify their cookie consent process and take a step in the right direction towards complying with privacy regulations all over the world.

Share this

Our Videos

View More
2:56

China’s PIPL

China has drafted its new data protection law, Personal Information Protection Law (PIPL) that will strengthen the regulatory framework for privacy and data protection in China.

Learn More
View More
3:03

South Africa’s POPIA

The video gives an overview of South Africa's Protection of Personal Information Act (POPIA).

Learn More
privacy policy and notice management View More
02:26

Dynamic Privacy Policies & Notices

Automatically Update & Refresh Your Policies and Notices

Learn More
View More
02:37

Universal Consent & Preference Management

Simplify and automate universal consent management

Learn More
View More
01:53

Cookie Consent Management

Automate and manage the entire consent life cycle with efficiency for various cookie compliance regulations around the world.

Learn More
View More
3:06

Sensitive Data Intelligence

Discover granular insights into all aspects of your privacy and security functions while reducing security risks and lowering the overall costs

Learn More