LGPD for sites with ads, the simple way

Complete privacy policy

The law guarantees the data subject easy access to the purpose, form and duration of data use, who the controller is and how to contact them, sharing and the rights under article 18. Google also requires the policy to say that third parties, such as Google, use cookies to show ads.

Advertising cookies only after a yes

The ANPD guide indicates consent for non-necessary cookies and recommends keeping them off by default. If you use Google tags, Consent Mode can start as denied for Brazil only and change when the person accepts.

gtag('consent', 'default', {
  'ad_storage': 'denied',
  'ad_user_data': 'denied',
  'ad_personalization': 'denied',
  'wait_for_update': 500,
  'region': ['BR']
});

Easy-to-see reject button

The ANPD guide recommends an easy-to-see button to reject all non-necessary cookies. It advises against a banner with a single button and no option to manage.

Nothing pre-selected

The ANPD guide says it is not recommended to use a banner with authorization options already checked. Each purpose starts off until the person chooses.

Revoke at any time

The law says consent can be revoked at any time, through a free and simplified procedure. Leave a fixed link for the person to change their choice.

Published data protection officer contact

The identity and contact of the data protection officer must be disclosed clearly and objectively, preferably on the site. Small-scale agents exempt from appointing an officer must keep a channel with the data subject.

Respond to data subject requests

Confirmation and access to the data can be given right away, in a simplified format, or in a full statement within 15 days of the request. Have a channel to receive these requests.

Take care with children and sensitive data

Children's data requires the consent of at least one parent or guardian. Sensitive data, such as health and religion, requires specific and prominent consent, and Google does not accept personalized ads based on them.