## Want to understand why there are cookie banners on every website you visit today? This article is for you!

Cookie banners, cookie notices, GDPR notices or Privacy Notices… call them what you want. (We’ve even heard them called “that boring legal notice,” but more on that later.)

In fact, all the world’s largest and most serious companies have already added a cookie notice to their website, and this is for a good reason: GDPR, LGPD, CCPA and many others are live!

Completely inspired by the GDPR ,the LGPD in Brazil, as it’s commonly known, is a regulation that was created in 2018 specifically to address the way that personal data, such as a user’s name, e-mail, telephone number, address, etc.,  is collected and utilized by companies.

## The GDPR, LGPD…CCPA and cookie banners are here to stay!

Why does the GDPR require cookie banners? Does every website now need a banner?

The LGPD, as said, was inspired by the European Union’s General Data Protection Regulation (GDPR), and similar laws are already being enacted all over the world. Even North Korea now has its own privacy regulation! That is to say, this is not a passing trend and must be taken seriously. 

This shift does not necessarily mean more bureaucracy, but it does mean real empowerment. Thanks to these new privacy laws, ordinary citizens now have the right to authorize, deny, or even revoke companies’ ability to use their data!

## You mean I didn’t already have the right to decide what happens with my data?!

Don’t worry, we can explain! 

The answer is not that simple, as this law needs to function in parallel with innumerable others that also govern individual rights, including consumer, health, and internet law, among others. 
Keep going, it will be worth it! Soon you’ll be able to speak like an expert on this subject. 

With the advancement of advertising technologies that are linked to [digital marketing](https://br.sharpspring.com/marketing-digital/) and the exponential growth of social media, everyone now has a machine that generates and stores valuable data in the palm of their hands: cellphones. Every time an individual accesses a website, e-commerce account, Instagram, Facebook, or any similar platform, the visit generates data that is collected and stored by cookies. 

Cookies are simply text files that are capable of storing information generated by websites. 

## Want a practical example of cookie technology? 

I'm sure you know when you enter a website through your browser and it recognizes that you’ve already accessed the page before, allowing you to re-enter the site without signing in again? This happens because your browser has already stored a cookie from that site which can authorize your access. 

In the same way, cookies can also store data like which photos you’ve liked on Instagram or if you “forgot” a product in your shopping cart. All of this information is saved for later use.  

## And this is very valuable! 

Did you know that a person needs, on average, at least six interactions with a product or service before making the decision to purchase? 

It’s no wonder that when you “forget something in your shopping cart,” the product seems to follow you all over the internet with ads. Only then do you end up making the purchase. Is this a coincidence, or magic? 
Neither, these are the processes and technologies that utilize cookies for advertising.

If you’ve been through this, welcome! You’re in good company. 

