LGPD

Brazil's general data protection law has been in force since September 2020, with sanctions enforceable since August 2021 by the Autoridade Nacional de Proteção de Dados. It is modeled on the GDPR, with ten legal bases including consent and legitimate interest, rights of access, correction, and deletion, and a requirement that consent be free, informed, unambiguous, and for specific purposes. The ANPD published cookie guidance in 2022 that follows the European approach to banners and pre-consent tracking. Fines reach 2 percent of the organization's revenue in Brazil, capped at R$50 million per violation, with additional sanctions including publication of the violation and suspension of processing. For global brands, the Brazilian site or app is often where consent handling built for Europe quietly stopped being applied.