If you've reached this article, you're certainly searching and wondering: What is the best [cookie banner](https://goadopt.io/blog/en/what-is-a-cmp/) for your website, and how do you choose among the many options on the market? What are the criteria for this choice, and what are the strengths and weaknesses of each option? Well, we're here to help you because this decision needs to be well thought out!

Therefore, below we have listed the answers into key points that should be carefully analyzed.

1. Why do I need this banner, really?
2. But [cookies](https://goadopt.io/en/blog/lgpd-cookies-all-you-need-to-know/) are anonymous, so why all this?
3. Legislation and Language.
4. [LGPD](https://goadopt.io/blog/en/lgpd-general-data-protection-law/) and the cookie banner, technical aspects of the Law.
5. [Design](https://goadopt.io/blog/en/what-is-privacy-by-design/).
6. Truth.
7. Detailed Purposes.
8. Freedom of choice.
9. Blocking third-party cookies.
10. Price
11. Integrations.


## Why do I need this banner, really?

First of all, **does your website REALLY need an [LGPD](https://goadopt.io/en/blog/gdpr-lgpd-and-ccpa-what-are-these-laws-similarities-and-differences/) Cookie banner?**

What do you mean? I'm already in this article to choose a cookie software, and you still want to tell me who actually needs the LGPD [Cookie](https://goadopt.io/blog/en/operation-of-cookie-banner/) banner?

Exactly! Because there are many people who come to us to install the cookie banner on a website that simply does not use cookies. Seriously! Sometimes it seems like our banner is synonymous with website quality (okay, I confess, I agree), but there are limits.

It's like buying sunscreen for a nighttime stroll or mosquito repellent for diving.

The key point is confusing for many!

1. Just because many websites are using it doesn't mean you need to as well!
2. Pay attention to other legal bases that can support your business, in addition to consent.
3. The key question: If you don't use cookies on your website, why have a cookie banner? In times of such complex legislation, less is more!

Here, we have highlighted some points from the LGPD to support our reasoning:

**Article 8** addresses how the controller should request the data subject's consent. The first and most important rule is that the consent clauses must be separate from others, allowing the data subject to have a clear understanding of what they are consenting to.

Article 8 - § 2: The burden of proving that consent has been obtained in accordance with this Law lies with the controller.

_What does this mean? _
As the controller (your website), you must keep a record of all consents obtained, and these must be stored and documented.

Because at any time, data subjects have the right to request such records and any data you may have about them.

Refer to Article 19:

**Article 19: Confirmation of the existence of personal data or access to personal data shall be provided upon request by the data subject:**
_
I - in a simplified format, immediately;_ or

_II - through a clear and complete statement indicating the origin of the data, the absence of a record, the criteria used, and the purpose of the processing, subject to trade and industrial secrets, provided within a period of up to 15 (fifteen) days from the date of the data subject's request._

1. Personal data shall be stored in a format that facilitates the exercise of the right of access.

2. Information and data may be provided, at the data subject's discretion. § 3. The processing of personal data based on defective consent is prohibited. § 4. Consent must relate to specific purposes, and generic authorizations for the processing of personal data shall be void. § 5. Consent may be revoked at any time by the data subject's express manifestation, by means of a free and facilitated procedure, without prejudice to the processing carried out under the previously given consent until the request for elimination, as provided for in item VI of the main section of Article 18 of this Law.

## But, aren't Cookies anonymous? Why all this?

If you're not familiar with the digital world, let me explain to you with the most popular phrase from privacy policies ("Cookies are small pieces of text that are stored in your browser when you access a website on the internet.")

With this information from cookies, companies can do a lot, and I mean a lot! They can accurately profile your psychology and cross-reference this information with extremely personal data, known in the market as data enrichment or "data farming."

### The logic is always very similar: Browser -> cookie -> personal data (email, phone) -> person/registration -> CPF (Brazilian individual taxpayer registry) -> income, IRPF (Brazilian income tax return), marital status

Several companies do this, and virtually all of those that have tags installed on their websites can somehow convert this information and target any individual specifically. Whether it's directly through their own database (Google), or by cross-referencing with third-party databases (such as Serasa).

In other words:

**Cookies are not anonymous but rather anonymized.**

## Legislation and Language.
This is an excellent variable to consider when looking for a cookie banner! Questions like: Does it support multiple languages, can that be an advantage? But, before that, does it accept multiple legislations?

For example, if your website is Brazilian and someone accesses it from Italy, it wouldn't be enough for the banner to be in Italian. The visitor is actually under the jurisdiction of the [GDPR](https://goadopt.io/en/blog/key-differences-LGPD-GDPR/), unless the LGPD has more "private" provisions in those specific areas (as required by the visitor's country's law).

In other words, just because your site has multiple languages and versions doesn't mean that all the legislations are correctly implemented and complied with regarding the cookie banner. Is it clearer now?

Pay attention to compliance with the applicable legislations, especially for your target audience! Language and accessibility are crucial, but not the only factors when it comes to foreign accesses.

