## Want to understand why there are cookie banners on every website you visit today? This article is for you!

Cookie banners, cookie notices, GDPR notices or Privacy Notices… call them what you want. (We’ve even heard them called “that boring legal notice,” but more on that later.)

In fact, all the world’s largest and most serious companies have already added a cookie banner to their website, and this is for a good reason: GDPR, LGPD, CCPA and many others are live!

Completely inspired by the GDPR ,the LGPD in Brazil, as it’s commonly known, is a regulation that was created in 2018 specifically to address the way that personal data, such as a user’s name, e-mail, telephone number, address, etc.,  is collected and utilized by companies.

## The GDPR, LGPD…CCPA and cookie banners are here to stay!

Why does the GDPR require cookie banners? Does every website now need a banner?

The LGPD, as said, was inspired by the European Union’s General Data Protection Regulation (GDPR), and similar laws are already being enacted all over the world. Even North Korea now has its own privacy regulation! That is to say, this is not a passing trend and must be taken seriously. 

This shift does not necessarily mean more bureaucracy, but it does mean real empowerment. Thanks to these new privacy laws, ordinary citizens now have the right to authorize, deny, or even revoke companies’ ability to use their data!

## You mean I didn’t already have the right to decide what happens with my data?!

Don’t worry, we can explain! 

The answer is not that simple, as this law needs to function in parallel with innumerable others that also govern individual rights, including consumer, health, and internet law, among others. 
Keep going, it will be worth it! Soon you’ll be able to speak like an expert on this subject. 

With the advancement of advertising technologies that are linked to [digital marketing](https://br.sharpspring.com/marketing-digital/) and the exponential growth of social media, everyone now has a machine that generates and stores valuable data in the palm of their hands: cellphones. Every time an individual accesses a website, e-commerce account, Instagram, Facebook, or any similar platform, the visit generates data that is collected and stored by cookies. 

Cookies are simply text files that are capable of storing information generated by websites. 

## Want a practical example of cookie technology? 

I'm sure you know when you enter a website through your browser and it recognizes that you’ve already accessed the page before, allowing you to re-enter the site without signing in again? This happens because your browser has already stored a cookie from that site which can authorize your access. 

In the same way, cookies can also store data like which photos you’ve liked on Instagram or if you “forgot” a product in your shopping cart. All of this information is saved for later use.  

## And this is very valuable! 

Did you know that a person needs, on average, at least six interactions with a product or service before making the decision to purchase? 

It’s no wonder that when you “forget something in your shopping cart,” the product seems to follow you all over the internet with ads. Only then do you end up making the purchase. Is this a coincidence, or magic? 
Neither, these are the processes and technologies that utilize cookies for advertising.

If you’ve been through this, welcome! You’re in good company. 

Simply put, cookies are a piece of the wheel that moves the internet. It’s the use of data for advertising that allows us to consume the content that we love for free. After all, who do you think pays for that cool, free YouTube video? Advertisers! And now you know they use cookies to find you on your favorite channel. 

The use of cookies is not necessarily positive or negative, but it reached a point where individuals like you or I were not fully in control of what the internet giants were doing with our data. This is why privacy laws like the GDPR, LGPD and CCPA were created: to rebalance the relationship between companies and people.   

Ok, but weren’t you going to talk about data, privacy, and the rights I have? 

Yes! When the LGPD was enacted by Brazil in August of 2020 it forced companies to examine the way that they handled the plethora of consumer data generated by their business, and to make changes to their processes and databases. One of these changes was the obligation to inform visitors of the reason for their data collection, as well as the legal basis for it. 

Thus, in accordance with the LGPD, GDPR, CCPA and several others, every business must present a clear and objective communication that informs visitors of their purposes for collecting personal data. Whether on or offline, it is essential that every citizen is notified of the collection of their personal data as well as the many ways it might be used. 

As for us data “subjects,” as some law refers to us, we are now able to make a “free, informed, and unequivocal declaration,” as to whether or not we permit its use. That is to say, if we consent to the terms outlined by the business, we authorize them to use our data. In Brazil, for example if businesses violate this flow by collecting data without consent, they could face serious consequences including being fined up to 2% of their annual revenue, with a ceiling of 50 million real. Has your business ever considered the threat of being fined simply for not having a cookie banner on its website? 

Want to understand exactly how the GDPR, LGPD and CCPA impact your business? Here are some articles on the subject.

## But how do I know what they already do, or will now do with my data? Will the cookie banner tell me? 
Who among us has actually read the privacy policy or terms of use of a website we use? Not many, but it’s precisely in these official documents that these answers are found.

According to the Privacy Laws, businesses must comply with certain official documentation requirements and legal basis to inform users of their entire data collection process and its purposes. Well-known by lawyers, the “Privacy document kit” fulfills the standard that every company must meet, including a privacy policy, terms of use, data mapping, and contact information of the DPO, among others.

## Now the good news! 
These documents don’t need to be written in “legalese,” nor should they be, as LGPD, GDPR and CCPA requires that the information presented be “clear and accessible.” A user cannot consent to the collection of their data if they cannot understand the banner. 

What’s the use of a company acting cool in its marketing and communications, or speaking beautifully in advertisements, if when addressing privacy and transparency it starts speaking in code? It doesn’t make sense, right?

Anyway, this article aims to inform you that, along with the laws like GDPR, LGPD and CCPA, we also have new rights and duties, both as citizens and, especially, as companies. In this matter, the cookie banners actually serve a noble purpose! Businesses that use these banners correctly are able to show customers that they care about their individual rights, freedom of choice, and privacy. 

## A good cookie banner should meet certain minimal requirements outlined by the GDPR, LGPD and CCPA: 

Inform users clearly and objectively of all of the ways in which the company collects consumer data. 
Point to official documents such as the privacy policy, terms of use, etc. (referring back to the Privacy document kit mentioned above). 

List the options that you as the data owner have to fully or partially accept “the rules of the game” with that company, thus allowing you to receive their content or consume their products or services. 

Make it clear where, upon accepting the cookies, you could access the data that the company will gather about you, and how to opt-out if you change your mind. 

Allow users to consent to the data collection in a way that is free, informed, and unambiguous. 

**Last but not least:**

When you see the banner: “If you continue browsing, we understand that you consent…” know that the law has determined this to be insufficient, and there are several arguments why. Mainly, this banner without further detail does not give the visitor enough information to give their consent in a manner that is “free, informed, and unambiguous.”

We hope this article helped you to understand the “why” of the now popular cookie banners, which will soon be installed on all company websites. With this new regulation, there is no going back. 

## We’ll leave you with two final invitations: 

1. Do you know a business that needs to know more about cookie banners?

Again, any and all companies that collect personal data, such as name, email, or telephone number on their site, and use third-party services like the Facebook pixel, Google Analytics, etc. MUST include this banner.

We at AdOpt are experts in cookie banners and can help them today! And even better, for many it’s free! Send this article to whoever you know that could use this content. They will thank you when they avoid an unpleasant fine!

2. Want to dive deeper into the subject of cookie banners?
We’ve got more articles for you [here](https://goadopt.io/blog/significado-da-lgpd/) para você:).



Why are cookie banners everywhere?

João Bruno Soares

If you've reached this article, you're certainly searching and wondering: What is the best cookie notice for your website, and how do you choose among the many options on the market? What are the criteria for this choice, and what are the strengths and weaknesses of each option? Well, we're here to help you because this decision needs to be well thought out!

Therefore, below we have listed the answers into key points that should be carefully analyzed.

