## Want to understand why there are cookie banners on every website you visit today? This article is for you!

Cookie banners, cookie notices, GDPR notices or Privacy Notices… call them what you want. (We’ve even heard them called “that boring legal notice,” but more on that later.)

In fact, all the world’s largest and most serious companies have already added a cookie banner to their website, and this is for a good reason: GDPR, LGPD, CCPA and many others are live!

Completely inspired by the GDPR ,the LGPD in Brazil, as it’s commonly known, is a regulation that was created in 2018 specifically to address the way that personal data, such as a user’s name, e-mail, telephone number, address, etc.,  is collected and utilized by companies.

## The GDPR, LGPD…CCPA and cookie banners are here to stay!

Why does the GDPR require cookie banners? Does every website now need a banner?

The LGPD, as said, was inspired by the European Union’s General Data Protection Regulation (GDPR), and similar laws are already being enacted all over the world. Even North Korea now has its own privacy regulation! That is to say, this is not a passing trend and must be taken seriously. 

This shift does not necessarily mean more bureaucracy, but it does mean real empowerment. Thanks to these new privacy laws, ordinary citizens now have the right to authorize, deny, or even revoke companies’ ability to use their data!

## You mean I didn’t already have the right to decide what happens with my data?!

Don’t worry, we can explain! 

The answer is not that simple, as this law needs to function in parallel with innumerable others that also govern individual rights, including consumer, health, and internet law, among others. 
Keep going, it will be worth it! Soon you’ll be able to speak like an expert on this subject. 

With the advancement of advertising technologies that are linked to [digital marketing](https://br.sharpspring.com/marketing-digital/) and the exponential growth of social media, everyone now has a machine that generates and stores valuable data in the palm of their hands: cellphones. Every time an individual accesses a website, e-commerce account, Instagram, Facebook, or any similar platform, the visit generates data that is collected and stored by cookies. 

Cookies are simply text files that are capable of storing information generated by websites. 

## Want a practical example of cookie technology? 

I'm sure you know when you enter a website through your browser and it recognizes that you’ve already accessed the page before, allowing you to re-enter the site without signing in again? This happens because your browser has already stored a cookie from that site which can authorize your access. 

In the same way, cookies can also store data like which photos you’ve liked on Instagram or if you “forgot” a product in your shopping cart. All of this information is saved for later use.  

## And this is very valuable! 

Did you know that a person needs, on average, at least six interactions with a product or service before making the decision to purchase? 

It’s no wonder that when you “forget something in your shopping cart,” the product seems to follow you all over the internet with ads. Only then do you end up making the purchase. Is this a coincidence, or magic? 
Neither, these are the processes and technologies that utilize cookies for advertising.

If you’ve been through this, welcome! You’re in good company. 

Simply put, cookies are a piece of the wheel that moves the internet. It’s the use of data for advertising that allows us to consume the content that we love for free. After all, who do you think pays for that cool, free YouTube video? Advertisers! And now you know they use cookies to find you on your favorite channel. 

The use of cookies is not necessarily positive or negative, but it reached a point where individuals like you or I were not fully in control of what the internet giants were doing with our data. This is why privacy laws like the GDPR, LGPD and CCPA were created: to rebalance the relationship between companies and people.   

Ok, but weren’t you going to talk about data, privacy, and the rights I have? 

Yes! When the LGPD was enacted by Brazil in August of 2020 it forced companies to examine the way that they handled the plethora of consumer data generated by their business, and to make changes to their processes and databases. One of these changes was the obligation to inform visitors of the reason for their data collection, as well as the legal basis for it. 

Thus, in accordance with the LGPD, GDPR, CCPA and several others, every business must present a clear and objective communication that informs visitors of their purposes for collecting personal data. Whether on or offline, it is essential that every citizen is notified of the collection of their personal data as well as the many ways it might be used. 

As for us data “subjects,” as some law refers to us, we are now able to make a “free, informed, and unequivocal declaration,” as to whether or not we permit its use. That is to say, if we consent to the terms outlined by the business, we authorize them to use our data. In Brazil, for example if businesses violate this flow by collecting data without consent, they could face serious consequences including being fined up to 2% of their annual revenue, with a ceiling of 50 million real. Has your business ever considered the threat of being fined simply for not having a cookie banner on its website? 

Want to understand exactly how the GDPR, LGPD and CCPA impact your business? Here are some articles on the subject.

## But how do I know what they already do, or will now do with my data? Will the cookie banner tell me? 
Who among us has actually read the privacy policy or terms of use of a website we use? Not many, but it’s precisely in these official documents that these answers are found.

According to the Privacy Laws, businesses must comply with certain official documentation requirements and legal basis to inform users of their entire data collection process and its purposes. Well-known by lawyers, the “Privacy document kit” fulfills the standard that every company must meet, including a privacy policy, terms of use, data mapping, and contact information of the DPO, among others.

## Now the good news! 
These documents don’t need to be written in “legalese,” nor should they be, as LGPD, GDPR and CCPA requires that the information presented be “clear and accessible.” A user cannot consent to the collection of their data if they cannot understand the banner. 

What’s the use of a company acting cool in its marketing and communications, or speaking beautifully in advertisements, if when addressing privacy and transparency it starts speaking in code? It doesn’t make sense, right?

Anyway, this article aims to inform you that, along with the laws like GDPR, LGPD and CCPA, we also have new rights and duties, both as citizens and, especially, as companies. In this matter, the cookie banners actually serve a noble purpose! Businesses that use these banners correctly are able to show customers that they care about their individual rights, freedom of choice, and privacy. 

## A good cookie banner should meet certain minimal requirements outlined by the GDPR, LGPD and CCPA: 

Inform users clearly and objectively of all of the ways in which the company collects consumer data. 
Point to official documents such as the privacy policy, terms of use, etc. (referring back to the Privacy document kit mentioned above). 

