## Want to understand why there are cookie banners on every website you visit today? This article is for you!

Cookie banners, cookie notices, GDPR notices or Privacy Notices… call them what you want. (We’ve even heard them called “that boring legal notice,” but more on that later.)

In fact, all the world’s largest and most serious companies have already added a cookie banner to their website, and this is for a good reason: GDPR, LGPD, CCPA and many others are live!

Completely inspired by the GDPR ,the LGPD in Brazil, as it’s commonly known, is a regulation that was created in 2018 specifically to address the way that personal data, such as a user’s name, e-mail, telephone number, address, etc.,  is collected and utilized by companies.

## The GDPR, LGPD…CCPA and cookie banners are here to stay!

Why does the GDPR require cookie banners? Does every website now need a banner?

The LGPD, as said, was inspired by the European Union’s General Data Protection Regulation (GDPR), and similar laws are already being enacted all over the world. Even North Korea now has its own privacy regulation! That is to say, this is not a passing trend and must be taken seriously. 

This shift does not necessarily mean more bureaucracy, but it does mean real empowerment. Thanks to these new privacy laws, ordinary citizens now have the right to authorize, deny, or even revoke companies’ ability to use their data!

## You mean I didn’t already have the right to decide what happens with my data?!

Don’t worry, we can explain! 

The answer is not that simple, as this law needs to function in parallel with innumerable others that also govern individual rights, including consumer, health, and internet law, among others. 
Keep going, it will be worth it! Soon you’ll be able to speak like an expert on this subject. 

With the advancement of advertising technologies that are linked to [digital marketing](https://br.sharpspring.com/marketing-digital/) and the exponential growth of social media, everyone now has a machine that generates and stores valuable data in the palm of their hands: cellphones. Every time an individual accesses a website, e-commerce account, Instagram, Facebook, or any similar platform, the visit generates data that is collected and stored by cookies. 

Cookies are simply text files that are capable of storing information generated by websites. 

## Want a practical example of cookie technology? 

I'm sure you know when you enter a website through your browser and it recognizes that you’ve already accessed the page before, allowing you to re-enter the site without signing in again? This happens because your browser has already stored a cookie from that site which can authorize your access. 

In the same way, cookies can also store data like which photos you’ve liked on Instagram or if you “forgot” a product in your shopping cart. All of this information is saved for later use.  

## And this is very valuable! 

Did you know that a person needs, on average, at least six interactions with a product or service before making the decision to purchase? 

It’s no wonder that when you “forget something in your shopping cart,” the product seems to follow you all over the internet with ads. Only then do you end up making the purchase. Is this a coincidence, or magic? 
Neither, these are the processes and technologies that utilize cookies for advertising.

If you’ve been through this, welcome! You’re in good company. 

Simply put, cookies are a piece of the wheel that moves the internet. It’s the use of data for advertising that allows us to consume the content that we love for free. After all, who do you think pays for that cool, free YouTube video? Advertisers! And now you know they use cookies to find you on your favorite channel. 

The use of cookies is not necessarily positive or negative, but it reached a point where individuals like you or I were not fully in control of what the internet giants were doing with our data. This is why privacy laws like the GDPR, LGPD and CCPA were created: to rebalance the relationship between companies and people.   

Ok, but weren’t you going to talk about data, privacy, and the rights I have? 

Yes! When the LGPD was enacted by Brazil in August of 2020 it forced companies to examine the way that they handled the plethora of consumer data generated by their business, and to make changes to their processes and databases. One of these changes was the obligation to inform visitors of the reason for their data collection, as well as the legal basis for it. 

Thus, in accordance with the LGPD, GDPR, CCPA and several others, every business must present a clear and objective communication that informs visitors of their purposes for collecting personal data. Whether on or offline, it is essential that every citizen is notified of the collection of their personal data as well as the many ways it might be used. 

As for us data “subjects,” as some law refers to us, we are now able to make a “free, informed, and unequivocal declaration,” as to whether or not we permit its use. That is to say, if we consent to the terms outlined by the business, we authorize them to use our data. In Brazil, for example if businesses violate this flow by collecting data without consent, they could face serious consequences including being fined up to 2% of their annual revenue, with a ceiling of 50 million real. Has your business ever considered the threat of being fined simply for not having a cookie banner on its website? 

Want to understand exactly how the GDPR, LGPD and CCPA impact your business? Here are some articles on the subject.