## LGPD and the Cookie Banner, Technical Aspects of the Law.
Now that we understand the context of the law, the complexities of cookies, and the parallel legislations that may influence the use of the Cookie Banner on your website, let's discuss some key points that will help you make this choice.

1. **Design**
Why design when we're talking about technical aspects? Precisely because of that, after all, what are the main metrics of a website, an e-commerce? How do you analyze the conversion from visitors to leads and then to sales? Is Bounce Rate a concern? What are the KPIs of your site? Does usability and visitor experience matter?

Yes, they matter A LOT!

Thus, look for a cookie banner with refined and responsive design that allows you to customize colors, logos, and placement on the site in a way that harmonizes with the overall structure of the site. Don't just throw a senseless banner in the middle of the visitor's screen; respect the attention the visitor is giving you!

Be cautious with designs that occupy the entire screen! We understand that the law requires clear and assertive communication, and many are overwhelmed by the uncertainties in the market. However, you shouldn't disturb the visitor or act impulsively because of that!

We know how every second counts in capturing visitors' attention, so make it count!

Do you really want to use a banner that steals attention instead of fulfilling a simple and even basic role required by the law?

![aviso barcelona.png](https://strapi.goadopt.io/uploads/aviso_barcelona_1cc05ad647.png?updated_at=2022-08-17T18:16:59.332Z)

This Barcelona F.C. banner is like having ten players blocking the goal...

2. **Transparency**
I may sound sensationalistic, but I dare say:

**"Most of the cookie plugins and banners we see on the internet are just fake buttons. Yes, digital components that don't record or organize anything."**

In addition to the _"fakeness"_ of these mentioned points, always use assertive and direct language. Don't try to be "cool" or trendy. Of course, using too much legal jargon can push people away.

![aviso seção verdade.png](https://strapi.goadopt.io/uploads/aviso_secao_verdade_3a5ce550cc.png?updated_at=2022-08-17T18:18:11.830Z)

Not to mention that if I have no way to refuse, how would it block then? So, in the end, it's the same thing, don't you agree?

## Detailed Reasons.

This is one of the crucial points we consider in a good cookie banner. According to LGPD, consent must be given for specific purposes. Therefore, a simple "OK" or even "Accept" without the option to explore my choices and understand their purposes and legal bases can be somewhat coercive.

Consent is not a salvation or a general acceptance. It is the formalization of acceptance for that specific purpose presented.

![aviso sem finalidade.png](https://strapi.goadopt.io/uploads/aviso_sem_finalidade_db0539333e.png?updated_at=2022-08-17T18:18:58.036Z)

## Freedom of Choice.
The General Data Protection Law (LGPD) lists a series of legal bases through which companies can use data with ease. If you have chosen consent for your company, use it with respect and always value the privacy of your data subjects.

There is no better or stronger legal basis. Instead, choose the one that best fits your business model and market. Similarly, a cookie banner should understand the context in which consent will be communicated and collected, and should provide visitors with the freedom to choose fully, partially, or not at all.

Always look for cookie banners that break down the listing of tags and cookies into categories and subcategories. This is essential to demonstrate that a particular purpose is presented within category "X," and visitors can freely choose whether to accept it or not.

## Blocking Third-Party Cookies.
The cookie banner is not just an interactive button; it must have authority over the behavior of other tags used on the website, authorizing or blocking their firing based on the consent collected during that visitor's session.

For example, the Google Analytics tag should only be fired when the visitor accepts the statistical category of tags. Before that, the notice informs and waits for visitor interaction.

For more information on how to configure the [AdOpt Cookie Banner](hhtps://goadopt.io) to enable automatic blocking of third-party tags, see our tutorial.

## Price
The price of a cookie banner should be:

**- Affordable:**
Low prices that do not eat into your marketing budget. If there is a free plan, even better! The cookie banner only solves a part of the law's compliance, and it's likely that you will need other services or consultations in the future. Therefore, don't spend too much of your budget on this product.

A cookie banner does not cover all the obligations regulations like the GDPR, CCPA, LGPD... for example.

If you have other internal processes that use personal data, you will need to use other controls and even systems for that management.

The cookie banner should take care of the "digital gates" and reinforce the legal basis of consent.

How?

By recognizing and categorizing all users with their choices of total opt-in, partial opt-in, or opt-out and sending these requests directly to the [Data Protection Officer (DPO)](https://goadopt.io/blog/en/responsibilities-of-a-data-protection-officer/), or even systems like CRM, ERP...

**- Scalable**
Look for cookie banners that offer billing with scalability parameters. In other words, they should have little to no impact initially, and as your website grows and your audience expands, you will pay for that processing power.

Additionally, the volume and value tiers should be broad enough to accommodate any seasonality, so you don't

How to choose a Cookie Banner for your website

João Bruno Soares

It's time to talk about one of the most impactful tasks, both for the company and for the visitors of your websites: tag categorization. But why is it so impactful? What is the relevance of this configuration and how can it affect us? It is precisely because of these common questions we receive from our clients that we have written this article on best practices in tag categorization.