Simply put, cookies are a piece of the wheel that moves the internet. It’s the use of data for advertising that allows us to consume the content that we love for free. After all, who do you think pays for that cool, free YouTube video? Advertisers! And now you know they use cookies to find you on your favorite channel. 
The use of cookies is not necessarily positive or negative, but it reached a point where individuals like you or I were not fully in control of what the internet giants were doing with our data. This is why privacy laws like the GDPR, LGPD and CCPA were created: to rebalance the relationship between companies and people.   
Ok, but weren’t you going to talk about data, privacy, and the rights I have? 
Yes! When the LGPD was enacted by Brazil in August of 2020 it forced companies to examine the way that they handled the plethora of consumer data generated by their business, and to make changes to their processes and databases. One of these changes was the obligation to inform visitors of the reason for their data collection, as well as the legal basis for it. 
Thus, in accordance with the LGPD, GDPR, CCPA and several others, every business must present a clear and objective communication that informs visitors of their purposes for collecting personal data. Whether on or offline, it is essential that every citizen is notified of the collection of their personal data as well as the many ways it might be used. 
As for us data “subjects,” as some law refers to us, we are now able to make a “free, informed, and unequivocal declaration,” as to whether or not we permit its use. That is to say, if we consent to the terms outlined by the business, we authorize them to use our data. In Brazil, for example if businesses violate this flow by collecting data without consent, they could face serious consequences including being fined up to 2% of their annual revenue, with a ceiling of 50 million real. Has your business ever considered the threat of being fined simply for not having a cookie banner on its website? 
Want to understand exactly how the GDPR, LGPD and CCPA impact your business? Here are some articles on the subject.
## But how do I know what they already do, or will now do with my data? Will the cookie banner tell me? 
Who among us has actually read the privacy policy or terms of use of a website we use? Not many, but it’s precisely in these official documents that these answers are found.
According to the Privacy Laws, businesses must comply with certain official documentation requirements and legal basis to inform users of their entire data collection process and its purposes. Well-known by lawyers, the “Privacy document kit” fulfills the standard that every company must meet, including a privacy policy, terms of use, data mapping, and contact information of the DPO, among others.
## Now the good news! 
These documents don’t need to be written in “legalese,” nor should they be, as LGPD, GDPR and CCPA requires that the information presented be “clear and accessible.” A user cannot consent to the collection of their data if they cannot understand the notice. 
What’s the use of a company acting cool in its marketing and communications, or speaking beautifully in advertisements, if when addressing privacy and transparency it starts speaking in code? It doesn’t make sense, right?
Anyway, this article aims to inform you that, along with the laws like GDPR, LGPD and CCPA, we also have new rights and duties, both as citizens and, especially, as companies. In this matter, the cookie banners actually serve a noble purpose! Businesses that use these banners correctly are able to show customers that they care about their individual rights, freedom of choice, and privacy. 
## A good cookie banner should meet certain minimal requirements outlined by the GDPR, LGPD and CCPA: 
Inform users clearly and objectively of all of the ways in which the company collects consumer data. 
Point to official documents such as the privacy policy, terms of use, etc. (referring back to the Privacy document kit mentioned above). 
List the options that you as the data owner have to fully or partially accept “the rules of the game” with that company, thus allowing you to receive their content or consume their products or services. 
Make it clear where, upon accepting the cookies, you could access the data that the company will gather about you, and how to opt-out if you change your mind. 
Allow users to consent to the data collection in a way that is free, informed, and unambiguous. 

Last but not least:
When you see the banner: “If you continue browsing, we understand that you consent…” know that the law has determined this to be insufficient, and there are several arguments why. Mainly, this banner without further detail does not give the visitor enough information to give their consent in a manner that is “free, informed, and unambiguous.”
We hope this article helped you to understand the “why” of the now popular cookie banners, which will soon be installed on all company websites. With this new regulation, there is no going back. 

## We’ll leave you with two final invitations: 

1. Do you know a business that needs to know more about cookie banners?
Again, any and all companies that collect personal data, such as name, email, or telephone number on their site, and use third-party services like the Facebook pixel, Google Analytics, etc. MUST include this banner.
We at AdOpt are experts in cookie banners and can help them today! And even better, for many it’s free! Send this article to whoever you know that could use this content. They will thank you when they avoid an unpleasant fine!

2. Want to dive deeper into the subject of cookie banners?
We’ve got more articles for you here.


Want to understand why there are cookie banners on every website you visit today? This article is for you!

Why are cookie notices everywhere?

Surely you've already seen the predictions of fines and sanctions that the LGPD brought with it, right?
Thanks to a long history in Brazil we now have a new law, the LGPD, but what does this mean for businesses?

Before taking an alarmist or even pessimistic perspective on the law, it is essential to clarify that the use of personal data by businesses has not been prohibited, but simply more regulated. This means that you as an entrepreneur or specialist in your market can and should maintain your work and strategies, though you must now understand how to adapt your business model to the regulations that the law prescribes for the use of personal data.