## But how do I know what they already do, or will now do with my data? Will the cookie banner tell me? 
Who among us has actually read the privacy policy or terms of use of a website we use? Not many, but it’s precisely in these official documents that these answers are found.

According to the Privacy Laws, businesses must comply with certain official documentation requirements and legal basis to inform users of their entire data collection process and its purposes. Well-known by lawyers, the “Privacy document kit” fulfills the standard that every company must meet, including a privacy policy, terms of use, data mapping, and contact information of the DPO, among others.

## Now the good news! 
These documents don’t need to be written in “legalese,” nor should they be, as LGPD, GDPR and CCPA requires that the information presented be “clear and accessible.” A user cannot consent to the collection of their data if they cannot understand the banner. 

What’s the use of a company acting cool in its marketing and communications, or speaking beautifully in advertisements, if when addressing privacy and transparency it starts speaking in code? It doesn’t make sense, right?

Anyway, this article aims to inform you that, along with the laws like GDPR, LGPD and CCPA, we also have new rights and duties, both as citizens and, especially, as companies. In this matter, the cookie banners actually serve a noble purpose! Businesses that use these banners correctly are able to show customers that they care about their individual rights, freedom of choice, and privacy. 

## A good cookie banner should meet certain minimal requirements outlined by the GDPR, LGPD and CCPA: 

Inform users clearly and objectively of all of the ways in which the company collects consumer data. 
Point to official documents such as the privacy policy, terms of use, etc. (referring back to the Privacy document kit mentioned above). 

List the options that you as the data owner have to fully or partially accept “the rules of the game” with that company, thus allowing you to receive their content or consume their products or services. 

Make it clear where, upon accepting the cookies, you could access the data that the company will gather about you, and how to opt-out if you change your mind. 

Allow users to consent to the data collection in a way that is free, informed, and unambiguous. 

**Last but not least:**

When you see the banner: “If you continue browsing, we understand that you consent…” know that the law has determined this to be insufficient, and there are several arguments why. Mainly, this banner without further detail does not give the visitor enough information to give their consent in a manner that is “free, informed, and unambiguous.”

We hope this article helped you to understand the “why” of the now popular cookie banners, which will soon be installed on all company websites. With this new regulation, there is no going back. 

## We’ll leave you with two final invitations: 

1. Do you know a business that needs to know more about cookie banners?

Again, any and all companies that collect personal data, such as name, email, or telephone number on their site, and use third-party services like the Facebook pixel, Google Analytics, etc. MUST include this banner.

We at AdOpt are experts in cookie banners and can help them today! And even better, for many it’s free! Send this article to whoever you know that could use this content. They will thank you when they avoid an unpleasant fine!

2. Want to dive deeper into the subject of cookie banners?
We’ve got more articles for you [here](https://goadopt.io/blog/significado-da-lgpd/) para você:).



Why are cookie banners everywhere?

João Bruno Soares

In this article, you will have a great introduction to the topic, as well as various other variations that revolve around the subject: Cookies and LGPD.

We list concepts and examples of cookie types, how to classify them in your documentation, Privacy Policy, Legal Bases of LGPD, etc.

In effect since August 2020, the General Data Protection Law (LGPD) will require a drastic change in the operations of companies that use data from their customers and users. Starting from August, data can only be used if it complies with the principles of LGPD - the so-called Legal Bases of LGPD - and is transparently and objectively consented to.

This will cause numerous websites to not only change their privacy policies and the information their cookies store but also various processes and ways of handling people's data. In this article, we will see how the use of cookies will be affected and how your company can continue to use them in a way that respects the law.

## What are cookies?

Cookies are small text files that can store what the user is doing for a certain period. Some cookies store your browsing history, as well as logins and passwords. It is because of them that you can access your Facebook account without having to enter your email every time, as the browser (using cookies) does it for you.

In addition to various functional aspects, cookies also provide excellent service in well-known systems such as Google Drive, for example. Thanks to the cookie's ability to store information, we can work on our texts, spreadsheets, presentations, even offline, and when we reconnect, our work is not lost.

## There are two types of cookies:
**First-Party** and **Third-Party Cookies,** terms used to refer to cookies generated by the website owner or by third parties.

First-Party Cookies are those generated by the website's own domain. From the website owner's perspective, they are the information that visitors generate during their browsing session.

- Which tabs you visited;
- If you searched for a product, added it to a list, and "forgot it in the shopping cart";
- If you filled out any forms, etc.

Many website builders or e-commerce services use cookies to provide these functionalities to their customers. So, don't be surprised if you see that your website triggers first-party cookies without notifying you. They have practically become a "market standard."