1. Why do I need this banner, really?
2. But cookies are anonymous, so why all this?
3. Legislation and Language.
4. LGPD and the cookie notice, technical aspects of the Law.
5. Design.
6. Truth.
7. Detailed Purposes.
8. Freedom of choice.
9. Blocking third-party cookies.
10. Price
11. Integrations.


##Why do I need this banner, really?

First of all, **does your website REALLY need an LGPD Cookie banner?**

What do you mean? I'm already in this article to choose a cookie software, and you still want to tell me who actually needs the LGPD Cookie banner?

Exactly! Because there are many people who come to us to install the cookie banner on a website that simply does not use cookies. Seriously! Sometimes it seems like our banner is synonymous with website quality (okay, I confess, I agree), but there are limits.

It's like buying sunscreen for a nighttime stroll or mosquito repellent for diving.

The key point is confusing for many!

1. Just because many websites are using it doesn't mean you need to as well!
2. Pay attention to other legal bases that can support your business, in addition to consent.
3. The key question: If you don't use cookies on your website, why have a cookie banner? In times of such complex legislation, less is more!

Here, we have highlighted some points from the LGPD to support our reasoning:

**Article 8** addresses how the controller should request the data subject's consent. The first and most important rule is that the consent clauses must be separate from others, allowing the data subject to have a clear understanding of what they are consenting to.

Article 8 - § 2: The burden of proving that consent has been obtained in accordance with this Law lies with the controller.

_What does this mean? _
As the controller (your website), you must keep a record of all consents obtained, and these must be stored and documented.

Because at any time, data subjects have the right to request such records and any data you may have about them.

Refer to Article 19:

**Article 19: Confirmation of the existence of personal data or access to personal data shall be provided upon request by the data subject:**
_
I - in a simplified format, immediately;_ or

_II - through a clear and complete statement indicating the origin of the data, the absence of a record, the criteria used, and the purpose of the processing, subject to trade and industrial secrets, provided within a period of up to 15 (fifteen) days from the date of the data subject's request._

1. Personal data shall be stored in a format that facilitates the exercise of the right of access.

2. Information and data may be provided, at the data subject's discretion. § 3. The processing of personal data based on defective consent is prohibited. § 4. Consent must relate to specific purposes, and generic authorizations for the processing of personal data shall be void. § 5. Consent may be revoked at any time by the data subject's express manifestation, by means of a free and facilitated procedure, without prejudice to the processing carried out under the previously given consent until the request for elimination, as provided for in item VI of the main section of Article 18 of this Law.

##But, aren't Cookies anonymous? Why all this?

If you're not familiar with the digital world, let me explain to you with the most popular phrase from privacy policies ("Cookies are small pieces of text that are stored in your browser when you access a website on the internet.")

With this information from cookies, companies can do a lot, and I mean a lot! They can accurately profile your psychology and cross-reference this information with extremely personal data, known in the market as data enrichment or "data farming."

###The logic is always very similar: Browser -> cookie -> personal data (email, phone) -> person/registration -> CPF (Brazilian individual taxpayer registry) -> income, IRPF (Brazilian income tax return), marital status

Several companies do this, and virtually all of those that have tags installed on their websites can somehow convert this information and target any individual specifically. Whether it's directly through their own database (Google), or by cross-referencing with third-party databases (such as Serasa).

In other words:

**Cookies are not anonymous but rather anonymized.**

##Legislation and Language.
This is an excellent variable to consider when looking for a cookie banner! Questions like: Does it support multiple languages, can that be an advantage? But, before that, does it accept multiple legislations?

For example, if your website is Brazilian and someone accesses it from Italy, it wouldn't be enough for the banner to be in Italian. The visitor is actually under the jurisdiction of the GDPR, unless the LGPD has more "private" provisions in those specific areas (as required by the visitor's country's law).

In other words, just because your site has multiple languages and versions doesn't mean that all the legislations are correctly implemented and complied with regarding the cookie notice. Is it clearer now?

Pay attention to compliance with the applicable legislations, especially for your target audience! Language and accessibility are crucial, but not the only factors when it comes to foreign accesses.

##LGPD and the Cookie Banner, Technical Aspects of the Law.
Now that we understand the context of the law, the complexities of cookies, and the parallel legislations that may influence the use of the Cookie Banner on your website, let's discuss some key points that will help you make this choice.

1. **Design**
Why design when we're talking about technical aspects? Precisely because of that, after all, what are the main metrics of a website, an e-commerce? How do you analyze the conversion from visitors to leads and then to sales? Is Bounce Rate a concern? What are the KPIs of your site? Does usability and visitor experience matter?

Yes, they matter A LOT!

Therefore, look for a cookie banner with refined and responsive design that allows you to customize colors, logos, and placement on the site in a way that harmonizes with the overall structure of the site. Don't just throw a senseless banner in the middle of the visitor's screen; respect the attention the visitor is giving you!

Be cautious with designs that occupy the entire screen! We understand that the law requires clear and assertive communication, and many are overwhelmed by the uncertainties in the market. However, you shouldn't disturb the visitor or act impulsively because of that!

We know how every second counts in capturing visitors' attention, so make it count!

Do you really want to use a banner that steals attention instead of fulfilling a simple and even basic role required by the law?

![aviso barcelona.png](https://strapi.goadopt.io/uploads/aviso_barcelona_1cc05ad647.png?updated_at=2022-08-17T18:16:59.332Z)

This Barcelona F.C. banner is like having ten players blocking the goal...

2. **Transparency**
I may sound sensationalistic, but I dare say:

**"Most of the cookie plugins and banners we see on the internet are just fake buttons. Yes, digital components that don't record or organize anything."**

In addition to the "fakeness" of these mentioned points, always use assertive and direct language. Don't try to be "cool" or trendy. Of course, using too much legal jargon can push people away.

![aviso seção verdade.png](https://strapi.goadopt.io/uploads/aviso_secao_verdade_3a5ce550cc.png?updated_at=2022-08-17T18:18:11.830Z)

Not to mention that if I have no way to refuse, how would it block then? So, in the end, it's the same thing, don't you agree?

##Detailed Purposes.

This is one of the crucial points we consider in a good cookie banner. According to LGPD, consent must be given for specific purposes. Therefore, a simple "OK" or even "Accept" without the option to explore my choices and understand their purposes and legal bases can be somewhat coercive.

Consent is not a salvation or a general acceptance. It is the formalization of acceptance for that specific purpose presented.

![aviso sem finalidade.png](https://strapi.goadopt.io/uploads/aviso_sem_finalidade_db0539333e.png?updated_at=2022-08-17T18:18:58.036Z)

##Freedom of Choice.
The General Data Protection Law (LGPD) lists a series of legal bases through which companies can use data with ease. If you have chosen consent for your company, use it with respect and always value the privacy of your data subjects.

There is no better or stronger legal basis. Instead, choose the one that best fits your business model and market. Similarly, a cookie banner should understand the context in which consent will be communicated and collected, and should provide visitors with the freedom to choose fully, partially, or not at all.

Always look for cookie banners that break down the listing of tags and cookies into categories and subcategories. This is essential to demonstrate that a particular purpose is presented within category "X," and visitors can freely choose whether to accept it or not.

##Blocking Third-Party Cookies.
The cookie banner is not just an interactive button; it must have authority over the behavior of other tags used on the website, authorizing or blocking their firing based on the consent collected during that visitor's session.

For example, the Google Analytics tag should only be fired when the visitor accepts the statistical category of tags. Before that, the notice informs and waits for visitor interaction.