List the options that you as the data owner have to fully or partially accept “the rules of the game” with that company, thus allowing you to receive their content or consume their products or services. 

Make it clear where, upon accepting the cookies, you could access the data that the company will gather about you, and how to opt-out if you change your mind. 

Allow users to consent to the data collection in a way that is free, informed, and unambiguous. 

**Last but not least:**

When you see the banner: “If you continue browsing, we understand that you consent…” know that the law has determined this to be insufficient, and there are several arguments why. Mainly, this banner without further detail does not give the visitor enough information to give their consent in a manner that is “free, informed, and unambiguous.”

We hope this article helped you to understand the “why” of the now popular cookie banners, which will soon be installed on all company websites. With this new regulation, there is no going back. 

## We’ll leave you with two final invitations: 

1. Do you know a business that needs to know more about cookie banners?

Again, any and all companies that collect personal data, such as name, email, or telephone number on their site, and use third-party services like the Facebook pixel, Google Analytics, etc. MUST include this banner.

We at AdOpt are experts in cookie banners and can help them today! And even better, for many it’s free! Send this article to whoever you know that could use this content. They will thank you when they avoid an unpleasant fine!

2. Want to dive deeper into the subject of cookie banners?
We’ve got more articles for you [here](https://goadopt.io/blog/significado-da-lgpd/) para você:).



Why are cookie banners everywhere?

João Bruno Soares

It's time to talk about one of the most impactful tasks, both for the company and for the visitors of your websites: tag categorization. But why is it so impactful? What is the relevance of this configuration and how can it affect us? It is precisely because of these common questions we receive from our clients that we have written this article on best practices in tag categorization.

## What is a tag?

To start off on the right foot, let's clarify some basic concepts that will help situate each one of you at AdOpt and in the market as a whole.

In a straightforward manner: **1 Tag = Trigger for 1 or more Cookies.**

What does that mean?

Basically, most Tags or pixels – as they are also known – when installed in the HTML of a website, are responsible for triggering cookies for each visitor on that specific page. A Tag can perform various functions such as tracking button clicks, page scrolling, collecting text fields, always associating these behaviors with that specific visiting browser.

Once this is possible, the way the Tag stores the data generated by the visitor is:

- Sending it to their server (the service provider's server that created the Tag) and;
-It can also record all the information in cookies that it generates and stores on your machine.

For example, when we visit an e-commerce website and it recognizes that we are returning after a previous visit, showing products that are of interest to us, it happens thanks to cookies and tags doing their job. In summary, 1 Tag can trigger N cookies and perform N functions.

Ultimately, the Tag itself is not inherently good or bad; it all depends on its application.

## What is tag categorization?

Categorization involves the work of the Data Protection Officer (DPO) in organizing all the tags installed on the website(s) under their responsibility into specific categories that represent their purpose and reason for being there.

Since GDPR, which was the pioneer in this regard, the market has created "standard categories." These categories are:

- **Essential / Necessary**: Without them, your business model or website does not function, or you are required to use them by law or regulations.

- **Marketing / Advertising**: With them, you can trigger re-marketing, populate ad pixels, automate email sequences, etc.

- **Statistics / Analytics**: With them, you have an analysis of what visitors do, where they come from, and how they behave on your website.

- **Performance**: Tags that maintain website functionality, ensuring its operation and response speed. For example, they can prevent DDoS attacks.

- **Functional**: Tags that handle functional aspects, such as remembering preferences or recognizing that you are already logged into the system, chatbots.

In other words, each company may have a group of tags installed on its website, with their purpose described and detailed in the Privacy Policy (or cookie policy). This purpose should be replicated in communication with visitors - the cookie banners - as well as in all processes that use this data.

## Why categorize tags?

Many companies use cookie banners that do not organize tags or cookies into specific categories, forcing visitors to accept all tags without distinction.

This poses a significant risk of fines for your operation since various regulations require that consent be specific and detailed for a particular purpose. In the LGPD, for example, Article 5, Item XII is clear:

> #info XII - consent: the free, informed, and unequivocal expression by which the data subject agrees to the processing of their personal data for a specific purpose.

This is one of the reasons why AdOpt has always worked with a design that prioritizes freedom for all visitors to navigate through categories and their respective tags.

## How to differentiate the function of each tag?

Certainly, the market already anticipates some purposes and their respective categories. However, it is worth noting that this step often involves areas of the company that go beyond those apparent on the website. A collection made through cookies can be the operational basis for an entire department and all processes within a company.

This means that, although the market already provides a standard for the category of each tag, especially the most popular ones, data controllers must adjust this difference within the company's operation, ensuring the reality of the situation and primarily supporting such choices with the chosen legal bases.

Therefore, even though there is a standard, companies are free to adjust the facts and must be prepared to respond to them with complete clarity to individuals.

That's why at AdOpt, when tags are scanned, some of them already come with a pre-classification. However, this does not prevent the data controller of a specific company from adjusting this categorization according to their Cookie and Privacy Policy.

As a platform, AdOpt cannot enforce a specific configuration or principle. However, it values freedom within its environments so that the responsibilities of the data controller are respected at all times.

## What do privacy regulations say about classifying each type of tag?

Privacy regulations do not delve into this "micro" analysis of tag categories. It would be impractical for national authorities to issue a classification opinion for every new tag that emerges in the market.

Thus, it is up to companies to ensure that communication is clear, objective, and respects the aspects of freedom and purpose already mentioned. Naturally, the market adjusts and creates standards and even specific terms for each of them.

For example, the terms "Essential" or "Necessary" are not determined by law. However, these terms help in quickly understanding their purpose, which is why the market has adopted them. The less confusion in this regard, the better. After all, subjectivity exists in all places and contexts. If we can avoid these points with a certain "standard," we minimize these variables.