Regarding the cookie's storage capacity, this information is indeed "generated" by our browsing, and cookies are one way to store it. How does it work?

When the system generates a cookie, it has an identifier that stores the information in the company's database as well as in the visitor's browser. A very simple example is when we access a news portal and encounter the famous paywall message, "you have reached the limit of daily free articles, subscribe to our services."

How does it know that you have already read a specific article?
Simple, through the cookies it stores in your browser for each article read.
(Does this mean that if I clear my cookies or browse anonymously, I can read freely?... Wait, wait... do you think they haven't thought about that too? 😉)

On the other hand, Third-Party Cookies are cookies from third-party sources external to the website's domain. In other words, they are cookies from third-party companies that also set cookies to record information about their visitors.

Most of the time, these third-party cookies should (or at least should) all be authorized to be present. Otherwise, the website owner may be surprised by the number of entities "sucking" data from their site(s).

Here are some common examples of services that use cookies:

- Facebook Ads
- Google Ads
- Google Analytics
- Hotjar
- Cloudflare
- Mixpanel
- Zendesk
...

## How does LGPD affect the use of cookies?

5th Article 5 of the _Lei Geral de Proteção de Dados_ - LGPD provides legal definitions of terms that you will come across frequently when researching the regulation. Among these definitions is that of personal data:

**"personal data: **information related to an identified or identifiable _natural person._"

We have the last two words in italic because they are the most important for the subject at hand.

Not all data that cookies carry is personal. For example, your visit to our website is not personal data. However, once you register your email on a site like Facebook, you are identifying yourself. Therefore, this is personal data that can be collected by a cookie.

And it is from there that the LGPD starts to affect how your data is used by websites and how your website handles user data.

The problem with the use of cookies arises when it is not known what data is being collected, for what purposes, and by whom. It is a matter of privacy and transparency, values that are the foundation of the LGPD.

The use of cookies that violates the LGPD will be penalized, and among the penalties are expensive fines.

## Who needs a cookie policy?

All websites that process data, specifically those that use First or Third Party Cookies. If your website processes personal data or data that, when combined, can identify an individual person, it needs even more careful review of how this information is processed.

But, should this be listed in the Cookie Policy or the Privacy Policy?

That depends on the company's choice to differentiate these aspects, as it may be a different approach based on the business model. Some companies address regulations for their "digital" data in the Cookie Policy and the "offline" data in the Privacy Policy. However, it varies greatly, so we recommend consulting an expert who can analyze your business model and all the data flows and mappings of your company to understand the need for such differentiation.

## Cookie requirements: How to keep your website compliant with LGPD.

To ensure that a website is compliant with LGPD when using cookies, there are certain principles to consider, especially if you have a valid "reason" or legal basis that supports the use of data and cookies on your site. For many, this legal basis is "Consent."

What does that mean?
In order for companies to process personal data of data subjects (individuals like you and me), they now need to have a strong legal basis provided by the law (LGPD). This "permission" is known as the Legal Bases of LGPD.

Therefore, while consent is not the only legal basis that allows companies to use data, it plays a crucial role when it comes to cookies. This is why cookie banners serve an essential purpose: notifying and informing visitors, as well as correctly collecting and storing individual consents.

Regardless of the information carried by a cookie, it should have been consented to by the user. But what makes consent valid? And what should be communicated to the user?

The user must be clearly and objectively informed about the purpose for which their data will be collected. Additionally, they must give their explicit consent, or opt-in, by clicking on a banner.

To automate this process, Cookie Notices or Cookie Banners are used.
They serve to fulfill the sixth principle of the law: transparency.

## Cookie Banner or Cookie Notice
The Cookie Banner is that little pop-up window you can see on most websites nowadays, including when you entered our blog. This banner communicates that the site uses cookies. Ours says the following:

"Take control of your privacy. Our site uses cookies to enhance navigation." Then, there are two links: Privacy Policy and Terms of Use. Right after, there's a button for you to view your privacy options and an "accept" button, indicating that you agree to the use of your data.

The cookie banner, or cookie notice, which is a feature of the Consent Management Platform, serves to explicitly state the practice (use of cookies), the purpose (enhancing navigation), and offer users the possibility to fully or partially agree to the data processing.

This is what LGPD requires: transparency and objectivity, without complications.
In this way, the use of cookies is permitted and can greatly assist in your business operations.


## What is the expiration period of a cookie?

GDPR, the European data protection regulation, has a limit of twelve months for the use of a cookie. However, LGPD does not establish an "expiration" deadline.

