What is the same
Both expect consent before non-essential cookies, a real choice to refuse, no pre-ticked boxes, clear information about purposes and an easy way to withdraw consent.
A banner built well for the GDPR is most of the way to the LGPD.
Brazil and the EU, side by side
LGPD vs GDPR for cookies
The LGPD and the GDPR ask almost the same of a cookie banner. Here is what changes for a site that serves both Brazil and Europe, point by point.
Run a free scan
No credit card required · Instant insights
Live scan · What CookieInspector capturesEvidence-based
Page load0.00s
Signals captured0.42s
Banner shown1.10s
Report ready—
Cookies & local storagecaptured
Third-party scriptsflagged
Consent signalsverified
Network requestslogged
| For a cookie banner | LGPD (Brazil) | GDPR + ePrivacy (EU) |
|---|---|---|
| Consent model | Opt-in for non-essential cookies; audience analytics may use legitimate interest in limited cases | Opt-in for everything not strictly necessary |
| Reject on the first layer | Recommended by the ANPD cookie guide | Expected by EU regulators |
| Pre-ticked boxes, implied consent | Not recommended by the ANPD cookie guide | Invalid (CJEU, Planet49) |
| Withdrawing consent | An own mechanism, as easy as giving consent; browser settings are not enough | As easy as giving consent (GDPR Art. 7(3)) |
| Language | Cookie information only in a foreign language is flagged | Language of the audience |
| Privacy contact | Encarregado contact published, preferably on the site | DPO contact where a DPO exists |
| Maximum fine | 2% of revenue in Brazil, capped at R$ 50 million per infringement | Up to €20 million or 4% of global turnover |
Analytics: the main difference
The ANPD's guide accepts legitimate interest for audience analytics in limited contexts: aggregated data, no profiling and no combination with other tracking. Under the EU's ePrivacy rules, analytics usually needs consent unless a narrow exemption applies.
A standard setup that shares data with an advertising platform is unlikely to fit the ANPD's conditions, so treat it as consent-based in both.
What to add for Brazil
Show cookie information in Portuguese to Brazilian visitors, publish the contact of your encarregado (data protection officer), and keep a way to reopen cookie preferences after the first choice.
Checking both with one scan
The behaviour both laws care about is the same: what loads before consent and whether visitors can say no.
A CookieInspector scan shows both, with evidence for every request.
How we differ
“One scan, two rulebooks: the evidence is the same for the LGPD and the GDPR, and the report shows it request by request.”
Frequently asked questions
Is a GDPR-compliant cookie banner compliant with the LGPD?
Mostly. You may also need Portuguese-language cookie information for Brazilian visitors and a published contact for your encarregado (data protection officer).
Can analytics run without consent under the LGPD?
In limited contexts, according to the ANPD guide: aggregated data, no profiling and no combination with other trackers. Otherwise, rely on consent.
Which fines are higher?
The GDPR's cap is higher: up to €20 million or 4% of global turnover. The LGPD caps fines at 2% of revenue in Brazil, up to R$ 50 million per infringement.
Related tools & guides
Cookie ScannerCookie Audit ToolGoogle Consent Mode CheckerPre-Consent Tracking DetectionSupported Consent PlatformsFor Law FirmsFor AgenciesGuide: Cookie ComplianceGuide: Pre-Consent TrackingGuide: Scan LocationAll scanner comparisonsCookiebot alternativeOneTrust alternativeLGPD Cookie ComplianceVerificador de cookies (Português)
See exactly what's running on your site right now.
Run a free scanNo credit card required · Instant insights