## Where to apply and/or replicate this information?

As mentioned earlier, the categorization of tags is an organization that should reflect the operational purpose of using that data. Therefore, before a conceptual application, it should have a practical use that mirrors this classification.

However, it is worth noting that this classification is often explained or expanded upon in official company documents such as the Privacy Policy and Cookie Policy.

In addition, a crucial aspect directly related to tag categorization is the configuration of blocking third-party tags according to the visitor's choice. In other words, the cookie banner only allows a certain tag to be executed after the visitor's consent.

What does that mean?

Each visitor is free to choose whether or not to consent to that group of tags declared by the company. Therefore, their will is respected when cookies are only stored upon "free, informed, and unambiguous" consent (without ambiguity, clear, without equivocation).

**That's why AdOpt advises all users of the tool, without exception, to configure the blocking of third-party tags. Only with this configuration in place will the banner be complete and properly installed.**

Here's a tutorial for configuring the blocking of third-party tags on your website.

## Why do some websites don't block third-party tags?

It is not up to AdOpt to judge why a particular site, and even its clients, have chosen not to implement this configuration, even though it is constantly reinforced in our communication and classified as "essential."

Certainly, such a decision harms the image of both the company and even AdOpt. However, it is important to remember that prior to this setup, each tag has a unique function within each company, in its unique environment and context. Imposing a technological mechanism by AdOpt would go against the freedom of choice for its clients in the interpretation and application of the law that applies to everyone.

Keeping in mind the necessary proportions and equivalences, let's consider an example. It would be like holding vehicle manufacturers responsible for cars that have the capability to exceed the speed limit. The automaker can install alerts, reinforce communication in various ways. But they can never impose that a citizen does not drive according to their freedom of choice.

## Last point, as a golden rule!

**Always align the Actual Use of data with Processes, Documentation, and Communication.**

**Process: **The data collection declared for a specific purpose should indeed have the same destination and use of data within your company.

**Documentation**: Official documents should always be up to date and truly reflect the practices within the company.

**Communication**: The tag classified as Necessary or other classifications should indeed be necessary. The tag should not be classified as "essential" just because visitors cannot block it. This would be an attempt to bypass the freedom of individuals accessing your website.

The same market that creates classification standards for certain tags is also capable of judging the truthfulness of intentions and facts declared by your cookie banner on your website.

Always remember that people come before companies. The LGPD (General Data Protection Law) was created precisely to better balance the relationship between companies and citizens. After all, privacy is a universal right and should not only have value when it is lost.

---

Did you feel that something was missing or need further explanation?
Let us know at [hey@goadopt.io](hey@goadopt.io), and we'll be happy to discuss the topic further with you!


Best practices in tag categorization

While internet cookies, commonly referred to as just "cookies," are widely recognized today, some companies also use Local Storage and Session Storage as other methods used by programmers to store persistent information in a visitor's browser. However, what's the main difference between cookies and local storage, and why choose one over the other? This article will help you with these questions!

As mentioned earlier, [Cookies](https://goadopt.io/blog/en/cookies-and-lgpd/), Local Storage, and Session Storage are methods used through programming languages to store information in a website visitor's browser.

In other words, they store information in your browser about your access and how you navigate the website. Many of these have been used maliciously, even capable of storing all the information entered in text fields in forms, for example.

## Relax, cookies and local storage aren't synonymous with invasion of privacy.

Few people know that cookies were originally developed by hackers to capture people's data on the internet. Later, this technology gained a commercial purpose and is now widely used across the web.

Before you get alarmed or want to reject all internet cookies and storage, remember, they make your life much easier.

Thanks to them, your products stay in the shopping cart when you switch tabs or go back to the store to add more items.

They keep a pre-filled form in case there's a connection glitch, preventing you from starting over.

And they also welcome you by recognizing your previous access, without needing to log in to your account hundreds of times a day.

## What are the Key Differences Between [Cookies](https://goadopt.io/blog/en/cookies-and-lgpd/), Local Storage, and Session Storage?

Now that we've discussed the similarities, let's delve into the differences using three main criteria: **storage capacity, storage location, data persistence, and performance.**

**- Storage Capacity**

This capacity usually varies between browsers. In general, cookies can store up to 4096 bytes or 4KB, while Local Storage can handle 5MB, and Session Storage ranges from 5MB to 10MB.

Moreover, there's a maximum limit on the number of cookies per domain, and it's not recommended to exceed 30 cookies.

Some browsers, such as Opera, will prompt the user to allow more data usage when this limit is reached.

**- Storage Location**

Cookie information is stored in both the browser and the originating server of the referenced service.

Local Storage and Session Storage use only the browser as the storage location for data.

**- Data Persistence**

Data persistence refers to HOW and WHEN the stored information is deleted, erased, or invalidated.

**Cookies**

Cookies have an expiration date, causing the stored information to become invalid and outdated when that date is reached. However, whenever a visitor deletes cookies from a website, that information is also removed from the browser.

Some browsers automatically clear cookies periodically, and you can usually configure this in settings.

[Learn how to clear cookies and browser cache.](https://goadopt.io/en/blog/delete-cookies-cache-chrome/)

Today, due to privacy regulations like LGPD, GDPR, and CCPA, websites using these trackers must inform their visitors of their existence using a cookie notice. This technology, called a [CMP (Consent Management Platform)](https://goadopt.io/blog/en/what-is-a-cmp/), must then block cookies based on user consent.

[To learn all about GDPR, CCPA, and LGPD, we have this article for you.](https://goadopt.io/blog/en/lgpd-general-data-protection-law/)

**Local Storage**

Local Storage has no expiration date, so the information persists in the browser until the user performs a cleanup and deletion. Additionally, there are fewer browsers that offer features to block or periodically delete Local Storage data.