So what does the [LGPD](https://goadopt.io/blog/lgpd-lei-geral-de-protecao-de-dados/) mean for your company?

Below you will find as brief and practical as possible a compilation of key information that will serve as a guide through the doubts you might face on your path to understanding and, above all, meeting the expectations of this new law!

## Introduction

### Before we start, who is AdOpt to help me with this?

After several years of work initiatives and studies on data, marketing, and privacy on the internet, we need to make a confession: we’ve honestly seen it all. We've been in this market from the birth of predictive analytics concepts and all the Adtechs that have emerged since then, through the rise and fall of Cambridge Analytica and its scandals and leaks, countless analyses and documentaries, Wikileaks, Snowden, and so on.

As such, we’ve followed the market through the emergence of the GDPR and its derivatives around the globe, which today, here in Brazil, has culminated in the LGPD. For almost seven years we have been working daily with several of the pillars that the “Marketing for Data” sector is so familiar with today:

- The construction of data models for analysis of performance metrics
- Sequential, non-relational, physical, cloud databases and many others 
- Numerous features of tracking tags, fingerprints, SDKs, etc.
- Endless technology, privacy, rumors and browser updates with their third-party cookie blocks
- Various integrations with ad servers, CRMs, email tools, DSPs, cookie syncs with DMPs, data providers, credit bureaus, etc.
- Firewalls, backdoors, security routines, DNS, etc.

In short, there are more than 200 million unique users mapped on our systems, and 40,000 sites have passed through our network since 2015, when we created the first version of our tag and cookie technology.

After all this experience, we’ve realized that the knowledge we’ve gained is not useful unless:

1. We promptly implement the best work and safety practices.
2. We are able to translate international theories into our legislation and local market realities.
3. We debunk the idea that starting the work requires infinite and extremely elaborate resources.
4. The theory generates a real gain for customers, and consequently sales for both sides.

Over the course of 2019 we interviewed nearly 250 companies about the LGPD, its impact, and their perceptions of the challenges of adaptation. We learned that their main difficulties were understanding the law, lack of skilled labor, difficulties with handling new technologies and, last but not least, the administration and collection of the consent of data owners.

Since then we’ve understood that the LGPD remains an open question for most, and at the same time that we, who are a living part of the market, have in our hands the opportunity to reinforce how seriously privacy should be taken. Privacy is an individual right of all citizens that should be valued and protected before it is lost. 

How much harder is it these days to ignore the elephant in the room, the growing number of cell phones and devices collecting text, audio, and video data in virtually every home?

The fact is, privacy legislation is here to stay! Yes, we are at a point of no return when it comes to data usage by our favorite gadgets. With that, it's essential that we know the value of privacy while we still, at least theoretically, have control. It’s especially important that we have access to technologies that work in our favor, not only collecting our data but also giving us the freedom of choice when faced with the countless collection occasions that we face daily. Yes, before data is collected the choice to consent must have been made by a free citizen who was informed of their rights clearly, and their decision must be respected.

So, in the midst of this accumulation of data, services, doubts, and endless testing of technologies, AdOpt was born.

We spent years studying the law and applying it practically with the goal of minimizing the negative consequences that the marketing and advertising industries could suffer following its enactment. We did this not only because of the GDPR, which drastically reduced the revenue of large publishers when it came into effect in Europe, but also because of the needs of the maturing Brazilian market, which is confronting countless technologies that haven’t been tested due to the limitations of local budgets.  

AdOpt began as a quick and practical way for all companies to communicate and collect the consent of their visitors, without running the risk of destroying their metrics and engagement with one more ugly warning that looks like a paywall (or we could say privacy wall?). 

Throughout AdOpt's journey and evolution as a product, we have also aimed to democratize access to information about the legislation and its application, so that we can all respect everyone's privacy! 