For more information on how to configure the AdOpt Cookie Banner to enable automatic blocking of third-party tags, see our tutorial.

##Price
The price of a cookie banner should be:

**- Affordable:**
Low prices that do not eat into your marketing budget. If there is a free plan, even better! The cookie banner only solves a part of the law's compliance, and it's likely that you will need other services or consultations in the future. Therefore, don't spend too much of your budget on this product.

A cookie banner does not cover all the obligations of LGPD, for example.

If you have other internal processes that use personal data, you will need to use other controls and even systems for that management.

The cookie banner should take care of the "digital gates" and reinforce the legal basis of consent.

How?

By recognizing and categorizing all users with their choices of total opt-in, partial opt-in, or opt-out and sending these requests directly to the Data Protection Officer (DPO), or even systems like CRM, ERP...

**- Scalable**
Look for cookie banners that offer billing with scalability parameters. In other words, they should have little to no impact initially, and as your website grows and your audience expands, you will pay for that processing power.

Additionally, the volume and value tiers should be broad enough to accommodate any seasonality, so you don't

How to choose a Cookie Banner for your website

The Brazilian Data Protection Law (_LGPD - Lei Geral de Proteção de Dados_) emerged a long time ago and has since drawn attention from numerous professionals. However, it is not uncommon to find websites and companies that ignore it, as they seek time to adapt. In this regard, how long can we ignore LGPD?

**Well, it is no longer possible to ignore it.** This has been a reality since its approval. Furthermore, it has been enforced since 2021.

With that in mind, it has been several years since this law was introduced, which leaves no excuse for ignoring it. Moreover, ignorance of the law can bring significant consequences, like [fines](https://goadopt.io/blog/en/fines-in-lgpd/).

Therefore, the clock is ticking against those who have chosen to postpone the necessary adaptations imposed by LGPD. It is time to change your stance. How and why to do so will be explained below.

##But what exactly does LGPD require?

[LGPD](https://goadopt.io/blog/en/lgpd-general-data-protection-law/) is often mentioned, yet little is said about its actual requirements. However, it has become essential for online users and website owners to understand what it entails.

Only then can the true importance of this law be comprehended. But don't worry, we won't use legal jargon to explain it to you.

The [LGPD](https://goadopt.io/blog/en/lgpd-general-data-protection-law/) is a nationwide regulation that came into effect in 2020. Many expected it to be implemented later, as there were speculations about its postponement, as seen before.

However, that did not happen. In other words, LGPD has been a reality since 2020 and requires attention. Many believe that it only applies to companies and their websites. However, it governs how all legal entities, including companies, governments, NGOs, associations, churches, and various other organizations, handle the data of the country's citizens.

It is worth noting that [LGPD](https://goadopt.io/blog/en/lgpd-general-data-protection-law/) and all other privacy regulations do not only focus on digital data but encompass all types of data. Therefore, how a company handles an email provided on a website or on a clipboard matters! Similarly, this extends the care to not only the website's servers but also to files, cabinets, and notebooks that "store" such data.

In summary, all processes in your company that involve personal data in their workflows must be reevaluated and adapted.

Assuming that you already understand that every time you visit a website or take an online action, both your browser will record signals and the website will receive information about you. Let's reinforce that this cannot happen indiscriminately, right? That is precisely what the General Data Protection Law addresses. It ensures limitations on the use of personal data, whether on websites or any other environments.

(If you haven't grasped that we are talking about Internet Cookies, read about them here before proceeding.)

With this, the law aims to protect users' privacy and intimacy. It also ensures that they have a better understanding of how their data is used and the security measures taken by the company that has access to that information.

But it doesn't stop there. LGPD also introduces data classification concepts and specific safeguards regarding data breaches and handling.

Ultimately, this law aims to promote transparency between websites and users. It imposes measures that can ensure their security. Therefore, in summary, it establishes four crucial points regarding data protection:

- Appropriate handling and use of personal data.
- Request for authorization and/or revocation regarding data collection.
- Penalties for companies that fail to comply with the aforementioned measures.
- Freedom for all citizens to access their own data.

##Tic Tac: There's no more time to ignore LGPD, see the consequences of doing so
It should be clear to you by now that LGPD has brought forth a series of important issues that completely impact the way companies operate.

Now, bringing it into the digital environment we are currently in, it becomes even more crucial for companies to demonstrate transparency to their visitors and strictly adhere to authorizations and policies.

Although the law granted a transition period for companies until August 2021, that deadline has already passed. In other words, the application of penalties and fines under the General Data Protection Law is now possible for websites that fail to comply with its guidelines.

Therefore, if your website still doesn't have clear privacy policies, in the case of cookie usage, or a [cookie banner](https://goadopt.io/blog/en/cookie-banner/) that respects personalized authorizations, it is at risk.

The penalties under LGPD are quite severe and include warnings (less severe) and [fines](https://goadopt.io/blog/en/fines-in-lgpd/). For non-compliance, the [fine](https://goadopt.io/blog/en/fines-in-lgpd/) can be up to 2% of the company's annual revenue (with a maximum calculation base of R$ 50 million). Additionally, there are possibilities of sanctions that can block a company's database until they regularize their operations.

In this sense, continuing to ignore the law that regulates data security and protection is shooting yourself in the foot for your company.

By doing so, you put your website and your company at risk. Even in the best-case scenario of receiving only a warning, persisting in the error will affect your finances and the image of your website, as well as access to data that is crucial for your activities.

##How to adapt to LGPD and avoid problems with the law?
Ignoring LGPD is no longer an option since the deadline for compliance with the law has passed.

As we are currently in the digital environment, let's focus on how to help you in this process. After all, many companies nowadays have a significant portion of their processes and operations in the digital realm. Such as e-commerce, digital agencies, product launches, info product creators, startups, and more.

All the examples mentioned above rely on the use of personal data for marketing automation, landing pages, various tracking pixels with remarketing cookies, media campaigns, and so on.

In short, it is impossible to continue ignoring this law. But how can you put it into practice? Don't worry, we have prepared a basic step-by-step guide with some essential principles.

>Remember, LGPD is not just a checkbox on your website; it involves a change in processes and a culture focused on privacy. So, below are some tips. If you take them seriously, you will find some valuable further guidance at the end. (Some people are charging a lot for the information we provide here for free - you're welcome!)

>#Important _LGPD is not just a checkbox on your website; it involves a change in processes and a culture focused on privacy!_

##Plan your Compliance, "Know Your Mess."

First and foremost, it's impossible to talk about LGPD compliance without a plan. What does that mean? Understand that you'll never feel confident in what you're doing if you don't know where the data is, where it comes from, where it goes, who processes and uses it. Therefore, you need a [Data Mapping, here's an article ](https://goadopt.io/blog/en/data-mapping-or-data-inventory-lgpd/)that will help you understand what it is and how to create one.

You know when you're at the grocery store and you see a product out of place? It's kind of bizarre, right? It gives us an uncomfortable feeling, as they would say in the South of Brazil. So, seriously, dedicate some time to this, and you'll see that all the other steps will be simplified. You don't want to find a toothbrush in your sock drawer when the Regulatory Agency comes knocking at your door.

##Work on a privacy policy.

First and foremost, it's impossible to put LGPD respect into practice without developing a privacy policy. It provides comprehensive information on how the company collects data, how it uses it, with whom it shares it, its usage deadlines, and other details.

Likewise, it clarifies how data is stored and what precautions are taken to ensure security against leaks, for example. So, remember to use clear and accessible language and address all relevant points in detail.