Regarding privacy regulations, especially [GDPR](https://goadopt.io/), the same obligation to inform its usage applies to Local Storage. Therefore, when choosing your cookie notice, ensure that it also lists third-party tracker Local Storage used on your site.

To learn more about [how a CMP works](https://goadopt.io/blog/en/what-is-a-cmp/), here's an article to help you understand.

**Session Storage**

In Local Storage, information remains stored until a deletion is performed. However, in Session Storage, the information is automatically deleted whenever the visitor leaves the site or closes the browser tab.

This is the main difference between Local and Session Storage.

**- Performance**

To analyze performance between web storage (Local and Session) and cookies, a highly technical language would be necessary. However, let's try to simplify the facts.

Every website has a visually coded part connected to a server. The server keeps the site online, and when someone accesses that URL, it operates those visual settings and responds to interactions on the screen.

This interaction is performed by the [browser (Chrome, Safari, Opera, Brave...)](https://goadopt.io/en/blog/delete-cookies-cache-chrome/)

If your browser has cookies from that site, in addition to communicating with the site's server, it must also await the server's reading of those cookies and their respective servers. This is because there may be cookies from that specific site and cookies from third-party companies installed.

Therefore, when using cookies, all requests you make to the site also depend on sending cookie information to your origin server and then to the site. Hence, simply using a cookie in your application consumes a bit more "bandwidth" and "data" to read and execute it on the site, and present it in the browser.

**In contrast, Local and Session Storage do not require this triangulation between servers, resulting in less bandwidth needed for the site to respond to the information contained in web storage.**

## How to Create a Consent Strategy as the [Legal Basis for LGPD](https://goadopt.io/blog/en/legal-bases-of-lgpd/)?

Want to learn more about [how a LGPD cookie notice works](https://goadopt.io/blog/en/operation-of-cookie-banner/)? In this link, I explain the step-by-step of the technology developed by [AdOpt](https://goadopt.io/blog/en/why-the-cookie-banner/) and used on thousands of websites.

After all, if your site uses cookies, you can't simply [ignore LGPD](https://goadopt.io/blog/en/ignoring-lgpd/). You need to choose a strategy to avoid the [fines](https://goadopt.io/blog/en/fines-in-lgpd/) associated with this new legislation.


What is the difference between cookies, local storage, and session storage?

Terms of use are an essential part of many websites, especially regarding [LGPD](https://goadopt.io/blog/en/lgpd-general-data-protection-law/). Despite being frequently overlooked, Terms of Use are, quite literally, the contract established between you and the company offering that product or service in a digital manner. Therefore, not only their development but also any eventual changes require careful consideration.

This care pertains to both the situations in which such changes can or should be applied and the manner of alteration and its consequences. In the following text, you'll find an explanation of how each of these aspects works and how to ensure the validity of your terms, as well as compliance with [LGPD, GDPR, CCPA, PIPEDA, POPIA](https://goadopt.io), among others.

## What Are the Key Topics Addressed in Terms of Use?

Before delving into why and how to make changes to the Terms of Use, let's first briefly review some of the main chapters/topics typically found in any standard document.

Based on AdOpt's own [Terms of Use](https://goadopt.io/blog/en/terms-of-use-lgpd/), the text is divided as follows:

**1. Object**

**2. Features**

**3. Contracting and Service Provision**

**4. Term**

**5. Remuneration**

**6. Service Interruption**

**7. Responsibilities**

**8. Processing of Personal Data**

Here's a brief summary of what each section covers:

1. **Object**: Identification of the involved parties and detailed description of the services provided, including their characteristics and operational definitions.

2. **Features**: In the case of software like AdOpt's, this section lists the features involved and provides detailed information within the plans.

3. **Contracting and Service Provision**: Description of the processes and necessary details for service contracting.

4. **Term**: Delivery frequency and/or product/service availability after/during purchase.

5. **Remuneration**: Explanation of how payments will be made, including pricing, payment deadlines, and conditions.

6. **Service Interruption**: Explanation of situations where service interruption is prescribed, necessary, and justified, as well as the events that may lead to interruption.

7. **Responsibilities**: Clarification of the responsibilities of both parties upon accepting the terms. On one side, the provider commits to providing the service, and the customer commits to making payments and using the system/platform as necessary for service delivery.

8. **Processing of Personal Data**: Definition of the roles of [data controller vs. data processor](https://goadopt.io/blog/en/differences-operator-controller-of-data-lgpd/) within the processes established by the contract. If data is collected, the legal basis used is specified, along with the responsibilities arising from the operation.

9. **General Provisions**: Declarations that position the contract geographically, establish conditions for possible updates, provide guidance in case one of the parties breaches the contract, and specify the jurisdiction.

## Why Change the Terms of Use?

Changes to these documents, although often overlooked, are necessary whenever there is a significant alteration in the content description. Aspects such as the nature of the service or product delivered by the company, conditions of public service, official data, and now, mandatory aspects under LGPD, all necessitate changes.

Both [LGPD (General Data Protection Law)](https://goadopt.io/blog/en/lgpd-general-data-protection-law/) and other applicable regulations specify aspects related to data collection, processing, and treatment that may be part of the service or product and, therefore, must be included in the terms of use.

Furthermore, changes are often required to align the content of the terms of use with the reality of the brand. After all, these terms should reflect the company's actual situation and not be a work of fiction.

Otherwise, there's a risk of non-compatibility between the website's terms of use and its reality, services, rules, and regulations that apply to it. In essence, it renders the terms useless.

Aspects of our lives are constantly changing, and this is also true when it comes to brands, how they operate, and the rules they are subject to.