## What is a tag?

To start off on the right foot, let's clarify some basic concepts that will help situate each one of you at AdOpt and in the market as a whole.

In a straightforward manner: **1 Tag = Trigger for 1 or more Cookies.**

What does that mean?

Basically, most Tags or pixels – as they are also known – when installed in the HTML of a website, are responsible for triggering cookies for each visitor on that specific page. A Tag can perform various functions such as tracking button clicks, page scrolling, collecting text fields, always associating these behaviors with that specific visiting browser.

Once this is possible, the way the Tag stores the data generated by the visitor is:

- Sending it to their server (the service provider's server that created the Tag) and;
-It can also record all the information in cookies that it generates and stores on your machine.

For example, when we visit an e-commerce website and it recognizes that we are returning after a previous visit, showing products that are of interest to us, it happens thanks to cookies and tags doing their job. In summary, 1 Tag can trigger N cookies and perform N functions.

Ultimately, the Tag itself is not inherently good or bad; it all depends on its application.

## What is tag categorization?

Categorization involves the work of the Data Protection Officer (DPO) in organizing all the tags installed on the website(s) under their responsibility into specific categories that represent their purpose and reason for being there.

Since GDPR, which was the pioneer in this regard, the market has created "standard categories." These categories are:

- **Essential / Necessary**: Without them, your business model or website does not function, or you are required to use them by law or regulations.

- **Marketing / Advertising**: With them, you can trigger re-marketing, populate ad pixels, automate email sequences, etc.

- **Statistics / Analytics**: With them, you have an analysis of what visitors do, where they come from, and how they behave on your website.

- **Performance**: Tags that maintain website functionality, ensuring its operation and response speed. For example, they can prevent DDoS attacks.

- **Functional**: Tags that handle functional aspects, such as remembering preferences or recognizing that you are already logged into the system, chatbots.

In other words, each company may have a group of tags installed on its website, with their purpose described and detailed in the Privacy Policy (or cookie policy). This purpose should be replicated in communication with visitors - the cookie banners - as well as in all processes that use this data.

## Why categorize tags?

Many companies use cookie banners that do not organize tags or cookies into specific categories, forcing visitors to accept all tags without distinction.

This poses a significant risk of fines for your operation since various regulations require that consent be specific and detailed for a particular purpose. In the LGPD, for example, Article 5, Item XII is clear:

> #info XII - consent: the free, informed, and unequivocal expression by which the data subject agrees to the processing of their personal data for a specific purpose.

This is one of the reasons why AdOpt has always worked with a design that prioritizes freedom for all visitors to navigate through categories and their respective tags.

## How to differentiate the function of each tag?

Certainly, the market already anticipates some purposes and their respective categories. However, it is worth noting that this step often involves areas of the company that go beyond those apparent on the website. A collection made through cookies can be the operational basis for an entire department and all processes within a company.

This means that, although the market already provides a standard for the category of each tag, especially the most popular ones, data controllers must adjust this difference within the company's operation, ensuring the reality of the situation and primarily supporting such choices with the chosen legal bases.

Therefore, even though there is a standard, companies are free to adjust the facts and must be prepared to respond to them with complete clarity to individuals.

That's why at AdOpt, when tags are scanned, some of them already come with a pre-classification. However, this does not prevent the data controller of a specific company from adjusting this categorization according to their Cookie and Privacy Policy.

As a platform, AdOpt cannot enforce a specific configuration or principle. However, it values freedom within its environments so that the responsibilities of the data controller are respected at all times.

## What do privacy regulations say about classifying each type of tag?

Privacy regulations do not delve into this "micro" analysis of tag categories. It would be impractical for national authorities to issue a classification opinion for every new tag that emerges in the market.

Thus, it is up to companies to ensure that communication is clear, objective, and respects the aspects of freedom and purpose already mentioned. Naturally, the market adjusts and creates standards and even specific terms for each of them.

For example, the terms "Essential" or "Necessary" are not determined by law. However, these terms help in quickly understanding their purpose, which is why the market has adopted them. The less confusion in this regard, the better. After all, subjectivity exists in all places and contexts. If we can avoid these points with a certain "standard," we minimize these variables.

## Where to apply and/or replicate this information?

As mentioned earlier, the categorization of tags is an organization that should reflect the operational purpose of using that data. Therefore, before a conceptual application, it should have a practical use that mirrors this classification.

However, it is worth noting that this classification is often explained or expanded upon in official company documents such as the Privacy Policy and Cookie Policy.

In addition, a crucial aspect directly related to tag categorization is the configuration of blocking third-party tags according to the visitor's choice. In other words, the cookie banner only allows a certain tag to be executed after the visitor's consent.

What does that mean?

Each visitor is free to choose whether or not to consent to that group of tags declared by the company. Therefore, their will is respected when cookies are only stored upon "free, informed, and unambiguous" consent (without ambiguity, clear, without equivocation).

**That's why AdOpt advises all users of the tool, without exception, to configure the blocking of third-party tags. Only with this configuration in place will the banner be complete and properly installed.**

Here's a tutorial for configuring the blocking of third-party tags on your website.