What's the basis for writing a good policy? Guess what! Your Data Mapping from the previous point. So, don't skip the previous step, trust us!

Here's an article to help you with the [privacy policy](https://goadopt.io/blog/en/is-there-an-ideal-privacy-policy/).

##Use a cookie banner and configuration tool.

Remember that we're talking about digital companies, right? These companies have a very peculiar characteristic: the entry points for data are usually all digital. Therefore, it's much easier for us to control what goes through them! And even better, with the use of technology!

That's why your [Cookie Banner or CMP - Consent Management Platform](https://goadopt.io/blog/en/what-is-a-cmp/), when properly implemented, becomes practically a "Pareto of Compliance," those 20% of effort that solve 80% of the problems.

In other words, make sure your website has an appropriate cookie banner that helps you organize data from the moment of entry. The cookie banner won't be your silver bullet, but it will be an excellent start to keep things in order over time.

[Here's an article for you to better understand how an LGPD cookie banner works.](https://goadopt.io/blog/en/operation-of-cookie-banner/)

For that, rely on Adopt. Our team consists of experienced professionals in the market who provide all the assistance you need. Here, we help you [choose a cookie banner for your website.](https://goadopt.io/blog/en/how-to-choose-cmp-consent-management-platform/)

##Be cautious with information security.

Another important point for adapting your company and website to the Data Protection Law is to increase the focus on information security. Companies have always been responsible for leaked data, but now even more so! Therefore, let's work hard to prevent any leaks or resulting damages that can have serious consequences for companies and the individuals whose data is exposed.

Therefore, highlight the risks of leaks and security in your data mapping. Once again, dedicate time to these security criteria and processes. You won't regret having them mapped and controlled because, in times of chaos, the best feeling is knowing that you are prepared and know what to do!

##Be cautious with marketing actions.

Finally, also apply your care in applying LGPD to your marketing actions. After all, it's necessary to strictly adhere to using communications and campaigns only to those who have authorized their receipt, as well as other flows that are triggered through the use of personal data.

Here's another interesting article for you: [10 Marketing Processes You Need to Reconsider under LGPD](https://goadopt.io/blog/en/10-risky-processes-in-your-marketing/).

As mentioned before, these are just a few steps. If you want to delve deeper into compliance topics, the next article for you is [here](https://goadopt.io/blog/en/lgpd-meaning/).

How long can we ignore LGPD?

Having a cookie banner on your brand's website has become essential for many. For e-commerce, it has practically become an obligation. This type of website has a technological composition in which cookies are a structural part. Login flow, items in the cart, recommendation showcase, remarketing... Most of them rely on cookies.

As a result, the use of cookies is essential for the survival of online commerce. Therefore, cookie banners are also necessary to avoid fines and other penalties that may be imposed after the enactment of the [General Data Protection Law (LGPD)](https://goadopt.io/blog/en/lgpd-general-data-protection-law/).

However, beyond the simple legal obligation, cookie banners maintain a transparent and open relationship with the public.

Our experience allows us to anticipate some "consequences" of the cookie banner on your online store. It is important for you to understand each of them so that you are not caught off guard and can adjust to this new reality.

## Cookie Banner: What Is It?

As the name suggests, a cookie banner is simply an alert about the use of this type of data by your website. Through it, visitors become aware that the page uses these files, which are essential for its operation and to enhance the user experience.

However, it's not just that. With the enactment of LGPD in 2020, data subjects gained the power to authorize or refuse the use of these tools during their browsing. In other words, they can accept or reject cookies at any time.

Therefore, the cookie banner informs visitors about their website's use of cookies and, at the same time, requests the user's authorization to use them. The user has the power to choose which types of cookies to allow.

Thus, all the management of these variables is contained in a platform called CMP - Consent Management Platform.

[To learn more about what a CMP is, we've prepared this article for you.](https://goadopt.io/blog/en/how-to-choose-cmp-consent-management-platform/)

**## Some Tips for Configuring the Cookie Banner**

According to the [LGPD text, consent is defined as a free, informed, and unequivocal expression by which the data subject agrees to the processing of their personal data for a specific purpose.](https://presrepublica.jusbrasil.com.br/legislacao/612902269/lei-13709-18#art-5) Here are some points to consider when setting up consent collection for your e-commerce:

- **FREE**: Collecting consent in exchange for some benefit is prohibited. This can constitute what's called "consent bias." Visitors cannot be forced or coerced into accepting.

- **INFORMED**: Citizens must be informed about the details of consent. Only with free access to this information can consent be "celebrated" between the parties.

- **UNEQUIVOCAL**: Consent must be provided in writing or by another means that demonstrates the data subject's will, which can be evidenced by a record, date, and time.

- **SPECIFIC PURPOSE**: Consent must be given for a specific and not a generic or general use.

Only with the four points listed above can various interpretations be drawn for the consent collection flow. In [this article](https://goadopt.io/blog/en/how-to-choose-cmp-consent-management-platform/), we've provided a specific analysis of each of the flow, design, and legal arguments to help you choose your cookie banner.

## The Most Overlooked and Feared Configuration in the Market

The most complex and overlooked configuration in the market is the blocking of third-party cookies, releasing them only after consent. In other words, tags like Google Analytics, Conversion Pixel, Remarketing, etc., can only be fired after visitor consent, with the exception of essential tags, of course.

This is one of the most important points that ensure the rights and privacy of data subjects, which many companies struggle to understand, adopt, and implement. After all, this would completely impact the site's performance, conversion KPIs, and numerous tracking metrics.

However, it's worth noting that this configuration is also one of the first things auditors and authorities look at when assessing whether a website is compliant or not. Firing cookies before consent leaves a poor impression and is certainly a red flag for audits and authorities.

Unfortunately, many SEO, performance, and analytics tools do not prioritize privacy. Google itself favors sites that use its services and share data with it. So, the entire market will have to adapt. An interesting alternative for those looking for privacy-respecting analytics services is [Fathom](https://usefathom.com/).

## How Does a Cookie Banner Impact Your E-commerce?

Delving a bit deeper into the direct and indirect impacts of the cookie banner on e-commerce, we've listed some of the main influences below.

**1. Bounce Rate: Be Cautious About Size and Design Harmony**
Any popup, banner, or notice that appears on the screen tends to prompt an immediate reaction, often rejection (especially on mobile). To prevent this, it's important for the Cookie Banner to have a minimalist design that harmonizes with your site's style. Otherwise, the chances of rejection or a bounce increase significantly. Look for opportunities to customize colors, formats, fonts, text, and images to make the banner's communication as unobtrusive as possible.

**2. Cookie Blocking and Metric Impact: Balloon Banners Are More Accepted Than Bottom Bars**
As explained in the previous item, once third-party cookie blocking is implemented, the metrics associated with this firing are directly impacted. From our experience, we've observed that about 25% of site visitors give consent. Sites that use balloon-style cookie banner have an 80% higher acceptance rate than the bottom bar format.

**3. Data Subject Requests Create a New Workflow/Process in Your Company**
One of the obligations brought by privacy laws ([LGPD, GDPR, CCPA, PIPEDA](https://goadopt.io), etc.) is the free access of citizens to their data and direct queries to companies. In other words, a citizen can at any time inquire if your company holds any data related to them and request more information, portability, or even deletion of it.

That's why, at AdOpt, we place such importance on data subject request workflows. Each AdOpt banner also generates an Opt-out page where people can make their requests at any time. This generates an email sent to the [Data Protection Officer](https://goadopt.io/blog/en/responsibilities-of-a-data-protection-officer/) (DPO) of the company, which, by law, must be responded to within 15 days.