Since the terms of use relate to these matters, any changes in them should also reflect on them to ensure they remain valid and relevant, fulfilling their role in relation to the brand.

## When Is It Necessary to Change the Terms of Use?

In general terms, changes should be made whenever one of these aspects is identified:
- Alteration in the site's mode of operation.
- Addition or modification of available services and products.
- Legal changes affecting the rules a site can apply, as well as the duties and rights it imposes.
- Inadequacy between the terms and the reality of the brand (such as its characteristics, offerings, and operations), or between the terms and current laws (such as LGPD or the Consumer Code, for example).

Therefore, there are various reasons that can lead to changes in the terms of use. All of them are relevant, especially to maintain the validity of this document and its applicability.

## Do I Need Authorization to Change the Terms of Use?

Yes! The terms are among the documents that clarify to the public what the rules are in that space, meaning on the website.

They join the [privacy policy](https://goadopt.io/blog/en/is-there-an-ideal-privacy-policy/) and the cookie notice to promote transparency with the user. While the terms indicate the applicable rules, rights, and duties, the policy pertains to privacy and data usage, which cookies are also part of.

All these documents are important because they assist in complying with LGPD regulations. Transparency is at its core.

Therefore, it wouldn't make sense for changes to the terms of use to occur without the consent of the user, right? It's not necessarily about authorization; after all, it's up to the user to decide whether to accept the terms, thereby maintaining access to the site's services and making their information available or to forfeit this and withdraw their consent.

In conclusion: whenever there are changes in rules and policies that affect users and data subjects, they must be notified to express their acceptance or rejection of the new rules and guidelines.

That's why changes are always announced for a future date, giving users ample time to read and understand the changes.

## My terms of use include a clause indicating the possibility of changing them, do I still need to notify users?

Once again, the answer is yes. Despite many terms and policies including the possibility of changes, it's not a good idea to change them without any notification and obtaining the consent of the data subject.

After all, this would be a unilateral change. Since terms of use function as an online contract, this isn't a favorable decision and can be seen as abusive. Likewise, it goes against LGPD, where transparency and consent are essential.

## How to Notify Your Users of Changes to the Terms of Use?

It's essential that you inform your users and customers of changes to your privacy policies and terms. Here are some tips on how to do it effectively.

## Notification by Message

One of the ways to notify your users of changes to the terms of use on your website is through message notifications. In this case, you can opt for email or other communication methods provided by the data subject (SMS, etc.).

In this scenario, inform users about the changes and provide access to the new terms. Similarly, ensure that when users access the document, they have the opportunity to indicate whether they accept these changes (in the famous "I declare that I have read and accept the terms of use" checkbox).

Additionally, make sure that this type of consent for changes is identifiable and properly archived as evidence.

## Notification upon Website Access

Another option is to have a banner that indicates changes to the terms of use appear as soon as the user accesses your website. In this scenario, it's advisable to prevent the user from navigating the page until they have read and agreed (or disagreed) with the new terms.

This practice is typically used when the new terms are already in effect, as it can have a more significant impact on the user experience. However, it's essential for both scenarios.

## Beware! Silence Does Not Imply Consent

Lastly, our final tip when changing the terms of use is to be careful regarding silence. Unlike what we often assume, silence does not imply consent. It's essential to obtain explicit consent from the data subject regarding changes to the terms.

## Help the Visitor Read the New Terms of Use!

Not all of your visitors, if not the minority, have the patience and interest to read your Terms of Use. Yes, this is concerning given its importance, but it's a fact we observe daily.

So, since you'll already have to notify users of changes, a good practice is to highlight the main changes and how they might affect the user so they can quickly grasp the key points, accelerating their understanding and, consequently, the collection of their acceptance of the terms.

So, since you'll already have to notify users of changes, a good practice is to highlight the main changes and how they might affect the user so they can quickly grasp the key points, accelerating their understanding and, consequently, the collection of their acceptance of the terms.

Do you have any questions or work as a [Data Protection Officer](https://goadopt.io/blog/en/responsibilities-of-a-data-protection-officer/) and can contribute with these tips?

Please let us know how we can improve; we're always open to feedback!

Tips on how to notify users after a change on the Terms of Use.

ROPA in LGPD? Get to Know the Records of Processing Activities

The [LGPD - General Data Protection Law](https://goadopt.io/blog/en/lgpd-general-data-protection-law/) brought with it several acronyms and specific terms. Many of them imported from other countries and legislations. One of them is ROPA (Record Of Processing Activities), adapted in Brazil to _Registros das Atividades de Tratamento_. An essential document for any DPO, Data Processor.

If you work in the field or are in the process of adapting your company, this article was made to help you better understand this document.

ROPA (_Record Of Processing Activities_), is nothing more than a document that organizes the company's official records about:
- **How data collection is done**, its processes, and activities;
- **What is done with the data**, if there is any processing or sharing;
- **How data is deleted**, if applicable.

In other words, the essential questions and answers in case of consultation by the ANPD - National Data Protection Authority, to your company. Below, we'll discuss each of these points in more detail.

It's worth noting that all documents and processes mapped by the company's Data Processor are "living," constantly being updated and changed. A new process created in department X can change the ROPA, the [Privacy Policy](https://goadopt.io/blog/en/is-there-an-ideal-privacy-policy/), and many other controls.

So, regardless of the size of your company, documents should always reflect reality and be constantly updated.

Smaller companies may not feel the need or complexity of keeping these "Mapping of flows" updated, after all, everything is smaller and involves fewer people. Now, for a larger company, there are already software solutions that help with this control in a more automated way, such as [LGPDNOW](http://lgpdnow.com.br/), for example.

## What is ROPA?

ROPA (_Record Of Processing Activities_), translated by the Brazilian market to Records of Processing Activities, is an official document of companies, generated by a system or not, that records all flows, processing, and activities involving personal data.

