LGPD Compliance Guide
opt-in-brazil — Brazil-specific opt-in with 10 lawful bases and ANPD enforcement. Parental consent gate for under-12. Use compliance: { type: 'opt-in-brazil' } in your ConsentiSetup config.Brazil's Lei Geral de Proteção de Dados Pessoais (LGPD) — Law 13,709/2018 — came into full force in September 2020 and is enforced by the ANPD (Autoridade Nacional de Proteção de Dados). It is structurally similar to the EU GDPR, relying on 10 lawful bases for processing with consent being the most common for cookie-based analytics and marketing.
Official references
Key requirements
| Requirement | Detail |
|---|---|
| Consent model | Opt-in — free, informed, unambiguous, purpose-specific |
| Sensitive data | Explicit consent required (health, biometric, racial origin, religion, political/union membership) |
| Minors | Under-12 requires parental/guardian consent; 12–17 requires at least assent |
| Withdrawal | Must be free and easy; controller must stop processing on withdrawal |
| Lawful bases | 10 bases — consent (Art. 7 I), legitimate interest (Art. 7 IX), contract, legal obligation, vital interests, etc. |
| Records | Controllers must maintain processing records |
| Enforcer | ANPD — Autoridade Nacional de Proteção de Dados |
LGPD vs. GDPR
| GDPR | LGPD | |
|---|---|---|
| Opt-in required | Yes | Yes |
| Lawful bases | 6 | 10 |
| Minor age threshold | 16 (States may lower to 13) | 12 (parental consent); 12–17 assent |
| DPO equivalent | Data Protection Officer | Encarregado (mandatory for some controllers) |
| Enforcer | National DPAs / EDPB | ANPD |
| GPC | Optional to honour | Not recognised — no equivalent |
Enabling LGPD mode
Frontend widget
new ConsentiSetup({
core: {
regulation: 'lgpd',
},
})Profile configuration (dashboard)
Select LGPD (Brazil) as the regulation. The consent flow mirrors the GDPR opt-in model. Optionally add your Encarregado (DPO equivalent) contact in the profile metadata to render it in the consent notice footer.
{
"regulation": "lgpd",
"lgpd": {
"encarregadoEmail": "[email protected]",
"purposeDescription": "Para operar o site e enviar e-mails transacionais."
}
}lgpd.encarregadoEmail field, when set, is rendered in the modal notice footer — giving users a direct route to your data officer, as recommended by ANPD.Sensitive data categories
LGPD Article 11 lists data requiring explicit consent: health/genetic data, biometric data, racial or ethnic origin, religious belief, political opinion, union membership, and sexual orientation. Tag cookies containing any of these as sensitive: true in your cookie definitions to trigger the explicit-consent banner variant.
Right to erasure (Art. 18)
DELETE /consenti/api/v1/consent/:visitorId