So, your company needs a structured process to ensure that requests and their responses are fully met within the deadline. Someone must be trained and responsible for this workflow.

Would you like more tips on how to organize your operations to better handle these requests? I've selected two articles for you:

- Learn more about the [ROPA document of LGPD](https://goadopt.io/blog/en/ropa-for-lgpd//).
- [Data Mapping or Data Inventory, the DPO's Lifesaver](https://goadopt.io/blog/en/data-mapping-or-data-inventory-lgpd/).

**4. Tag Changes, Tool Testing Will Have a Larger Workflow**
Some companies tend to test many tools and technologies on their websites, which is not a problem in itself. However, since many of these tools fire cookies, it's essential that the entire communication flow, now established by LGPD, be reviewed and, if necessary, updated with the introduction of a new technology that fires cookies or collects data.

Especially if your official documents, such as the Privacy Policy and, possibly, the Terms of Use, have already listed the cookies you use, their purposes, deadlines, etc.

Therefore, if there is any change in the listing of official documents, it is important that communication is also completely revised and updated. It's worth noting that whenever a new privacy policy or cookie policy is updated, all consents collected up to that point should be updated/replaced. This is because consent is an agreement between the company and the citizen, the terms of which are precisely in the policy. Therefore, if the policy changes, the agreement of the parties must also be collected.

- [Learn more about how to notify users about term updates.](https://goadopt.io/blog/en/notification-to-users-terms-of-use/)
- [Important Tips on the Ideal Privacy Policy for Companies.](https://goadopt.io/blog/en/is-there-an-ideal-privacy-policy/)

## Is a Cookie Banner the Same as a CMP?

No, a CMP (Consent Management Platform) is a tool where a cookie notice or banner is just one integrated feature among many.

This differentiation is important because some people think that a cookie banner is just a pop-up with a button for the website. However, the technology involved goes far beyond that.

The banner can identify whether the visitor is accessing for the first time or not. By collecting the visitor's consent, it triggers this record to the database and to other tools that also await consent to react to access. All of this happens in milliseconds.

This is just one of several functionalities. Others include:

- Blocking third-party cookies.
- Hiding after acceptance.
- Recognizing the browser's language so that the banner is translated into the visitor's preferred language.
- Recognizing the visitor's IP country to ensure compliance with the visitor's country's legislation.
- Redirecting to the Opt-out/rights of data subjects page.
- Alerting the DPO when a request is made, consolidating visitor information.
- Integration with systems via API, callbacks to feed other databases.
- And more...

- Want to know more about a [CMP and how to choose one for your company? This link can help.](https://goadopt.io/blog/como-escolher-cmp-plataforma-gestao-consentimentos/)

## Why Have a Cookie Banner?

In summary, based on what we've seen so far, this is important for two main reasons. First, because LGPD requires it. According to the law, all use of data from data subjects must have their knowledge and consent. If you can manage this information offline or in some specific way, great! If you need to scale and automate workflows, the cookie banner (CMP) is essential for you.

But it's not just that. The cookie banner is also important to demonstrate to your audience how you care about both their experience on your site and the transparency in the relationship between the page and them.

Therefore, it improves the reliability of the relationship and shows the site's responsibility to its audience, as well as its pursuit of the best possible experience without compromising privacy.

So, it's extremely important to have a good cookie banner. It should be intuitive, grab the audience's attention, and integrate naturally with your website. Below, you can see how to get a good information banner and consent management.

## How to Get a Good Cookie Banner that Helps with Data and Consent Management?

For this, you can rely on AdOpt! Our cookie platform not only includes the banner but also a management tool, i.e., a CMP.

The platform is adaptable to your website's design, seamlessly integrating with it. Thus, when the site opens, it's available and provides information about the cookies used, as well as offering personalized configuration options for which ones the data subject will authorize.

Similarly, AdOpt includes essential documents for LGPD compliance on the page: Terms of Use and Privacy Policy. Therefore, all this data is organized in one place.

To top it off, AdOpt combines all of this with a real-time update and tracking tool for all entries, exits, and changes in consent. By doing so, it ensures that data will only be used in accordance with the data subject's wishes.

So, don't hesitate to rely on AdOpt and check out our plans. You'll see how complying with LGPD is much easier and more beneficial than it seems!






The Impact of Cookie Banners on Your E-commerce - LGPD

AdOpt is a consent management platform that allows you to build a relationship of transparency and trust with your website visitors.

So, every visitor who accesses your site will be greeted by a notice with a notification asking for their consent in a free, direct, informed, and detailed manner.

Below is a step-by-step explanation of how consent registration works in AdOpt.

## How does the [AdOpt cookie banner](https://goadopt.io/) work?

#### Here's an example of how the platform operates:

1. #### The visitor accesses your site.
    
2. #### AdOpt checks if this access is from a new visitor (meaning they don't have the AdOpt cookie).
    
    #### 1 – If yes, the notice is not displayed, and only the controller (a small dot with the AdOpt or your site's logo) is visible in the corner of the site.
    
    #### 2.2 If not, AdOpt treats them as a new visitor.
    
    #### 2.3 Necessary/Essential tags are triggered.
    
3. #### The visitor receives a privacy setup notification from AdOpt, including:
    
    #### 1 – A list of third-party Tags/Cookies and their classification by the AdOpt site manager.
    
    #### 3.2 – Public links to the Privacy Policy and Terms of Use.
    
    #### 3.3 – Public links to AdOpt's opt-out page for that site.
    
4. #### The visitor configures their preferences, with the option to detail the list of each category of [cookies](https://goadopt.io/blog/cookies-e-lgpd/) and present tags.
    
5. #### Upon clicking "Accept," AdOpt generates a unique CookieID for that visitor, which is stored in their browser.
    
6. #### Consent information, including:
    
    #### 1 – Date and Time,
    
    #### 6.2 – Anonymized CookieID,
    
    #### 6.3 – An updated list of accepted or rejected Tags and Cookies,
    
    #### 6.4 – The version of the Privacy Policy and Terms of Use available at that time,
    
    #### is individually recorded in the "Consent Log" within the AdOpt platform (logged area).
    
7. #### If the [AdOpt notice manager](https://goadopt.io/blog/responsabilidades-de-um-encarregado-de-dados/) for the respective site has integrated AdOpt with Tag Manager, whenever this visitor accesses the site, the list of authorized or unauthorized tags (item 6.3) will be in the visitor's browser.
    
    #### [– Here's a tutorial on blocking third-party tags](https://www.youtube.com/watch?v=8jqGLjZZ4UM)
    
    #### So, with each new visit, the tags in GTM check AdOpt's list to determine whether they should be activated or inactive for that unique visit.
    
8. #### If the visitor submits an opt-out request:
    
    #### a – AdOpt updates the CookieID that made the request, marking this cookie as inactive/opt-out. This way, within the AdOpt system, this "CookieID" will be invalidated and will only serve as a record for proof of consent.
    
    #### b – Two emails are sent to notify the data subject (if identified) and the site/company manager.
    
    #### 1 – The company receives this email and can analyze whether there are other integrations that use this information to proceed with the request in other integrated systems (systems, call backs, and APIs).
    
    #### b.1.1 – If you have no data associated with the cookie, you don't need to take any action. AdOpt will only have anonymous information for proof of consent, a copy of which you have already received in the email.
    
    #### b.2 – If the data subject has also provided an email, you should use this data to exclude them from all other systems, using it as an access key through your data mapping.
    
