What the LGPD requires
- Have a lawful basis for each cookie that collects personal data. For most non-essential cookies, such as advertising cookies, this is consent that is free, informed and unambiguous and given for a specific purpose.
- Give people clear, easy-to-find information on the purpose and duration of processing, who you share data with and their rights. The ANPD advises against giving cookie information only in a foreign language.
- Let data subjects access, correct, delete and port their data.
- Appoint a data protection officer (encarregado) and publish their identity and contact details. Some small businesses may offer a contact channel instead.
- Notify the ANPD and the people affected within three working days of learning of a security incident that may cause them significant risk or harm.
- Keep a record of consents and processing activities you can show on request.
What the banner does here
The same opt-in mode as in the EU and UK: non-essential cookies are blocked until the visitor chooses, with Reject all beside Accept all at the same size, and no pre-ticked boxes.
How GrantCookie covers it
- Scheduled scans. The scanner finds the cookies and trackers your site sets, sorts them into categories and re-checks on every scheduled scan, so the banner asks about what is really there.
- Provable records. Every choice is timestamped and stored with the banner version the visitor saw. Paid plans include consent log export.
- Withdrawing consent. A re-open control stays on every page, so visitors can withdraw or change their choice at any time.
This page is general guidance. It is not legal advice. Check your specific obligations with a qualified adviser.