LGPD Brazil: E-commerce Cookie Compliance & Technical Audit

Audit & Compliance

Introduction to LGPD and E-commerce Cookies

The Brazilian Regulatory Context: A GDPR Replica

The Lei Geral de Proteção de Dados Pessoais (LGPD), Law No. 13.709/2018, came into force in Brazil in September 2020, with sanctions applied in August 2021. Directly inspired by the European General Data Protection Regulation (GDPR), the LGPD establishes a comprehensive legal framework for the collection, processing, storage, and sharing of personal data. Its scope is broad, covering any data processing operation carried out in Brazil, or concerning data of individuals located in Brazil, or data collected with the aim of offering goods or services to individuals in Brazil. This extraterritoriality is crucial for international e-commerce companies targeting the Brazilian market. The Autoridade Nacional de Proteção de Dados (ANPD) is the regulatory body responsible for overseeing the application of the LGPD and imposing sanctions.

For cookies, the LGPD requires a clear legal basis for their use, with consent being the most common for non-essential cookies. This implies a redesign of consent collection and management practices, particularly for e-commerce platforms that heavily rely on these trackers for analytics, personalization, and targeted advertising.

Specific Impact on E-commerce: Navigating Personalization and Privacy

E-commerce sites are by nature intensive data collectors. Cookies are at the heart of their operation, allowing them to remember items in a shopping cart, track user journeys, personalize product recommendations, display relevant advertisements, and measure the effectiveness of marketing campaigns. Under the LGPD, the use of these cookies, with the exception of those strictly necessary for the site's operation (e.g., shopping cart, security), is subject to obtaining prior, free, informed, specific, and unambiguous user consent.

This represents a major technical and strategic challenge. Companies must not only ensure that their Consent Management Platforms (CMPs) are robust but also that integration with their marketing and analytics systems is compliant. Non-compliance can lead to substantial fines (up to 2% of annual revenue in Brazil, capped at BRL 50 million per infraction), data processing prohibitions, and irreparable damage to brand reputation. A proactive and technically rigorous approach is therefore imperative.

Fundamental Principles of LGPD Compliance for Cookies

Legal Basis for Processing: Granular Consent

The LGPD, like the GDPR, lists ten legal bases for processing personal data. For the vast majority of cookies used in e-commerce (analytical, advertising, personalization), user consent is the most appropriate and safest legal basis. This consent must meet strict criteria:

• Free: The user must not be subjected to any coercion or pressure. Refusal of consent must not result in significant disadvantage.
• Specific: Consent must be given for precise purposes. Global and undifferentiated consent for all cookies is insufficient.
• Informed: The user must be clearly and comprehensibly informed about the identity of the data controller, the purposes of the cookies, the types of data collected, the retention period, and the identity of third parties accessing the data.
• Unambiguous: Consent must be manifested by a clear affirmative action (e.g., clicking an "Accept" button). Silence, pre-checked boxes, or inactivity do not constitute valid consent.
• Revocable: The user must be able to withdraw their consent at any time, as easily as they gave it.

The implementation of a Consent Management Platform (CMP) offering granular choice by cookie category (necessary, functional, analytical, advertising) is therefore a fundamental technical requirement.

Transparency and Clear Information: The Key to Trust

Transparency is a pillar of the LGPD. E-commerce sites must provide clear and accessible information about their use of cookies. This translates to:

• Consent Banner (CMP): A visible banner or pop-up upon arrival on the site, informing the user about the use of cookies and offering clear options ("Accept All", "Reject All", "Customize"). The "Reject All" button must be as visible and easy to access as "Accept All".
• Detailed Cookie Policy: A dedicated document, easily accessible from the banner and the site's footer, detailing: the types of cookies used (first and third-party), their purposes, their lifespan, the data collected, third parties accessing this data, and the means for the user to manage their preferences.
• Language: All information must be available in Brazilian Portuguese.

Clarity of language is paramount. Avoid complex legal jargon and favor simple, direct explanations to ensure the user fully understands the implications of their choice.

Technical Architecture of Consent Management

Implementation via Google Tag Manager (GTM) and Consent Mode

Google Tag Manager (GTM) is an indispensable tool for dynamically managing tags and scripts on an e-commerce site, including those that set cookies. Integrating a CMP with GTM, particularly via Google Consent Mode, is the most robust method to ensure LGPD compliance.

Consent Mode allows Google tags (Analytics, Ads) to dynamically adapt to the user's consent status. If the user rejects advertising cookies, Google Ads tags will adjust not to set advertising cookies, while still being able to send cookie-less pings for aggregated and anonymized measurements.

Key GTM integration steps:

1. CMP Deployment: Integrate your CMP's script (e.g., OneTrust, Cookiebot, Didomi) at the top of your site's <head>, before any other script.
2. Consent Mode Initialization: Configure Google Consent Mode via GTM to set default consent states (generally "denied" for all non-essential categories) and update these states based on user choices via the CMP.
3. Tag Configuration: Ensure that all tags (Google and third-party) are configured to respect Consent Mode or the CMP's consent variables. Use conditional triggers in GTM to activate tags only when appropriate consent has been given.