    #### [– Here's an article on data mapping](https://goadopt.io/blog/mapeamento-ou-inventario-de-dados-lgpd/)
    
    #### b.2.1 – If it's in your processes to notify that the deletions have been made, use the data subject's email for this notification.
    
    #### b.3 – The data subject is notified through a pop-up and a link in the email footer that directs them to an educational and public environment that teaches them how to manually delete cookies from their browser.
    
    #### [– Here's the tutorial sent to the data subject](https://goadopt.io/blog/apagar-cookies-cache-navegador/)
    
    #### c – AdOpt maintains this record in its database, indicating that the CookieID #xyz.example.1234 made a request at that moment (date/time). So, if you need it for legal bases and privacy audits, it will be easily accessible.

This is a fairly comprehensive breakdown of the process!

If you feel that any part of how a cookie banner works is missing, please feel free to write to us [here](https://adopt-help.freshdesk.com/support/tickets) or leave a comment for us!

Thank you very much! The [AdOpt Team](https://goadopt.io/).

How does a cookie banner operate?

More than 30,000 people use [AdOpt's cookie notice](https://goadopt.io) daily to comply with various privacy regulations around the world.

In our "**Big Dream**," all goals and aspirations point toward a global operation.

Today, we can confidently say that AdOpt is getting closer to this goal every day!

#### Assisting small businesses worldwide in respecting the privacy of internet users.

The [Cookie Plugin for WordPress](https://wordpress.org/plugins/adopt/#description) is a crucial element in our global expansion strategy!

## One of the largest website-building platforms in the world!

The WordPress platform powers nearly 450 million websites globally, and it's estimated that 50% of Brazilian websites are on this platform. In other words, there are many people using and contributing to the community daily!

But getting here wasn't easy!

The initial sketches of the plugin began in 2020. At that time, AdOpt was virtually unknown, and very few believed that [LGPD](https://goadopt.io/blog/en/lgpd-general-data-protection-law/) would actually come into effect. So, as we always prioritize transparency, agility, and quality, our plugin, on one of the world's largest platforms, couldn't be "just another one."

Therefore, we outlined some key objectives that would lead us to develop our Cookie Plugin for WordPress with excellence!

- **Implement Version 2 of the Platform, more robust and scalable** - Released in Dec/2021

- **Allow AdOpt users to comply with multiple regulations and languages!** - Released in Apr/2021

- **Provide more autonomy and flexibility for our customers to customize 100% of the Cookie Notice text as needed** - Released in Apr/2021

We have listed the above points as the pillars of our minimum requirements to offer a good plugin worthy of the WordPress community. We believe that in doing so, we reinforce our value of providing "[compliance with LGPD, GDPR, and CCPA... even with the free plan](https://goadopt.io)"!

At AdOpt, we are obsessed with a platform that is always easier and more intuitive for users.

So, know that many more exciting features are yet to come!

We are working tirelessly to expand our integrations and partnerships so that anyone, even without any coding or programming experience, can confidently ensure their websites comply with all the world's privacy laws with just a few clicks.

## Want to install the [Cookie Plugin for WordPress](https://wordpress.org/plugins/adopt/#description) from AdOpt on your website?

Below is a tutorial to help you!

1. Install the [Cookie Plugin for WordPress](https://wordpress.org/plugins/adopt/#description).

2. Simply copy the ID of your Cookie Notice from AdOpt.
![Fast tutorial WP 1.png](https://strapi.goadopt.io/uploads/Fast_tutorial_WP_1_4184f033e9.png)

3. Activate the Plugin and paste the Notice ID.
![Fast tutorial WP 2.png](https://strapi.goadopt.io/uploads/Fast_tutorial_WP_2_e1742f229f.png)

4. Save.

5. That's it! The plugin will automatically install AdOpt's tag on your site.
**No coding, no complications.**

#### If you have any questions, here's a [**more detailed tutorial**](https://goadopt.io/en/support/integrations/wordpress/adopt-cookie-banner-wordpress/) for your reference, okay?


We've created a cookie banner plugin.


Choosing a [CMP (Consent Management Platform)](https://goadopt.io/blog/en/what-is-a-cmp/) is a great way to make efforts to adapt to new privacy regulations like [GDPR, [LGPD](https://goadopt.io/blog/en/lgpd-general-data-protection-law/) (Brazilian General Data Protection Law), and CCPA](http://goadopt.io/). This, which is one of the main tools for compliance, can be the solution to avoid the dreaded fines that regulations foresee.

But, for it to really fulfill the promise, the CMP must meet certain requirements, as well as quality in services. So, how do you choose the best option?

You'll find the answer below. We've brought everything you should look for when getting a consent management tool.

Oh, a spoiler: at the end, we'll tell you which one is the best.

## How to Choose a CMP? Look for Key Points.

CMP stands for Consent Management Platform, in plain English. It's a tool that aims to assist in managing the collection of consents and their use in accordance with the user's authorization.

That's why it becomes even more important in times of LGPD! In addition to helping comply with the law, it's also important for building the website's image, showing how it cares about user privacy.

This platform is capable of managing all the authorizations a visitor gives to a website during their visit. With this, it becomes the database for guiding the brand's actions based on that information. Below, see how to choose one successfully.

## Look for a CMP That Provides Rich Information.

First and foremost, it's important that the platform you choose provides rich information. The CMP is not just a cookie banner but a data usage and consent management tool.

Therefore, it's important that it includes other information related to data.

So, the best CMP is the one that provides complete information that includes access to the Terms of Use, [Privacy Policy](https://goadopt.io/blog/existe-politica-de-privacidade-ideal/), and a detailed [Cookie breakdown](https://goadopt.io/blog/cookies-e-lgpd/) with the option to customize them. That is, to choose which permissions the user wants freely.

### [Learn more about best practices in Tag Classification for GDPR, LGPD, CCPA, POPIA...](https://goadopt.io/blog/en/best-practices-in-tag-categorization/)

## Prefer a CMP That Allows Customization of Consents One by One.

It's not enough to have a cookie banner where the user can give permission for their use. It's also necessary that they can customize which ones they accept to be used by the website and which ones they don't.

In this way, avoid platforms that only offer an "all or nothing" consent option.

## Think Beyond Your Country.

Have you investigated how many people access your website from other countries?

Did you know that this will make all the difference when choosing a CMP?

The fact is, when someone accesses a website from another country, the legislation of the visiting country may override that of the website owner's country. In other words, LGPD may be overridden by GDPR if someone accesses a Brazilian website from Europe, for example.

How is that possible? It all depends on the aspect analyzed and which legislation is more "pro-privacy" or "pro-citizen." Thus, a great feature brought by CMPs is the automatic detection of access origin. That is, if someone accesses your website from another country, the collected consent will be 100% adjusted to the visitor's legislation, avoiding any conflicts and increasing your security.

If you're not familiar with the concept of [Privacy by Design](https://goadopt.io/blog/en/what-is-privacy-by-design/), this can help you understand these aspects.

## Know What Type of Data Security the Platform Provides.

The CMP you choose will have access to user data because, in addition to managing consent, it also helps manage the data collected regarding the types of consents they received.

Therefore, it's crucial to know what tools and security strategies this platform uses. In other words, how it ensures data security against leaks.

Ideally, the platform should use data encryption, as well as other types of data security protocols and tools that are essential when it comes to data processing.

## Customize Visual Preferences of the Banner

The design of your website matters a lot. Therefore, when choosing a CMP platform with a [cookie banner](https://goadopt.io/blog/por-que-do-aviso-de-cookies/), it's important that there is an option to customize it. That is, to match it with your site's design. So, prefer platforms that offer this possibility.