But one of the principles for data processing is necessity. According to the regulation, data can only be retained for the time necessary to fulfill its purpose. If a cookie carries information that no longer needs to be used, it becomes invalid under the law.

Additionally, there are various initiatives by browsers—especially Apple's Safari, which automatically blocks third-party cookies. This "trend," as it is known in the market, has been widely discussed since 2015, even before GDPR. However, it is always being rethought or adapted because the entire advertising and analytics market relies heavily on the widespread use of cookies.

Thus, any changes in this regard will indeed be revolutionary and will bring many changes to the ecosystem as a whole.

## Cookies and LGPD in the privacy policy.
It is important that your privacy policy includes a detailed and specific explanation of how your website uses cookies.

As described earlier, many companies make distinctions between the cookie policy and the privacy policy. This is not mandatory, but it may be necessary based on the business model. So, don't cling to templates, but strengthen transparency and accessibility for the information listed there.

## Cookie Pixel and Tag, what's the difference?
It is important to avoid confusion at this point, as many people end up mixing up these concepts. I'll provide a simple explanation below, which will help us understand the order of things and facilitate overall comprehension.

Remember: Tags and Pixels trigger Cookies.

- Tag & Pixel: Code that goes into the HTML of your website to call a specific service. These are scripts (programming codes) that call a server and perform specific functions based on these requests.

- Cookies: Text files read and triggered by Tags & Pixels, which store data and serve to identify whether a browser is new (if there is no cookie, the tag triggers) or already known (if It has the cookie, It will overwrite it).

##What is the correct way to use cookies under LGPD?

To maintain compliance with the law, it is necessary to pay attention to the principles of LGPD and have knowledge of the regulation as a whole.

Furthermore, once it is decided that the company will indeed use first-party or third-party cookies in its operations, the categorization or organization of these cookies is the basis for communicating with visitors in your cookie policy and banner.

In general, the market uses five main groups to classify their tags and consequently the cookies triggered by them:

- **Necessary**: Without them, your business model doesn't work, or you have to use them due to legal requirements/legislation.
(e.g., first-party cookies, gateway authentication, etc.)

- **Advertising**: With them, you trigger remarketing, populate ad pixels, email sequences, etc.
(e.g., Facebook Pixel and Google Ads)

- **Analytics**: With them, you have an analysis of what visitors do, where they come from, how they behave on your site.
(e.g., Google Analytics, Hotjar, etc.)

- **Performance**: Tags that maintain site functionality and ensure its operation, e.g., preventing DDoS attacks.
(e.g., Cloudflare)

- **Functional**: Tags that handle functional aspects, such as remembering preferences or recognizing that the user is already logged into the system.
(e.g., Chatbots, Helpcenters)

## How to manage cookies and visitor consent under LGPD?
To facilitate data collection and record user consent, there are Consent Management Platforms (CMPs) like [AdOpt](https://goadopt.io/).

In this [link](https://goadopt.io/en/), you can learn more about our service: In summary, a Cookie Banner that helps your website comply with LGPD, GPDR, CCPA... standards while also being a comprehensive tool for managing consent and communicating with visitors. 

Get [started for free now](https://goadopt.io/en/) and avoid LGPD, GPDR, CCPA... fines!






LGPD and Cookies what do you need to know?

If you've reached this article, you're certainly searching and wondering: What is the best cookie notice for your website, and how do you choose among the many options on the market? What are the criteria for this choice, and what are the strengths and weaknesses of each option? Well, we're here to help you because this decision needs to be well thought out!

Therefore, below we have listed the answers into key points that should be carefully analyzed.

1. Why do I need this banner, really?
2. But cookies are anonymous, so why all this?
3. Legislation and Language.
4. LGPD and the cookie notice, technical aspects of the Law.
5. Design.
6. Truth.
7. Detailed Purposes.
8. Freedom of choice.
9. Blocking third-party cookies.
10. Price
11. Integrations.


##Why do I need this banner, really?

First of all, **does your website REALLY need an LGPD Cookie banner?**

What do you mean? I'm already in this article to choose a cookie software, and you still want to tell me who actually needs the LGPD Cookie banner?

Exactly! Because there are many people who come to us to install the cookie banner on a website that simply does not use cookies. Seriously! Sometimes it seems like our banner is synonymous with website quality (okay, I confess, I agree), but there are limits.

It's like buying sunscreen for a nighttime stroll or mosquito repellent for diving.