In it, mainly list all the purposes and reasons why the company needs that data(s) for its operation, legal basis ([Legal Basis](https://goadopt.io/blog/en/legal-bases-of-lgpd/)), security criteria, data storage/retention period.

## Is ROPA the Same as Data Mapping?

The easy answer is: _it depends_.

[Data Mapping or Data Inventory](https://goadopt.io/blog/en/data-mapping-or-data-inventory-lgpd/) functions as a visual map of the flow of personal data within the Data Controller, bringing much more than ROPA, such as system and international transfer maps, ISO compliance parameters, NIST, among others.

On the other hand, ROPA focuses on activities involving data processing. In a more structured company, it may happen that a Data Mapping contains some ROPAs as part of it.

In any case, recording activities is an essential part of both documents. The perspective and methodology applied in each can be their differential.

## What Should a ROPA Include?

According to the [ICO (Information Commissioner’s Office), a ROPA must include at least:](https://ico.org.uk/for-organisations/accountability-framework/records-of-processing-and-lawful-basis/#requirements)

- Name and contact details of your organization, whether it's a controller or a processor (and where applicable, the joint controller, its representative, and the DPO);
- The purposes of processing;
- A description of the categories of individuals and personal data;
- Categories of recipients of personal data;
- Details of transfers to third countries, including a record of the safeguards in place for the transfer mechanism;
- Retention/storage times;
- A description of the technical and organizational security measures in place.
- If you have an internal record of all processing activities carried out by any processor on behalf of your organization.

**### Questions the ROPA Should Answer:**

- Have you considered the effectiveness of your accountability measures?
- Would staff say you have effective processes to keep the record up-to-date, accurate, and ensure data is minimized?
- Could staff explain their responsibilities and how they carry them out in practice?

## Best Practices for a Good ROPA.

Also, according to the [ICO (Information Commissioner’s Office)](https://ico.org.uk/for-organisations/accountability-framework/records-of-processing-and-lawful-basis/#requirements), ROPA also includes or links to documentation covering:

- Information needed for privacy notices, such as the legal basis for processing and the source of personal data;
- Consent records;
- Controller-processor contracts;
- The location of personal data;
- DPIA reports;
- Records of personal data breaches;
- Information needed for processing special category data or criminal conviction and offense data under the Data Protection Act 2018 (DPA 2018); and
- Retention and deletion policy documents.

**Questioning for the creation of your ROPA:**

- Have you considered the effectiveness of your accountability measures?
- Do staff understand how to access other relevant documents linked to the ROPA?
- Is it easy for staff to access relevant documentation from the ROPA?
- Could staff explain this process and how it impacts their role?

## How to Create a ROPA for LGPD?

A good example for those starting out or with a smaller company is to use spreadsheets for this control and organization.

In addition, on the [gov.br website, there are various guides and templates to help you comply with LGPD.](https://www.gov.br/governodigital/pt-br/seguranca-e-protecao-de-dados/guias-operacionais-para-adequacao-a-lei-geral-de-protecao-de-dados-pessoais-lgpd)

For larger companies that need to structure these processes better, a privacy management and data mapping platform can be very helpful!

That's why we recommend that you schedule a meeting with the [LGPDNOW](http://lgpdnow.com.br/) team for a no-obligation conversation to see how they can help you develop your ROPA for LGPD.

Templates and models imported from other companies can be very helpful. But it's essential that you can clearly and objectively translate the reality of your company.

Every time we are faced with the complexity of justifying and basing the collection of data, we should always prioritize privacy throughout all processes, as taught by [Privacy by Design](https://goadopt.io/blog/en/what-is-privacy-by-design/).

## How Can AdOpt Help with ROPA?

According to the recommendations of the ICO listed above, AdOpt's LGPD Platform helps you map and organize:

- [Cookie Banner](https://goadopt.io/blog/en/cookie-banner/) within ICO, LGPD, GDPR, CCPA standards.
- Records of all written consents; (organized by user with date, time, and details of each consent.)
- API Integration with your other platforms to enrich the collected data with the consent information recorded.
- And more, depending on the size of your company.

We're here to help!

So, in this [link](https://calendly.com/valquiriaadopt), our calendar is open to discuss your business's adaptation challenges.

ROPA in LGPD? Get to Know the Records of Processing Activities.

How does your website handle LGPD, CCPA, GDPR...?

What strategies does it use to comply with the LGPD [_General Data Protection Law_](https://goadopt.io/blog/en/lgpd-general-data-protection-law/)? Have you thought about using a [cookie banner](https://goadopt.io/blog/en/why-the-cookie-banner/) but don't know if your site has [cookies](https://goadopt.io/en/blog/lgpd-cookies-all-you-need-to-know/) or if it's enough? If you can't answer these questions, be cautious! Your page may be exposed to fines and other sanctions.

Below, check out 5 signs that indicate your strategies either don't exist or aren't working as they should. So keep reading to ensure the necessary compliance of your site with the principles of the law that regulates data consent.

## 5 Signs You Need an LGPD Consent Strategy Right Now

Check out the top 5 signs that your website isn't in compliance with LGPD and then see how to start your adjustment!

## 1 - You Have No Control Over the Data You Collect and Use
This is an undeniable sign that you need to reconsider how you view LGPD. After all, it regulates the use of third-party data.

It requires respect for user privacy and their consent. Therefore, data usage should always be informed. Not only that, but also the purposes to which it is directed, the way it is stored, and the period of use.

So, consider that if you don't know what data you collect, how will you inform the visitor? Furthermore, how will you ensure that the use of this information complies with the limits imposed by the data subject?

These are important questions that indicate that something is not right on your website regarding LGPD and its requirements.