Naturally, the CMP reflects the company's perspective toward visitors. But what's the visitors' perspective toward the company? When we put ourselves in the shoes of a visitor accessing the site, the design's simplicity and lightness speak volumes!

## Get to Know the Platform's Reputation in the Market.

Also, be sure to know the platform's reputation that caught your attention. Analyze the types of websites that use it, for example. Similarly, don't forget to do some research on potential data leaks, for example.

Or, on issues with data security or even platform usability. All of this is important, especially because the CMP becomes an essential figure in complying with [LGPD, GDPR, CCPA, POPIA...](http://goadopt.io), the list goes on.

Through it, you can obtain consents and manage them in a way that data will always be used correctly. That is, within the limits of consent given by the data subject.

Is the CMP you're researching known for good customer service? What will happen if you need to talk to them and ask questions? Or if some authority questions the consents collected, will they be on your side?

## So, What's the Best CMP Platform?

Now that you know what's relevant when looking for a tool for LGPD, it's time to find out where to find all that support and structure.

The best solution when it comes to a consent management platform is AdOpt! Our tool can manage all the interactions a user has with the site regarding the authorizations they grant.

Furthermore, it features a simple and intuitive cookie banner that's easy to use. In it, you can not only find information about cookie usage but also customize the consents given to the page, as required by the law.

At AdOpt, the [cookie banner](https://goadopt.io/blog/en/why-the-cookie-banner/) is adjusted according to the visitor's country, ensuring that the smallest details comply with your site globally.

Likewise, you'll find links to the Privacy Policy and Terms of Use, with the possibility to consent to all of this in one place. That is: complete information to the user, organization, and ease of operation.

Additionally, the platform uses cutting-edge technology. With the use of encrypted data, we ensure the security of the information collected. That is, its confidentiality and protection against leaks.

Finally, AdOpt's reputation as a tool for LGPD, GDPR, and CCPA is unquestionable. After all, we're present on highly relevant websites like **Exame**, **Metrópoles**, **Baixaki**, **GoPro**, **TecMundo**, and others.

So, don't hesitate to rely on AdOpt when hiring a consent management tool for your visitors and customers. With this, you have all the information organized and secure for data usage in accordance with LGPD.

Want to know more about [how a cookie banner works](https://goadopt.io/blog/en/operation-of-cookie-banner/)?

I've prepared this article for you!

How to Choose a CMP (Consent Management Platform)?

How does your website handle LGPD, CCPA, GDPR...?

What strategies does it use to comply with the LGPD [_General Data Protection Law_](https://goadopt.io/blog/en/lgpd-general-data-protection-law/)? Have you thought about using a [cookie banner](https://goadopt.io/blog/en/why-the-cookie-banner/) but don't know if your site has [cookies](https://goadopt.io/en/blog/lgpd-cookies-all-you-need-to-know/) or if it's enough? If you can't answer these questions, be cautious! Your page may be exposed to fines and other sanctions.

Below, check out 5 signs that indicate your strategies either don't exist or aren't working as they should. So keep reading to ensure the necessary compliance of your site with the principles of the law that regulates data consent.

## 5 Signs You Need an LGPD Consent Strategy Right Now

Check out the top 5 signs that your website isn't in compliance with LGPD and then see how to start your adjustment!

## 1 - You Have No Control Over the Data You Collect and Use
This is an undeniable sign that you need to reconsider how you view LGPD. After all, it regulates the use of third-party data.

It requires respect for user privacy and their consent. Therefore, data usage should always be informed. Not only that, but also the purposes to which it is directed, the way it is stored, and the period of use.

So, consider that if you don't know what data you collect, how will you inform the visitor? Furthermore, how will you ensure that the use of this information complies with the limits imposed by the data subject?

These are important questions that indicate that something is not right on your website regarding LGPD and its requirements.

LPs created without control, rich content available for download without accepting terms and policies, mailing lists being shared and passed from campaign to campaign... Be cautious!

I've separated this article for you, in case this is your situation:

[Understand the meaning of LGPD for your company.](https://goadopt.io/blog/en/lgpd-meaning/)

## 2 - There's No Information About the Use of Cookies

Cookies are another type of data that, in principle, should be informed by websites to their visitors. After all, they also capture information about these data subjects and, therefore, fall within the concept of data usage that LGPD addresses.

The use of cookies is almost natural for most websites, especially if they come from e-commerce platforms, for example.

_### To check if your site triggers cookies, access it from a computer and - in Google Chrome, click on the padlock just to the left of the address. It should show exactly which ones and how many there are._

However, many pages fail to see cookies for what they really are: data files and personal information. Therefore, the absence of this communication to your site's visitors is dangerous as it can be a violation of the law.

In fact, not just that, but the collection of them without prior consent is also a violation. You know that "We use Cookies" pop-up? Well, it's not there for no reason.

It's a way to comply with LGPD as it informs the use of this type of file while capturing authorization to use them.

- In this article, I help you understand more about [consent as a Legal Basis of LGPD.](https://goadopt.io/blog/en/legal-bases-of-lgpd/)
- In this one, [how to choose an appropriate CMP - Consent Management Platform for your website.](https://goadopt.io/blog/en/how-to-choose-cmp-consent-management-platform/)

## 3 - Generic Privacy Policy and Terms of Use

Your site probably has documents such as Privacy Policy and Terms of Use. They inform, respectively, the use of visitor data (and capture authorization for it) and the prevailing rules, rights, and duties.

Therefore, they are very important, especially in the time of LGPD! They stand out for their informative content to promote transparency with the data subject.

It is up to the data subject, then, to accept or not the conditions therein. In this sense, it is worth noting that the site may suspend access to some services, for example, due to a lack of acceptance of the rules and conditions. And that is natural since some of them are only possible with the authorization to use certain data.

Either way, these are important documents. But they shouldn't just be there. They should be specific to what the site offers and how it operates. So if you made your terms and policies based on Ctrl C + Ctrl V, pay attention!

It's time to review these documents and rewrite them to make them compatible with the reality of the site. Also, to fill gaps and clarify data usage. Below, I've separated a few more articles for you:

- [What is a Privacy Policy?](https://goadopt.io/blog/en/what-is-privacy-policy/)
- [What's the Ideal Privacy Policy for Your Company?](https://goadopt.io/blog/en/is-there-an-ideal-privacy-policy/)
- [What are Terms of Use in LGPD?](https://goadopt.io/blog/en/terms-of-use-lgpd/)

## 4 - Data Loss or Data Breach

When it comes to data loss, it's time to sound the alarm. Data breaches are a clear sign that your LGPD strategy needs urgent correction or revision.

After all, it should be developed to maintain the confidentiality of data and their use in accordance with the data subject's consent or the [legal basis](https://goadopt.io/blog/en/legal-bases-of-lgpd/) chosen. Also, to ensure the protection of this information.

Data breaches are compromising! They can tarnish the company's reputation and often that of its customers and suppliers as well. Furthermore, the company can be held responsible for them and, as a result, face significant sanctions, including hefty fines.