**From a commercial point of view, we came to the conclusion that the market lacked some easy-to-understand positioning and, above all, demystification of the interests of some sectors of the market with regard to the new General Law for the Protection of Personal Data, the LGPD. Lawyers, accountants, IT professionals, and several other groups are eager to grab their share of the market, and this is perfectly understandable, since the law encompasses knowledge from several areas simultaneously. However, in terms of privacy, we at AdOpt believe that there are two principles more important than any market advantage:**

## 1 – The principle of freedom.

Yes, freedom is of immeasurable value and only those who lose it are able to truly describe the impact of its absence. Whether in access to information, the right to come and go, freedom of the press, or the simple right to be forgotten. We are the generation that not only created memes, but also “cancel culture,” fierce criticism of “fake news,” the banning of some social networks, and more. Based on the premise of valuing truth, we sometimes forget to measure the real impact of some unilateral mechanisms that end up overshadowing the real value of freedom.

The LGPD is also a mechanism that helps citizens to maintain their freedom in the face of internet giants.

## 2 – Without content producers, we wouldn't have the internet.

Back when the internet was a simple cluster of half a dozen blogs and news portals, the LGPD would never have made sense. However, it was thanks to these internet anchors that the opportunity to monetize people's attention on certain pages was created! Without the big publishers we would not have programmatic media and all the opportunities to automate the money flow now generated globally, with the scale and proportion that we have today. 

**Without programmatic media we would not have social media as we know it.**
### After all, as Mr. Zuckerberg would say: “We run ads.”


Perhaps this introduction smacks of “manifesto” when we extol so strongly the value of privacy and freedom, as expressed through free access to information and consequently in the production of content.
Here's another confession for you, dear reader.
AdOpt today functions to provide cookie notices, as well as helping as a [CMP]("https://goadopt.io/blog/o-que-e-uma-cmp/") (Consent Management Platform). But you’ll be surprised to see what’s ahead as we connect all these dots and give you access to the technologies we’re designing! 

### If data is the new oil, privacy will be the new currency!

The subject is not over yet, but we hope you have understood how passionate we are about it and will allow us to guide you through! In our next chapter (article) we want to show you the basis for understanding the law: [The Legal Bases of the LGPD]("https://goadopt.io/blog/bases-legais-da-lgpd/"), See you there!


Surely you've already seen the predictions of fines and sanctions that the LGPD brought with it, right?

Understand the meaning of the LGPD for your company

At the beginning of everything are the legal bases of the LGPD, that is, the legal grounds (legitimate reasons) why companies not only can, but must access customer data in order to do their jobs well. 
You might wonder, isn’t selling a product or providing a service a legitimate reason to use customer data? What if I need this information in order to meet the terms of a contract? And in fact, both of these are examples of situations addressed by the legal bases of the LGPD.

These ten legal bases describe the conditions that justify the use of personal data, and they were designed to encompass all of the various hypothetical reasons data usage may be necessary. They are the structural basis that supports the ethical use of data, in order to prevent this same legislation from becoming a subterfuge used to circumvent other equally essential regulations.

Your task as manager or the person in charge of your company's data is to find among these ten the basis that best suits your business model and other governing legislation to which your company is subject. This applies to all possible steps included in data processes within your company, such as:

- Collection,
- Storage,
- Treatment,
- Transference,   
- Sharing of personal data.

Remember, we are talking about the right to privacy in the context of data that not only identifies the citizen, but also assigns them to behavioral and demographic matrices.

According to the LGPD, sensitive personal data include:

_Racial or ethnic origin, religious or philosophical beliefs, political opinions, union membership, genetics, biometrics, and issues about a person's health or sex life._

With that in mind, let's look at the 10 legal bases of the LGPD.

They are:

1. Consent of the data holder.
2. Legitimate interest.
3. Legal obligation.
4. Compliance with public policies.
5. Research bodies.
6. Execution of contracts.
7. Exercise of rights.
8. Protection of life.
9. Guardianship of health.
10. Credit protection.