LPs created without control, rich content available for download without accepting terms and policies, mailing lists being shared and passed from campaign to campaign... Be cautious!

I've separated this article for you, in case this is your situation:

[Understand the meaning of LGPD for your company.](https://goadopt.io/blog/en/lgpd-meaning/)

## 2 - There's No Information About the Use of Cookies

Cookies are another type of data that, in principle, should be informed by websites to their visitors. After all, they also capture information about these data subjects and, therefore, fall within the concept of data usage that LGPD addresses.

The use of cookies is almost natural for most websites, especially if they come from e-commerce platforms, for example.

_### To check if your site triggers cookies, access it from a computer and - in Google Chrome, click on the padlock just to the left of the address. It should show exactly which ones and how many there are._

However, many pages fail to see cookies for what they really are: data files and personal information. Therefore, the absence of this communication to your site's visitors is dangerous as it can be a violation of the law.

In fact, not just that, but the collection of them without prior consent is also a violation. You know that "We use Cookies" pop-up? Well, it's not there for no reason.

It's a way to comply with LGPD as it informs the use of this type of file while capturing authorization to use them.

- In this article, I help you understand more about [consent as a Legal Basis of LGPD.](https://goadopt.io/blog/en/legal-bases-of-lgpd/)
- In this one, [how to choose an appropriate CMP - Consent Management Platform for your website.](https://goadopt.io/blog/en/how-to-choose-cmp-consent-management-platform/)

## 3 - Generic Privacy Policy and Terms of Use

Your site probably has documents such as Privacy Policy and Terms of Use. They inform, respectively, the use of visitor data (and capture authorization for it) and the prevailing rules, rights, and duties.

Therefore, they are very important, especially in the time of LGPD! They stand out for their informative content to promote transparency with the data subject.

It is up to the data subject, then, to accept or not the conditions therein. In this sense, it is worth noting that the site may suspend access to some services, for example, due to a lack of acceptance of the rules and conditions. And that is natural since some of them are only possible with the authorization to use certain data.

Either way, these are important documents. But they shouldn't just be there. They should be specific to what the site offers and how it operates. So if you made your terms and policies based on Ctrl C + Ctrl V, pay attention!

It's time to review these documents and rewrite them to make them compatible with the reality of the site. Also, to fill gaps and clarify data usage. Below, I've separated a few more articles for you:

- [What is a Privacy Policy?](https://goadopt.io/blog/en/what-is-privacy-policy/)
- [What's the Ideal Privacy Policy for Your Company?](https://goadopt.io/blog/en/is-there-an-ideal-privacy-policy/)
- [What are Terms of Use in LGPD?](https://goadopt.io/blog/en/terms-of-use-lgpd/)

## 4 - Data Loss or Data Breach

When it comes to data loss, it's time to sound the alarm. Data breaches are a clear sign that your LGPD strategy needs urgent correction or revision.

After all, it should be developed to maintain the confidentiality of data and their use in accordance with the data subject's consent or the [legal basis](https://goadopt.io/blog/en/legal-bases-of-lgpd/) chosen. Also, to ensure the protection of this information.

Data breaches are compromising! They can tarnish the company's reputation and often that of its customers and suppliers as well. Furthermore, the company can be held responsible for them and, as a result, face significant sanctions, including hefty fines.

[**Understand the difference between Data Controller and Data Processor in LGPD here.**](https://goadopt.io/blog/en/differences-operator-controller-of-data-lgpd/)

And it's not just data loss itself. The lack of a clear plan of action in the event of information leaks is also an indication that you urgently need to work on your LGPD strategies. Below are some more articles to help you with this review:

- [Data Mapping or Inventory in LGPD, the DPO's life jacket.](https://goadopt.io/blog/en/data-mapping-or-data-inventory-lgpd/)
- [How to Adapt Your Marketing to LGPD](https://goadopt.io/blog/en/how-to-adapt-digital-marketing-to-lgpd/)
- [10 Risky Processes in Your Marketing](https://goadopt.io/blog/en/10-risky-processes-in-your-marketing/)

## 5 - Absence of Designation of a Data Protection Officer

Finally, the last sign that your website needs an LGPD strategy is the absence of the designation of a Data Protection Officer or DPO (Data Protection Officer) for the processing of data on your site.

This figure is a requirement of LGPD and, according to the law, is responsible for controlling and managing data processing. They carry out tasks determined by the Data Controller.

They are also the ones who handle complaints from personal data subjects, provide explanations, and communicate with them. Similarly, they control the entry and exit of consents, so they take the necessary actions to ensure compliance with authorizations. In this article, I explain more about [the responsibilities of a Data Protection Officer or DPO in LGPD.](https://goadopt.io/blog/en/responsibilities-of-a-data-protection-officer/)

## So, how about adapting your site to LGPD?

If you have recognized that your site falls into any of the signs above, it's a sign that you should take action to align it with the law. Otherwise, you may face [fines](https://goadopt.io/blog/en/fines-in-lgpd/) and other penalties that could even lead to the suspension of your page's activities.

Not to mention the impact on your brand's image in the eyes of the public, as someone who could care more about data privacy.

So, it's more than time to review your privacy strategies in the face of LGPD. For this, count on [AdOpt](https://goadopt.io/), which helps you not only organize them but also control the entry and use of data, as well as consents about them.

5 Signs Your Website Needs an LGPD Consent Strategy

Have you ever noticed that every time you sign up for a service to access information or register on a website for purchases, you need to give consent? If you're wondering why you have to give consent on every website you visit, you'll find the answer here.

Even though this consent is often "automatic" and happens without you thinking about it (which it shouldn't), it is very important. After all, it is a legal requirement that applies to the website and pertains to the security of your data.

Since data is becoming increasingly important and data breaches can cause significant harm, understanding what you're consenting to and what it means is indispensable. So don't miss the opportunity to learn more about this topic!