[**Understand the difference between Data Controller and Data Processor in LGPD here.**](https://goadopt.io/blog/en/differences-operator-controller-of-data-lgpd/)

And it's not just data loss itself. The lack of a clear plan of action in the event of information leaks is also an indication that you urgently need to work on your LGPD strategies. Below are some more articles to help you with this review:

- [Data Mapping or Inventory in LGPD, the DPO's life jacket.](https://goadopt.io/blog/en/data-mapping-or-data-inventory-lgpd/)
- [How to Adapt Your Marketing to LGPD](https://goadopt.io/blog/en/how-to-adapt-digital-marketing-to-lgpd/)
- [10 Risky Processes in Your Marketing](https://goadopt.io/blog/en/10-risky-processes-in-your-marketing/)

## 5 - Absence of Designation of a Data Protection Officer

Finally, the last sign that your website needs an LGPD strategy is the absence of the designation of a Data Protection Officer or DPO (Data Protection Officer) for the processing of data on your site.

This figure is a requirement of LGPD and, according to the law, is responsible for controlling and managing data processing. They carry out tasks determined by the Data Controller.

They are also the ones who handle complaints from personal data subjects, provide explanations, and communicate with them. Similarly, they control the entry and exit of consents, so they take the necessary actions to ensure compliance with authorizations. In this article, I explain more about [the responsibilities of a Data Protection Officer or DPO in LGPD.](https://goadopt.io/blog/en/responsibilities-of-a-data-protection-officer/)

## So, how about adapting your site to LGPD?

If you have recognized that your site falls into any of the signs above, it's a sign that you should take action to align it with the law. Otherwise, you may face [fines](https://goadopt.io/blog/en/fines-in-lgpd/) and other penalties that could even lead to the suspension of your page's activities.

Not to mention the impact on your brand's image in the eyes of the public, as someone who could care more about data privacy.

So, it's more than time to review your privacy strategies in the face of LGPD. For this, count on [AdOpt](https://goadopt.io/), which helps you not only organize them but also control the entry and use of data, as well as consents about them.

5 Signs Your Website Needs an LGPD Consent Strategy

Have you ever noticed that every time you sign up for a service to access information or register on a website for purchases, you need to give consent? If you're wondering why you have to give consent on every website you visit, you'll find the answer here.

Even though this consent is often "automatic" and happens without you thinking about it (which it shouldn't), it is very important. After all, it is a legal requirement that applies to the website and pertains to the security of your data.

Since data is becoming increasingly important and data breaches can cause significant harm, understanding what you're consenting to and what it means is indispensable. So don't miss the opportunity to learn more about this topic!

## With LGPD, Silence Doesn't Imply Consent

To understand how consent has become so important regarding data collection and use in the online environment, we need to go back to August 2020. That was the month when the [General Data Protection Law (LGPD)](https://goadopt.io/blog/en/lgpd-general-data-protection-law/) came into effect.

It was introduced as a response to the need to protect data shared on websites and collected by web pages, as well as to regulate their processing. Notably, in recent years, massive data breaches of personal information, such as the Facebook breach, have alarmed users.

Therefore, privacy laws like [GDPR, LGPD, CCPA](https://goadopt.io/blog/en/gdpr-lgpd-and-ccpa-what-are-these-laws-similarities-and-differences/) have consolidated the notion of consent for data usage. In other words, all websites that use cookies and collect data from their users for any purpose (such as marketing) not only need to inform but also ensure agreement.

This happens when you access a website and need to grant permissions for cookies, for example. Even though cookies are just one form of information collection, they are a good example of consent.

The same thing happens when you access a page where you need to enter personal data. For example, when subscribing to a newsletter and landing pages. Similarly, when registering for a purchase. In these cases, there's always a box that says "I agree to the [terms of use](https://goadopt.io/blog/en/terms-of-use-lgpd/) and [privacy policies](https://goadopt.io/blog/en/what-is-privacy-policy/), " right?

Know that in all these cases, consent is given for the use of your data. It relates to the company's security and information treatment policies, as well as which data is used, when, how, and for how long.

Of course, there are other [legal bases](https://goadopt.io/blog/en/legal-bases-of-lgpd/) that also ensure the correct use of citizens' data. However, for many, consent ends up being the quickest and most accessible option in their business flow.

[**### Discover how to adapt your digital marketing to LGPD.**](https://goadopt.io/blog/en/how-to-adapt-digital-marketing-to-lgpd/)

## What is the importance of the consent policy for the website and the visitor?

The consent that you might be tired of giving - but shouldn't, as it concerns your security - is important for both websites and you, as well as other visitors and users.

Well then, let's start with the visitors because the preference is theirs! For them, consent is important because it's only through it that the companies behind the websites can use their data. They can use it only within the limits stipulated, both in terms of time and application.

So, if you have the habit of giving consent to websites without carefully reading the terms beforehand, it's time to change that approach! The use of your data is important and relates to your security (including financial security!).

Therefore, it's important to be aware of what you're allowing and what the company's policies are for protection purposes.

In this sense, it's necessary to pay attention to two different text documents: the Terms of Use, regarding the rules of service utilization responsibility and limits of duties and rights; also, the Privacy Policy, which concerns the treatment of information and security details.

On the other hand, the consent you give to websites is also important for them, obviously. After all, this is the only way they can really use the data (within the informed and consented limits) in accordance with LGPD.

Learn more about [how the cookie banner work](https://goadopt.io/blog/en/operation-of-cookie-banner/)!

Moreover, LGPD imposes significant [penalties](https://goadopt.io/blog/en/fines-in-lgpd/) on those who violate it. In this regard, it can impose warnings as well as [fines](https://goadopt.io/blog/en/fines-in-lgpd/) that can be quite high! It can also lead to restrictions on data collection and the banning of the page.

## What types of pages need to obtain visitor consent?

The vast majority of websites that collect data in some way and use cookies need to obtain consent from their users. There are various types of data collection, ranging from cookies to voluntary information acquisition through page registrations.

In this sense, all pages that use tools for analyzing results and metrics, such as Google Analytics, already have a duty to obtain consent from their visitors for this.

Similarly, landing pages, contact pages with user information disclosure, and other data registration forms will always need policies of agreement regarding data collection and usage.

Especially when, according to the company's business model, other [legal bases](https://goadopt.io/blog/en/legal-bases-of-lgpd/) are weaker in terms of data usage rationale. Thus, consent ends up being an excellent option.

## Cookie Banner

Firstly, one of the methods for obtaining consent is through the Cookie Banner, right on the page.

In this case, the page's opening must clearly inform the use of cookies and allow the visitor to configure their preferences and give their permission. Only after consent, the cookies can be triggered.

[### **How to configure third-party cookie blocking in AdOpt?**](https://goadopt.io/en/support/essential-setups/3rd-party-cookie-blocking/manual-third-party-tag-blocking/)

For this purpose, your website can rely on AdOpt. With our tool, your cookie usage policies are always clear to the user. In addition, alongside the banner, you can configure the blocking of third-party cookies, multi-languages and legislations, text customization, positioning, colors, and images.

[_Have you heard of the ROPA document in LGPD? 
It's essential and can help you a lot in your compliance!_](https://goadopt.io/blog/en/ropa-for-lgpd/)

## Terms of Use and Privacy Policy Notices

The other method of applying consent policies on a website is precisely on pages dedicated to contact forms, landing pages, and site registration. Using those "I have read and accept" checkboxes.

In this case, it is essential that the user has access to the documents that reveal them and that they must allow the use of such information before continuing their online action.

Therefore, always make sure that these notifications halt the process. This way, only data that truly has the visitor's consent is collected.

If you are an [AdOpt](http://goadopt.io/) customer, our technology allows this online form consent collection to be integrated into the platform as a whole. This means that your CRM has another field fueled by visitor consent.

Want to know how? Just chat with us or schedule a presentation conversation [here](https://calendly.com/valquiriaadopt).