## Why do some websites don't block third-party tags?

It is not up to AdOpt to judge why a particular site, and even its clients, have chosen not to implement this configuration, even though it is constantly reinforced in our communication and classified as "essential."

Certainly, such a decision harms the image of both the company and even AdOpt. However, it is important to remember that prior to this setup, each tag has a unique function within each company, in its unique environment and context. Imposing a technological mechanism by AdOpt would go against the freedom of choice for its clients in the interpretation and application of the law that applies to everyone.

Keeping in mind the necessary proportions and equivalences, let's consider an example. It would be like holding vehicle manufacturers responsible for cars that have the capability to exceed the speed limit. The automaker can install alerts, reinforce communication in various ways. But they can never impose that a citizen does not drive according to their freedom of choice.

## Last point, as a golden rule!

**Always align the Actual Use of data with Processes, Documentation, and Communication.**

**Process: **The data collection declared for a specific purpose should indeed have the same destination and use of data within your company.

**Documentation**: Official documents should always be up to date and truly reflect the practices within the company.

**Communication**: The tag classified as Necessary or other classifications should indeed be necessary. The tag should not be classified as "essential" just because visitors cannot block it. This would be an attempt to bypass the freedom of individuals accessing your website.

The same market that creates classification standards for certain tags is also capable of judging the truthfulness of intentions and facts declared by your cookie banner on your website.

Always remember that people come before companies. The LGPD (General Data Protection Law) was created precisely to better balance the relationship between companies and citizens. After all, privacy is a universal right and should not only have value when it is lost.

---

Did you feel that something was missing or need further explanation?
Let us know at [hey@goadopt.io](hey@goadopt.io), and we'll be happy to discuss the topic further with you!


Best practices in tag categorization

The Brazilian Data Protection Law (_LGPD - Lei Geral de Proteção de Dados_) emerged a long time ago and has since drawn attention from numerous professionals. However, it is not uncommon to find websites and companies that ignore it, as they seek time to adapt. In this regard, how long can we ignore LGPD?

**Well, it is no longer possible to ignore it.** This has been a reality since its approval. Furthermore, it has been enforced since 2021.

With that in mind, it has been several years since this law was introduced, which leaves no excuse for ignoring it. Moreover, ignorance of the law can bring significant consequences, like [fines](https://goadopt.io/blog/en/fines-in-lgpd/).

Therefore, the clock is ticking against those who have chosen to postpone the necessary adaptations imposed by LGPD. It is time to change your stance. How and why to do so will be explained below.

##But what exactly does LGPD require?

[LGPD](https://goadopt.io/blog/en/lgpd-general-data-protection-law/) is often mentioned, yet little is said about its actual requirements. However, it has become essential for online users and website owners to understand what it entails.

Only then can the true importance of this law be comprehended. But don't worry, we won't use legal jargon to explain it to you.

The [LGPD](https://goadopt.io/blog/en/lgpd-general-data-protection-law/) is a nationwide regulation that came into effect in 2020. Many expected it to be implemented later, as there were speculations about its postponement, as seen before.

However, that did not happen. In other words, LGPD has been a reality since 2020 and requires attention. Many believe that it only applies to companies and their websites. However, it governs how all legal entities, including companies, governments, NGOs, associations, churches, and various other organizations, handle the data of the country's citizens.

It is worth noting that [LGPD](https://goadopt.io/blog/en/lgpd-general-data-protection-law/) and all other privacy regulations do not only focus on digital data but encompass all types of data. Therefore, how a company handles an email provided on a website or on a clipboard matters! Similarly, this extends the care to not only the website's servers but also to files, cabinets, and notebooks that "store" such data.

In summary, all processes in your company that involve personal data in their workflows must be reevaluated and adapted.

Assuming that you already understand that every time you visit a website or take an online action, both your browser will record signals and the website will receive information about you. Let's reinforce that this cannot happen indiscriminately, right? That is precisely what the General Data Protection Law addresses. It ensures limitations on the use of personal data, whether on websites or any other environments.

(If you haven't grasped that we are talking about Internet Cookies, read about them here before proceeding.)

With this, the law aims to protect users' privacy and intimacy. It also ensures that they have a better understanding of how their data is used and the security measures taken by the company that has access to that information.

But it doesn't stop there. LGPD also introduces data classification concepts and specific safeguards regarding data breaches and handling.

Ultimately, this law aims to promote transparency between websites and users. It imposes measures that can ensure their security. Therefore, in summary, it establishes four crucial points regarding data protection:

- Appropriate handling and use of personal data.
- Request for authorization and/or revocation regarding data collection.
- Penalties for companies that fail to comply with the aforementioned measures.
- Freedom for all citizens to access their own data.

##Tic Tac: There's no more time to ignore LGPD, see the consequences of doing so
It should be clear to you by now that LGPD has brought forth a series of important issues that completely impact the way companies operate.