Before we delve into each of the legal bases, let’s separate “consent” and “legitimate interest” into a category of their own, because despite being the most popular, they are less straightforward than the others and require additional care in their use. The eight bases that follow are clearer and more secure from a legal perspective.

Now, let’s take a closer look at each one:

## 1 – Data Holder's Consent

This is perhaps the most widely known legal basis in the entire market. There are already many sites that have used it to adapt to the LGPD by displaying the well-known warning, “This site uses cookies…” Well, whether in the virtual or offline environment, consent is a very quick way to obtain authorization from customers so that businesses can legally access their data and provide their services.

However, it is worth noting that the law specifies that this consent must be in writing, or by means that demonstrate the unequivocal expression of the holder's will. Therefore, when citizens are asked to give their consent, they must have clarity, ease, and the freedom to do so autonomously.

Precisely here is a feature that differentiates this legal basis from the others: it must be as easy for customers to revoke their consent as it is for them to provide it in the first place. 

Thus, it is important that the collection of consent, or opt-in (in the language of the market) is as agile and easy as revocation, or opt-out. This means that consent should not generate friction in the commercial relationship. Legal experts emphasize that, as a business owner, you should not rely solely on this modality to legitimize your use of data because this form of authorization tends to be fragile.

This is exactly why AdOpt so greatly values the agility, speed, and appearance of its communication, which corresponds with the visual identity of the company in question. When we studied the GDPR and its impact on large publishers (news and content portals) we saw that one of the biggest effects of those huge and unattractive notices (which look like the legal department designed them in Word) was the increase in bounce rate, a digital marketing and UX metric that shows the percentage of visitors that leave your website as soon as they access it.

Imagine yourself in your store watching customers come and go in a matter of seconds, without introducing themselves, asking for a product, or interacting with a salesperson.

This is the in-person analogy for the bounce rate metric. So, think carefully about the cookie notice you place on your site. It can act as a giant barrier for your customers.

Finally, understand that the use of consent in online and offline environments must be integrated with the other steps of data use and processing within your company. Therefore, it’s important to map the flow of data within your company so that you do not miss any blindspots.

## 2 – Legitimate Interest.

This is the second most popular legal basis and perhaps the most widespread because, for many, legitimate interests serve as a lifeline or card up the sleeve if they cannot fit in with the others. This doesn't make it any less important, but it is necessary to emphasize that “legitimate interest” is somewhat subjective when we consider the parties: data owner versus data operator or controller. After all, money talks and commercial interests can speak louder. But not all commercial interests will necessarily constitute a legitimate interest for the use of such data.

Why not? Because this could damage the individual rights of the owner or even another express provision of the LGPD. Article 10 of the LGPD establishes that the legitimate interest of the controller can only serve as a basis for the processing of personal data for legitimate purposes, considered from concrete situations, which include but are not limited to:

### 1) support and promotion of the controller's activities and;

### 2) protection, in relation to the holder, of the regular exercise of their rights or provision of services that benefit them, respecting their legitimate expectations and fundamental rights and freedoms.
Therefore, it’s important to ensure that the use of data is legitimately justified by the provision of the service or sale of the product, without any deviance that could weaken this legal basis under other current legislation.

### 3 – Legal Obligation.

As the LGPD is a fairly recent law, there are many other laws that oblige companies to, for example, collect, process, and share citizens’ personal data for other prior purposes. As such, if your business model, activity, or process is already subject to legislation in force that requires you to collect data, this legislation would be the best justification for its usage.

An example of this would be the personal data that companies must collect from their employees to report to the Ministry of Labour, Social Security, etc. Here, the holders - and in this case also employees, could not oppose their data being shared due to the legal obligation that the company is fulfilling by doing so.
### 4 – Compliance with Public Policies.

This is perhaps one of the biggest benefits that the LGPD has given to data subjects, all of us citizens, and every taxpayer in this country. Governments must also comply with the LGPD, making this one of the biggest - if not the biggest - legal bases of the LGPD.