Conceptual GTM configuration example (via a custom HTML tag or a CMP tag template):

// Example GTM configuration for consent mode
// Assuming your CMP exposes a global consent object, e.g., window.MyCMP.consentStatus

// Function to retrieve the consent status for a specific category
function getConsentStatus(category) {
  if (window.MyCMP && window.MyCMP.consentStatus) {
    return window.MyCMP.consentStatus[category] ? 'granted' : 'denied';
  }
  return 'denied'; // By default, deny if the CMP is not ready or if consent is not given
}

// Initialize consent mode with default values (all denied except essential)
// This part must be executed very early, before other tags load.
gtag('consent', 'default', {
  'ad_storage': 'denied',
  'analytics_storage': 'denied',
  'functionality_storage': 'denied',
  'personalization_storage': 'denied',
  'security_storage': 'granted' // Often considered essential and not subject to consent
});

// Update consent mode after user interaction with the CMP
// This function would be called by the CMP once consent is obtained.
window.updateGoogleConsent = () => {
  gtag('consent', 'update', {
    'ad_storage': getConsentStatus('advertising'),
    'analytics_storage': getConsentStatus('analytics'),
    'functionality_storage': getConsentStatus('functional'),
    'personalization_storage': getConsentStatus('personalization')
  });
};

// Ensure the CMP calls window.updateGoogleConsent() after interaction.

Preventive Cookie Blocking (JavaScript DOM Blocking): The "Prior Consent" Principle

The "prior consent" principle (prior consent) is fundamental: no non-essential cookie should be set before the user has given explicit consent. This requires a robust technical blocking mechanism, often implemented via JavaScript.

Blocking can be achieved by modifying the type of <script> tags or by using custom attributes that prevent their initial execution. Once consent is obtained, the corresponding scripts can be reloaded or executed dynamically.

Example of preventive tag blocking script:

// This script must be placed in your page's <head>, before any other script that might set cookies.
document.addEventListener('DOMContentLoaded', () => {
  const scriptsToBlock = document.querySelectorAll('script[data-consent-category]');

  scriptsToBlock.forEach(script => {
    // Prevents immediate execution by changing the script type
    script.setAttribute('type', 'text/plain');
    // Stores the original type to restore it after consent
    script.setAttribute('data-original-type', 'text/javascript');
  });

  // Global function to be called by the CMP after obtaining consent
  // 'consentedCategories' is an array of accepted cookie categories (e.g., ['analytics', 'advertising'])
  window.loadConsentedScripts = (consentedCategories) => {
    scriptsToBlock.forEach(script => {
      const category = script.getAttribute('data-consent-category');
      if (consentedCategories.includes(category)) {
        // Restores the original type to allow execution
        script.setAttribute('type', script.getAttribute('data-original-type'));

        // For external scripts (with src), they often need to be recreated to load
        if (script.src) {
          const newScript = document.createElement('script');
          newScript.src = script.src;
          // Copy other important attributes if necessary (async, defer, id, etc.)
          Array.from(script.attributes).forEach(attr => {
            if (attr.name !== 'type' && attr.name !== 'data-original-type') {
              newScript.setAttribute(attr.name, attr.value);
            }
          });
          script.parentNode.replaceChild(newScript, script);
        } else {
          // For inline scripts, evaluate the content directly
          try {
            eval(script.textContent);
          } catch (e) {
            console.error('Error executing inline script after consent:', e);
          }
        }
      }
    });
  };
});

// Example of use in HTML for a Google Analytics script:
// <script type="text/javascript" data-consent-category="analytics" src="https://www.googletagmanager.com/gtag/js?id=GA_MEASUREMENT_ID"></script>

In-depth Audit and Continuous Optimization

Audit Methodology with Browser DevTools

Regular technical audits are essential to ensure continuous compliance. Browser-integrated developer tools (Chrome DevTools, Firefox Developer Tools) are valuable allies for this task.

Audit steps with Chrome DevTools:

1. Consent Refusal Simulation:
   • Open your site in private/incognito mode to simulate a new user.
   • As soon as the consent banner appears, click "Reject All" or customize to reject all non-essential categories.
2. "Network" Panel Verification:
   • Open DevTools (F12 or Ctrl+Shift+I).
   • Go to the "Network" tab.
   • Refresh the page.
   • Filter by "cookie" or examine outgoing requests. Check Set-Cookie headers. No non-essential cookies should be set by your domain or third-party domains (e.g., Google Analytics, Facebook Pixel) after a refusal.
   • Look for requests to analytics or advertising services. They should not be sent, or if they are (e.g., Consent Mode), they should not include cookies or personal identifiers.
3. "Application" Panel Inspection:
   • Go to the "Application" tab > "Storage" > "Cookies".
   • Examine the list of cookies. Only strictly necessary cookies (e.g., session, cart, CMP) should be present. Check their domain, expiration, and value.
   • Also check "Local Storage" and "Session Storage" to ensure no personal data is stored without consent.
4. "Console" Panel Analysis:
   • Look for JavaScript errors or warnings related to the CMP or script loading.
   • Use document.cookie (with limitations) for a quick check of cookies accessible via JavaScript.
5. Consent Acceptance Simulation:
   • Clear all cookies and local storage (via "Application" > "Clear site data").
   • Refresh the page and this time, accept all cookies.
   • Repeat steps 2 and 3 to verify that the expected cookies are set and that requests to third-party services are correctly made.
6. Consent Revocation Test:
   • After accepting cookies, find the link or button to modify/revoke consent (often in the footer or via the CMP).
   • Revoke consent for certain categories and verify that the corresponding cookies are deleted and that scripts stop executing.

Analysis of CNIL Sanctions and Lessons for LGPD

Although the LGPD is Brazilian, decisions by the CNIL (French data protection authority) regarding cookies, based on the GDPR, offer valuable lessons. The principles of consent and transparency are very similar, and the reasons for sanctions often repeat. The Brazilian ANPD regularly draws inspiration from the practices and decisions of its European counterparts.

Comparative Table of Notable CNIL Sanctions and Lessons for LGPD