Now, bringing it into the digital environment we are currently in, it becomes even more crucial for companies to demonstrate transparency to their visitors and strictly adhere to authorizations and policies.

Although the law granted a transition period for companies until August 2021, that deadline has already passed. In other words, the application of penalties and fines under the General Data Protection Law is now possible for websites that fail to comply with its guidelines.

Therefore, if your website still doesn't have clear privacy policies, in the case of cookie usage, or a [cookie banner](https://goadopt.io/blog/en/cookie-banner/) that respects personalized authorizations, it is at risk.

The penalties under LGPD are quite severe and include warnings (less severe) and [fines](https://goadopt.io/blog/en/fines-in-lgpd/). For non-compliance, the [fine](https://goadopt.io/blog/en/fines-in-lgpd/) can be up to 2% of the company's annual revenue (with a maximum calculation base of R$ 50 million). Additionally, there are possibilities of sanctions that can block a company's database until they regularize their operations.

In this sense, continuing to ignore the law that regulates data security and protection is shooting yourself in the foot for your company.

By doing so, you put your website and your company at risk. Even in the best-case scenario of receiving only a warning, persisting in the error will affect your finances and the image of your website, as well as access to data that is crucial for your activities.

##How to adapt to LGPD and avoid problems with the law?
Ignoring LGPD is no longer an option since the deadline for compliance with the law has passed.

As we are currently in the digital environment, let's focus on how to help you in this process. After all, many companies nowadays have a significant portion of their processes and operations in the digital realm. Such as e-commerce, digital agencies, product launches, info product creators, startups, and more.

All the examples mentioned above rely on the use of personal data for marketing automation, landing pages, various tracking pixels with remarketing cookies, media campaigns, and so on.

In short, it is impossible to continue ignoring this law. But how can you put it into practice? Don't worry, we have prepared a basic step-by-step guide with some essential principles.

>Remember, LGPD is not just a checkbox on your website; it involves a change in processes and a culture focused on privacy. So, below are some tips. If you take them seriously, you will find some valuable further guidance at the end. (Some people are charging a lot for the information we provide here for free - you're welcome!)

>#Important _LGPD is not just a checkbox on your website; it involves a change in processes and a culture focused on privacy!_

##Plan your Compliance, "Know Your Mess."

First and foremost, it's impossible to talk about LGPD compliance without a plan. What does that mean? Understand that you'll never feel confident in what you're doing if you don't know where the data is, where it comes from, where it goes, who processes and uses it. Therefore, you need a [Data Mapping, here's an article ](https://goadopt.io/blog/en/data-mapping-or-data-inventory-lgpd/)that will help you understand what it is and how to create one.

You know when you're at the grocery store and you see a product out of place? It's kind of bizarre, right? It gives us an uncomfortable feeling, as they would say in the South of Brazil. So, seriously, dedicate some time to this, and you'll see that all the other steps will be simplified. You don't want to find a toothbrush in your sock drawer when the Regulatory Agency comes knocking at your door.

##Work on a privacy policy.

First and foremost, it's impossible to put LGPD respect into practice without developing a privacy policy. It provides comprehensive information on how the company collects data, how it uses it, with whom it shares it, its usage deadlines, and other details.

Likewise, it clarifies how data is stored and what precautions are taken to ensure security against leaks, for example. So, remember to use clear and accessible language and address all relevant points in detail.

What's the basis for writing a good policy? Guess what! Your Data Mapping from the previous point. So, don't skip the previous step, trust us!

Here's an article to help you with the [privacy policy](https://goadopt.io/blog/en/is-there-an-ideal-privacy-policy/).

##Use a cookie banner and configuration tool.

Remember that we're talking about digital companies, right? These companies have a very peculiar characteristic: the entry points for data are usually all digital. Therefore, it's much easier for us to control what goes through them! And even better, with the use of technology!

That's why your [Cookie Banner or CMP - Consent Management Platform](https://goadopt.io/blog/en/what-is-a-cmp/), when properly implemented, becomes practically a "Pareto of Compliance," those 20% of effort that solve 80% of the problems.

In other words, make sure your website has an appropriate cookie banner that helps you organize data from the moment of entry. The cookie banner won't be your silver bullet, but it will be an excellent start to keep things in order over time.

[Here's an article for you to better understand how an LGPD cookie banner works.](https://goadopt.io/blog/en/operation-of-cookie-banner/)

For that, rely on Adopt. Our team consists of experienced professionals in the market who provide all the assistance you need. Here, we help you [choose a cookie banner for your website.](https://goadopt.io/blog/en/how-to-choose-cmp-consent-management-platform/)

##Be cautious with information security.

Another important point for adapting your company and website to the Data Protection Law is to increase the focus on information security. Companies have always been responsible for leaked data, but now even more so! Therefore, let's work hard to prevent any leaks or resulting damages that can have serious consequences for companies and the individuals whose data is exposed.

Therefore, highlight the risks of leaks and security in your data mapping. Once again, dedicate time to these security criteria and processes. You won't regret having them mapped and controlled because, in times of chaos, the best feeling is knowing that you are prepared and know what to do!