The key point is confusing for many!

1. Just because many websites are using it doesn't mean you need to as well!
2. Pay attention to other legal bases that can support your business, in addition to consent.
3. The key question: If you don't use cookies on your website, why have a cookie banner? In times of such complex legislation, less is more!

Here, we have highlighted some points from the LGPD to support our reasoning:

**Article 8** addresses how the controller should request the data subject's consent. The first and most important rule is that the consent clauses must be separate from others, allowing the data subject to have a clear understanding of what they are consenting to.

Article 8 - § 2: The burden of proving that consent has been obtained in accordance with this Law lies with the controller.

_What does this mean? _
As the controller (your website), you must keep a record of all consents obtained, and these must be stored and documented.

Because at any time, data subjects have the right to request such records and any data you may have about them.

Refer to Article 19:

**Article 19: Confirmation of the existence of personal data or access to personal data shall be provided upon request by the data subject:**
_
I - in a simplified format, immediately;_ or

_II - through a clear and complete statement indicating the origin of the data, the absence of a record, the criteria used, and the purpose of the processing, subject to trade and industrial secrets, provided within a period of up to 15 (fifteen) days from the date of the data subject's request._

1. Personal data shall be stored in a format that facilitates the exercise of the right of access.

2. Information and data may be provided, at the data subject's discretion. § 3. The processing of personal data based on defective consent is prohibited. § 4. Consent must relate to specific purposes, and generic authorizations for the processing of personal data shall be void. § 5. Consent may be revoked at any time by the data subject's express manifestation, by means of a free and facilitated procedure, without prejudice to the processing carried out under the previously given consent until the request for elimination, as provided for in item VI of the main section of Article 18 of this Law.

##But, aren't Cookies anonymous? Why all this?

If you're not familiar with the digital world, let me explain to you with the most popular phrase from privacy policies ("Cookies are small pieces of text that are stored in your browser when you access a website on the internet.")

With this information from cookies, companies can do a lot, and I mean a lot! They can accurately profile your psychology and cross-reference this information with extremely personal data, known in the market as data enrichment or "data farming."

###The logic is always very similar: Browser -> cookie -> personal data (email, phone) -> person/registration -> CPF (Brazilian individual taxpayer registry) -> income, IRPF (Brazilian income tax return), marital status

Several companies do this, and virtually all of those that have tags installed on their websites can somehow convert this information and target any individual specifically. Whether it's directly through their own database (Google), or by cross-referencing with third-party databases (such as Serasa).

In other words:

**Cookies are not anonymous but rather anonymized.**

##Legislation and Language.
This is an excellent variable to consider when looking for a cookie banner! Questions like: Does it support multiple languages, can that be an advantage? But, before that, does it accept multiple legislations?

For example, if your website is Brazilian and someone accesses it from Italy, it wouldn't be enough for the banner to be in Italian. The visitor is actually under the jurisdiction of the GDPR, unless the LGPD has more "private" provisions in those specific areas (as required by the visitor's country's law).

In other words, just because your site has multiple languages and versions doesn't mean that all the legislations are correctly implemented and complied with regarding the cookie notice. Is it clearer now?

Pay attention to compliance with the applicable legislations, especially for your target audience! Language and accessibility are crucial, but not the only factors when it comes to foreign accesses.

##LGPD and the Cookie Banner, Technical Aspects of the Law.
Now that we understand the context of the law, the complexities of cookies, and the parallel legislations that may influence the use of the Cookie Banner on your website, let's discuss some key points that will help you make this choice.

1. **Design**
Why design when we're talking about technical aspects? Precisely because of that, after all, what are the main metrics of a website, an e-commerce? How do you analyze the conversion from visitors to leads and then to sales? Is Bounce Rate a concern? What are the KPIs of your site? Does usability and visitor experience matter?

Yes, they matter A LOT!

Therefore, look for a cookie banner with refined and responsive design that allows you to customize colors, logos, and placement on the site in a way that harmonizes with the overall structure of the site. Don't just throw a senseless banner in the middle of the visitor's screen; respect the attention the visitor is giving you!

Be cautious with designs that occupy the entire screen! We understand that the law requires clear and assertive communication, and many are overwhelmed by the uncertainties in the market. However, you shouldn't disturb the visitor or act impulsively because of that!

We know how every second counts in capturing visitors' attention, so make it count!

Do you really want to use a banner that steals attention instead of fulfilling a simple and even basic role required by the law?