## With LGPD, Silence Doesn't Imply Consent

To understand how consent has become so important regarding data collection and use in the online environment, we need to go back to August 2020. That was the month when the [General Data Protection Law (LGPD)](https://goadopt.io/blog/en/lgpd-general-data-protection-law/) came into effect.

It was introduced as a response to the need to protect data shared on websites and collected by web pages, as well as to regulate their processing. Notably, in recent years, massive data breaches of personal information, such as the Facebook breach, have alarmed users.

Therefore, privacy laws like [GDPR, LGPD, CCPA](https://goadopt.io/blog/en/gdpr-lgpd-and-ccpa-what-are-these-laws-similarities-and-differences/) have consolidated the notion of consent for data usage. In other words, all websites that use cookies and collect data from their users for any purpose (such as marketing) not only need to inform but also ensure agreement.

This happens when you access a website and need to grant permissions for cookies, for example. Even though cookies are just one form of information collection, they are a good example of consent.

The same thing happens when you access a page where you need to enter personal data. For example, when subscribing to a newsletter and landing pages. Similarly, when registering for a purchase. In these cases, there's always a box that says "I agree to the [terms of use](https://goadopt.io/blog/en/terms-of-use-lgpd/) and [privacy policies](https://goadopt.io/blog/en/what-is-privacy-policy/), " right?

Know that in all these cases, consent is given for the use of your data. It relates to the company's security and information treatment policies, as well as which data is used, when, how, and for how long.

Of course, there are other [legal bases](https://goadopt.io/blog/en/legal-bases-of-lgpd/) that also ensure the correct use of citizens' data. However, for many, consent ends up being the quickest and most accessible option in their business flow.

[**### Discover how to adapt your digital marketing to LGPD.**](https://goadopt.io/blog/en/how-to-adapt-digital-marketing-to-lgpd/)

## What is the importance of the consent policy for the website and the visitor?

The consent that you might be tired of giving - but shouldn't, as it concerns your security - is important for both websites and you, as well as other visitors and users.

Well then, let's start with the visitors because the preference is theirs! For them, consent is important because it's only through it that the companies behind the websites can use their data. They can use it only within the limits stipulated, both in terms of time and application.

So, if you have the habit of giving consent to websites without carefully reading the terms beforehand, it's time to change that approach! The use of your data is important and relates to your security (including financial security!).

Therefore, it's important to be aware of what you're allowing and what the company's policies are for protection purposes.

In this sense, it's necessary to pay attention to two different text documents: the Terms of Use, regarding the rules of service utilization responsibility and limits of duties and rights; also, the Privacy Policy, which concerns the treatment of information and security details.

On the other hand, the consent you give to websites is also important for them, obviously. After all, this is the only way they can really use the data (within the informed and consented limits) in accordance with LGPD.

Learn more about [how the cookie banner work](https://goadopt.io/blog/en/operation-of-cookie-banner/)!

Moreover, LGPD imposes significant [penalties](https://goadopt.io/blog/en/fines-in-lgpd/) on those who violate it. In this regard, it can impose warnings as well as [fines](https://goadopt.io/blog/en/fines-in-lgpd/) that can be quite high! It can also lead to restrictions on data collection and the banning of the page.

## What types of pages need to obtain visitor consent?

The vast majority of websites that collect data in some way and use cookies need to obtain consent from their users. There are various types of data collection, ranging from cookies to voluntary information acquisition through page registrations.

In this sense, all pages that use tools for analyzing results and metrics, such as Google Analytics, already have a duty to obtain consent from their visitors for this.

Similarly, landing pages, contact pages with user information disclosure, and other data registration forms will always need policies of agreement regarding data collection and usage.

Especially when, according to the company's business model, other [legal bases](https://goadopt.io/blog/en/legal-bases-of-lgpd/) are weaker in terms of data usage rationale. Thus, consent ends up being an excellent option.

## Cookie Banner

Firstly, one of the methods for obtaining consent is through the Cookie Banner, right on the page.

In this case, the page's opening must clearly inform the use of cookies and allow the visitor to configure their preferences and give their permission. Only after consent, the cookies can be triggered.

[### **How to configure third-party cookie blocking in AdOpt?**](https://goadopt.io/en/support/essential-setups/3rd-party-cookie-blocking/manual-third-party-tag-blocking/)

For this purpose, your website can rely on AdOpt. With our tool, your cookie usage policies are always clear to the user. In addition, alongside the banner, you can configure the blocking of third-party cookies, multi-languages and legislations, text customization, positioning, colors, and images.

[_Have you heard of the ROPA document in LGPD? 
It's essential and can help you a lot in your compliance!_](https://goadopt.io/blog/en/ropa-for-lgpd/)

## Terms of Use and Privacy Policy Notices

The other method of applying consent policies on a website is precisely on pages dedicated to contact forms, landing pages, and site registration. Using those "I have read and accept" checkboxes.

In this case, it is essential that the user has access to the documents that reveal them and that they must allow the use of such information before continuing their online action.

Therefore, always make sure that these notifications halt the process. This way, only data that truly has the visitor's consent is collected.

If you are an [AdOpt](http://goadopt.io/) customer, our technology allows this online form consent collection to be integrated into the platform as a whole. This means that your CRM has another field fueled by visitor consent.

Want to know how? Just chat with us or schedule a presentation conversation [here](https://calendly.com/valquiriaadopt).

Why are cookie banners everywhere?

Best practices in tag categorization

What is the difference between cookies, local storage, and session storage?

Tips on how to notify users after a change on the Terms of Use.

ROPA in LGPD? Get to Know the Records of Processing Activities.

5 Signs Your Website Needs an LGPD Consent Strategy

Why Give Consent on Every Website I Visit?