##Be cautious with marketing actions.

Finally, also apply your care in applying LGPD to your marketing actions. After all, it's necessary to strictly adhere to using communications and campaigns only to those who have authorized their receipt, as well as other flows that are triggered through the use of personal data.

Here's another interesting article for you: [10 Marketing Processes You Need to Reconsider under LGPD](https://goadopt.io/blog/en/10-risky-processes-in-your-marketing/).

As mentioned before, these are just a few steps. If you want to delve deeper into compliance topics, the next article for you is [here](https://goadopt.io/blog/en/lgpd-meaning/).

How long can we ignore LGPD?

Having a cookie banner on your brand's website has become essential for many. For e-commerce, it has practically become an obligation. This type of website has a technological composition in which cookies are a structural part. Login flow, items in the cart, recommendation showcase, remarketing... Most of them rely on cookies.

As a result, the use of cookies is essential for the survival of online commerce. Therefore, cookie banners are also necessary to avoid fines and other penalties that may be imposed after the enactment of the [General Data Protection Law (LGPD)](https://goadopt.io/blog/en/lgpd-general-data-protection-law/).

However, beyond the simple legal obligation, cookie banners maintain a transparent and open relationship with the public.

Our experience allows us to anticipate some "consequences" of the cookie banner on your online store. It is important for you to understand each of them so that you are not caught off guard and can adjust to this new reality.

## Cookie Banner: What Is It?

As the name suggests, a cookie banner is simply an alert about the use of this type of data by your website. Through it, visitors become aware that the page uses these files, which are essential for its operation and to enhance the user experience.

However, it's not just that. With the enactment of LGPD in 2020, data subjects gained the power to authorize or refuse the use of these tools during their browsing. In other words, they can accept or reject cookies at any time.

Therefore, the cookie banner informs visitors about their website's use of cookies and, at the same time, requests the user's authorization to use them. The user has the power to choose which types of cookies to allow.

Thus, all the management of these variables is contained in a platform called CMP - Consent Management Platform.

[To learn more about what a CMP is, we've prepared this article for you.](https://goadopt.io/blog/en/how-to-choose-cmp-consent-management-platform/)

**## Some Tips for Configuring the Cookie Banner**

According to the [LGPD text, consent is defined as a free, informed, and unequivocal expression by which the data subject agrees to the processing of their personal data for a specific purpose.](https://presrepublica.jusbrasil.com.br/legislacao/612902269/lei-13709-18#art-5) Here are some points to consider when setting up consent collection for your e-commerce:

- **FREE**: Collecting consent in exchange for some benefit is prohibited. This can constitute what's called "consent bias." Visitors cannot be forced or coerced into accepting.

- **INFORMED**: Citizens must be informed about the details of consent. Only with free access to this information can consent be "celebrated" between the parties.

- **UNEQUIVOCAL**: Consent must be provided in writing or by another means that demonstrates the data subject's will, which can be evidenced by a record, date, and time.

- **SPECIFIC PURPOSE**: Consent must be given for a specific and not a generic or general use.

Only with the four points listed above can various interpretations be drawn for the consent collection flow. In [this article](https://goadopt.io/blog/en/how-to-choose-cmp-consent-management-platform/), we've provided a specific analysis of each of the flow, design, and legal arguments to help you choose your cookie banner.

## The Most Overlooked and Feared Configuration in the Market

The most complex and overlooked configuration in the market is the blocking of third-party cookies, releasing them only after consent. In other words, tags like Google Analytics, Conversion Pixel, Remarketing, etc., can only be fired after visitor consent, with the exception of essential tags, of course.

This is one of the most important points that ensure the rights and privacy of data subjects, which many companies struggle to understand, adopt, and implement. After all, this would completely impact the site's performance, conversion KPIs, and numerous tracking metrics.

However, it's worth noting that this configuration is also one of the first things auditors and authorities look at when assessing whether a website is compliant or not. Firing cookies before consent leaves a poor impression and is certainly a red flag for audits and authorities.

Unfortunately, many SEO, performance, and analytics tools do not prioritize privacy. Google itself favors sites that use its services and share data with it. So, the entire market will have to adapt. An interesting alternative for those looking for privacy-respecting analytics services is [Fathom](https://usefathom.com/).

## How Does a Cookie Banner Impact Your E-commerce?

Delving a bit deeper into the direct and indirect impacts of the cookie banner on e-commerce, we've listed some of the main influences below.

**1. Bounce Rate: Be Cautious About Size and Design Harmony**
Any popup, banner, or notice that appears on the screen tends to prompt an immediate reaction, often rejection (especially on mobile). To prevent this, it's important for the Cookie Banner to have a minimalist design that harmonizes with your site's style. Otherwise, the chances of rejection or a bounce increase significantly. Look for opportunities to customize colors, formats, fonts, text, and images to make the banner's communication as unobtrusive as possible.