Today, the government, one of the institutions that benefits most from its citizens' data, including commercially, must also conform with this regulation.

According to article 7, paragraph III of the LGPD, public administration bodies need to comply with the law when processing or sharing personal data for the execution of public policies, contracts, agreements, or similar instruments, without the need for the consent of the holders.

Although there is no need for consent, data owners still have the right to a clear and unambiguous explanation of the purposes for which their data has been collected and the processes to which it is subject. A final note, however, is that public administration is not subject to fines. However, it is still subject to warnings, publication of infractions, and restriction or even deletion of data.

### 5 – Research Bodies.

The LGPD also authorizes scientific researchers and developers to access personal data for the purpose of their studies. It is recommended, however, that this information is always anonymized in order to guarantee the privacy of the holders and to avoid possible leaks. This way the identities of the research subjects are protected, and the researchers themselves can rest assured of the safety of their scientific methods.

### 6 – Execution of Contracts.

Once a contract is signed, the parties have their obligations and rights established therein. Thus, once a data holder has signed such a contract, the legal basis for the proper use of their data has been established. In this case, the owner himself gives his data and legitimizes the legal basis for its use as part of the document. In this sense, the situation is quite similar to that of consent. However, unlike with consent, if the data owner changes their mind, revocation of their permission is not as simple, since the contract has its own force of validity and may include additional legal bindings. 

### 7 – Exercise of Rights.

Another legal purpose for using personal data, by choice of the data controller, is the regular exercise of rights in judicial, administrative, or arbitration proceedings.

This legal basis aims to guarantee the right of one party to produce evidence against another in legal proceedings. This is intended to prevent one party from being able to defensively obstruct the other from accessing and processing data as part of the legal process. 

### 8 – Life Protection.

The use of data is also granted by law in cases that relate to the protection of the life or physical integrity of the data owners, or third parties.

Based on article 11, section II of the LGPD, sensitive data may be processed without providing the consent of the owner if it is essential for the protection of life or the physical safety of these or third parties.
As an example, imagine the work of first responders who bring in unconscious people in emergencies. Once the citizen and their medical records have been identified within a medical or hospital network, their information may be shared among physicians for the sake of the person, without their consent.

### 9 – Guardianship of Health.

As in the previous item, the LGPD also provides a legal basis that authorizes the access and processing of data for the protection of health, as long as it is carried out by a health professional, health services, or a health authority.

This legal basis tends to be widely discussed and put to the test, mainly because of the interest in information that can be used on a public and commercial basis. However, the legislation emphasizes that data sharing cannot be performed in order to harm the owner or gain economic advantage over them.
For example, imagine a scenario where access to some of the owner's health information automatically readjusted their health plan. This would be categorically vetoed by the LGPD. In other words, health plan operators are prohibited from using this data to assess risk or decide whether or not to accept clients.

### 10 – Credit Protection.

The 10th and final legal basis is intended to ensure that in situations of collection or debt incurred, data owners do not use the mechanisms of the LGPD as a loophole to escape their financial obligations.
An example would be if the owner requested that the creditor financial institution delete their data from its database, or even from agencies such as Boa Vista and Serasa, thus circumventing the charge.
This also tends to be a much discussed legal basis given the controversial implications that the context involves.

Legal bases are just the foundation!

Finally, we hope we’ve made these ten legal bases clear enough that you’ll be able to process data within the guidelines of the law.

With this in hand, you’re ready to take the next steps on the path to compliance.

To deepen your understanding, our next chapter is: What is the ideal privacy policy for your company?

At the beginning of everything are the legal bases of the LGPD, that is, the legal grounds (legitimate reasons) why companies not only can, but must access customer data in order to do their jobs well.

Cookie notice

GDPR

LGPD fines

Latest updates

Contact an expert!

Why are cookie notices everywhere?

Understand the meaning of the LGPD for your company

Understand the legal bases of the LGPD