**2. Cookie Blocking and Metric Impact: Balloon Banners Are More Accepted Than Bottom Bars**
As explained in the previous item, once third-party cookie blocking is implemented, the metrics associated with this firing are directly impacted. From our experience, we've observed that about 25% of site visitors give consent. Sites that use balloon-style cookie banner have an 80% higher acceptance rate than the bottom bar format.

**3. Data Subject Requests Create a New Workflow/Process in Your Company**
One of the obligations brought by privacy laws ([LGPD, GDPR, CCPA, PIPEDA](https://goadopt.io), etc.) is the free access of citizens to their data and direct queries to companies. In other words, a citizen can at any time inquire if your company holds any data related to them and request more information, portability, or even deletion of it.

That's why, at AdOpt, we place such importance on data subject request workflows. Each AdOpt banner also generates an Opt-out page where people can make their requests at any time. This generates an email sent to the [Data Protection Officer](https://goadopt.io/blog/en/responsibilities-of-a-data-protection-officer/) (DPO) of the company, which, by law, must be responded to within 15 days.

So, your company needs a structured process to ensure that requests and their responses are fully met within the deadline. Someone must be trained and responsible for this workflow.

Would you like more tips on how to organize your operations to better handle these requests? I've selected two articles for you:

- Learn more about the [ROPA document of LGPD](https://goadopt.io/blog/en/ropa-for-lgpd//).
- [Data Mapping or Data Inventory, the DPO's Lifesaver](https://goadopt.io/blog/en/data-mapping-or-data-inventory-lgpd/).

**4. Tag Changes, Tool Testing Will Have a Larger Workflow**
Some companies tend to test many tools and technologies on their websites, which is not a problem in itself. However, since many of these tools fire cookies, it's essential that the entire communication flow, now established by LGPD, be reviewed and, if necessary, updated with the introduction of a new technology that fires cookies or collects data.

Especially if your official documents, such as the Privacy Policy and, possibly, the Terms of Use, have already listed the cookies you use, their purposes, deadlines, etc.

Therefore, if there is any change in the listing of official documents, it is important that communication is also completely revised and updated. It's worth noting that whenever a new privacy policy or cookie policy is updated, all consents collected up to that point should be updated/replaced. This is because consent is an agreement between the company and the citizen, the terms of which are precisely in the policy. Therefore, if the policy changes, the agreement of the parties must also be collected.

- [Learn more about how to notify users about term updates.](https://goadopt.io/blog/en/notification-to-users-terms-of-use/)
- [Important Tips on the Ideal Privacy Policy for Companies.](https://goadopt.io/blog/en/is-there-an-ideal-privacy-policy/)

## Is a Cookie Banner the Same as a CMP?

No, a CMP (Consent Management Platform) is a tool where a cookie notice or banner is just one integrated feature among many.

This differentiation is important because some people think that a cookie banner is just a pop-up with a button for the website. However, the technology involved goes far beyond that.

The banner can identify whether the visitor is accessing for the first time or not. By collecting the visitor's consent, it triggers this record to the database and to other tools that also await consent to react to access. All of this happens in milliseconds.

This is just one of several functionalities. Others include:

- Blocking third-party cookies.
- Hiding after acceptance.
- Recognizing the browser's language so that the banner is translated into the visitor's preferred language.
- Recognizing the visitor's IP country to ensure compliance with the visitor's country's legislation.
- Redirecting to the Opt-out/rights of data subjects page.
- Alerting the DPO when a request is made, consolidating visitor information.
- Integration with systems via API, callbacks to feed other databases.
- And more...

- Want to know more about a [CMP and how to choose one for your company? This link can help.](https://goadopt.io/blog/como-escolher-cmp-plataforma-gestao-consentimentos/)

## Why Have a Cookie Banner?

In summary, based on what we've seen so far, this is important for two main reasons. First, because LGPD requires it. According to the law, all use of data from data subjects must have their knowledge and consent. If you can manage this information offline or in some specific way, great! If you need to scale and automate workflows, the cookie banner (CMP) is essential for you.

But it's not just that. The cookie banner is also important to demonstrate to your audience how you care about both their experience on your site and the transparency in the relationship between the page and them.

Therefore, it improves the reliability of the relationship and shows the site's responsibility to its audience, as well as its pursuit of the best possible experience without compromising privacy.

So, it's extremely important to have a good cookie banner. It should be intuitive, grab the audience's attention, and integrate naturally with your website. Below, you can see how to get a good information banner and consent management.

## How to Get a Good Cookie Banner that Helps with Data and Consent Management?

For this, you can rely on AdOpt! Our cookie platform not only includes the banner but also a management tool, i.e., a CMP.

The platform is adaptable to your website's design, seamlessly integrating with it. Thus, when the site opens, it's available and provides information about the cookies used, as well as offering personalized configuration options for which ones the data subject will authorize.

Similarly, AdOpt includes essential documents for LGPD compliance on the page: Terms of Use and Privacy Policy. Therefore, all this data is organized in one place.

To top it off, AdOpt combines all of this with a real-time update and tracking tool for all entries, exits, and changes in consent. By doing so, it ensures that data will only be used in accordance with the data subject's wishes.

So, don't hesitate to rely on AdOpt and check out our plans. You'll see how complying with LGPD is much easier and more beneficial than it seems!






The Impact of Cookie Banners on Your E-commerce - LGPD

AdOpt is a consent management platform that allows you to build a relationship of transparency and trust with your website visitors.

So, every visitor who accesses your site will be greeted by a banner with a notification asking for their consent in a free, direct, informed, and detailed manner.

Below is a step-by-step explanation of how consent registration works in AdOpt.

## How does the [AdOpt cookie banner](https://goadopt.io/) work?

#### Here's an example of how the platform operates:

1. #### The visitor accesses your site.
    
2. #### AdOpt checks if this access is from a new visitor (meaning they don't have the AdOpt cookie).
    
    #### 1 – If yes, the banner is not displayed, and only the controller (a small dot with the AdOpt or your site's logo) is visible in the corner of the site.
    
    #### 2.2 If not, AdOpt treats them as a new visitor.
    
    #### 2.3 Necessary/Essential tags are triggered.
    
3. #### The visitor receives a privacy setup notification from AdOpt, including:
    
    #### 1 – A list of third-party Tags/Cookies and their classification by the AdOpt site manager.
    
    #### 3.2 – Public links to the Privacy Policy and Terms of Use.
    
    #### 3.3 – Public links to AdOpt's opt-out page for that site.
    
4. #### The visitor configures their preferences, with the option to detail the list of each category of [cookies](https://goadopt.io/blog/cookies-e-lgpd/) and present tags.
    
5. #### Upon clicking "Accept," AdOpt generates a unique CookieID for that visitor, which is stored in their browser.
    
6. #### Consent information, including:
    
    #### 1 – Date and Time,
    
    #### 6.2 – Anonymized CookieID,
    
    #### 6.3 – An updated list of accepted or rejected Tags and Cookies,
    
    #### 6.4 – The version of the Privacy Policy and Terms of Use available at that time,
    
    #### is individually recorded in the "Consent Log" within the AdOpt platform (logged area).
    
7. #### If the [AdOpt banner](https://goadopt.io/blog/responsabilidades-de-um-encarregado-de-dados/) for the respective site has been integrated AdOpt with Tag Manager, whenever this visitor accesses the site, the list of authorized or unauthorized tags (item 6.3) will be in the visitor's browser.
    
    #### [– Here's a tutorial on blocking third-party tags](https://www.youtube.com/watch?v=8jqGLjZZ4UM)
    
    #### So, with each new visit, the tags in GTM check AdOpt's list to determine whether they should be activated or inactive for that unique visit.
    
8. #### If the visitor submits an opt-out request:
    
    #### a – AdOpt updates the CookieID that made the request, marking this cookie as inactive/opt-out. This way, within the AdOpt system, this "CookieID" will be invalidated and will only serve as a record for proof of consent.
    
    #### b – Two emails are sent to notify the data subject (if identified) and the site/company manager.
    
    #### 1 – The company receives this email and can analyze whether there are other integrations that use this information to proceed with the request in other integrated systems (systems, call backs, and APIs).
    
    #### b.1.1 – If you have no data associated with the cookie, you don't need to take any action. AdOpt will only have anonymous information for proof of consent, a copy of which you have already received in the email.
    
    #### b.2 – If the data subject has also provided an email, you should use this data to exclude them from all other systems, using it as an access key through your data mapping.
    
    #### [– Here's an article on data mapping](https://goadopt.io/blog/mapeamento-ou-inventario-de-dados-lgpd/)
    
    #### b.2.1 – If it's in your processes to notify that the deletions have been made, use the data subject's email for this notification.
    
    #### b.3 – The data subject is notified through a pop-up and a link in the email footer that directs them to an educational and public environment that teaches them how to manually delete cookies from their browser.
    
    #### [– Here's the tutorial sent to the data subject](https://goadopt.io/en/blog/delete-cookies-cache-chrome/)
    
    #### c – AdOpt maintains this record in its database, indicating that the CookieID #xyz.example.1234 made a request at that moment (date/time). So, if you need it for legal bases and privacy audits, it will be easily accessible.

This is a fairly comprehensive breakdown of the process!

If you feel that any part of how a cookie banner works is missing, please feel free to write to us [here](https://adopt-help.freshdesk.com/support/tickets) or leave a comment for us!

Thank you very much! The [AdOpt Team](https://goadopt.io/).

How to choose a Cookie Banner for your website

Best practices in tag categorization

How long can we ignore LGPD?

The Impact of Cookie Banners on Your E-commerce - LGPD

How does a cookie banner operate?

What is a CMP (Consent Management Platform)?

How to Choose a CMP (Consent Management Platform)?

Google Consent Mode: Beginner to Advanced Guide.

Google Consent Mode: Guida per Principianti ed Esperti.

Google Consent Mode: Guía de principiante a avanzado.

Oregon OCPA and Cookies: All You Need to Know

Tennessee TIPA and Cookies: All You Need to Know

California CCPA and Cookies: All You Need to Know