![aviso barcelona.png](https://strapi.goadopt.io/uploads/aviso_barcelona_1cc05ad647.png?updated_at=2022-08-17T18:16:59.332Z)

This Barcelona F.C. banner is like having ten players blocking the goal...

2. **Transparency**
I may sound sensationalistic, but I dare say:

**"Most of the cookie plugins and banners we see on the internet are just fake buttons. Yes, digital components that don't record or organize anything."**

In addition to the "fakeness" of these mentioned points, always use assertive and direct language. Don't try to be "cool" or trendy. Of course, using too much legal jargon can push people away.

![aviso seção verdade.png](https://strapi.goadopt.io/uploads/aviso_secao_verdade_3a5ce550cc.png?updated_at=2022-08-17T18:18:11.830Z)

Not to mention that if I have no way to refuse, how would it block then? So, in the end, it's the same thing, don't you agree?

##Detailed Purposes.

This is one of the crucial points we consider in a good cookie banner. According to LGPD, consent must be given for specific purposes. Therefore, a simple "OK" or even "Accept" without the option to explore my choices and understand their purposes and legal bases can be somewhat coercive.

Consent is not a salvation or a general acceptance. It is the formalization of acceptance for that specific purpose presented.

![aviso sem finalidade.png](https://strapi.goadopt.io/uploads/aviso_sem_finalidade_db0539333e.png?updated_at=2022-08-17T18:18:58.036Z)

##Freedom of Choice.
The General Data Protection Law (LGPD) lists a series of legal bases through which companies can use data with ease. If you have chosen consent for your company, use it with respect and always value the privacy of your data subjects.

There is no better or stronger legal basis. Instead, choose the one that best fits your business model and market. Similarly, a cookie banner should understand the context in which consent will be communicated and collected, and should provide visitors with the freedom to choose fully, partially, or not at all.

Always look for cookie banners that break down the listing of tags and cookies into categories and subcategories. This is essential to demonstrate that a particular purpose is presented within category "X," and visitors can freely choose whether to accept it or not.

##Blocking Third-Party Cookies.
The cookie banner is not just an interactive button; it must have authority over the behavior of other tags used on the website, authorizing or blocking their firing based on the consent collected during that visitor's session.

For example, the Google Analytics tag should only be fired when the visitor accepts the statistical category of tags. Before that, the notice informs and waits for visitor interaction.

For more information on how to configure the AdOpt Cookie Banner to enable automatic blocking of third-party tags, see our tutorial.

##Price
The price of a cookie banner should be:

**- Affordable:**
Low prices that do not eat into your marketing budget. If there is a free plan, even better! The cookie banner only solves a part of the law's compliance, and it's likely that you will need other services or consultations in the future. Therefore, don't spend too much of your budget on this product.

A cookie banner does not cover all the obligations of LGPD, for example.

If you have other internal processes that use personal data, you will need to use other controls and even systems for that management.

The cookie banner should take care of the "digital gates" and reinforce the legal basis of consent.

How?

By recognizing and categorizing all users with their choices of total opt-in, partial opt-in, or opt-out and sending these requests directly to the Data Protection Officer (DPO), or even systems like CRM, ERP...

**- Scalable**
Look for cookie banners that offer billing with scalability parameters. In other words, they should have little to no impact initially, and as your website grows and your audience expands, you will pay for that processing power.

Additionally, the volume and value tiers should be broad enough to accommodate any seasonality, so you don't

How to choose a Cookie Banner for your website

While internet cookies, commonly referred to as just "cookies," are widely recognized today, some companies also use Local Storage and Session Storage as other methods used by programmers to store persistent information in a visitor's browser. However, what's the main difference between cookies and local storage, and why choose one over the other? This article will help you with these questions!

As mentioned earlier, [Cookies](https://goadopt.io/blog/en/cookies-and-lgpd/), Local Storage, and Session Storage are methods used through programming languages to store information in a website visitor's browser.

In other words, they store information in your browser about your access and how you navigate the website. Many of these have been used maliciously, even capable of storing all the information entered in text fields in forms, for example.

## Relax, cookies and local storage aren't synonymous with invasion of privacy.

Few people know that cookies were originally developed by hackers to capture people's data on the internet. Later, this technology gained a commercial purpose and is now widely used across the web.

Before you get alarmed or want to reject all internet cookies and storage, remember, they make your life much easier.

Thanks to them, your products stay in the shopping cart when you switch tabs or go back to the store to add more items.

They keep a pre-filled form in case there's a connection glitch, preventing you from starting over.

And they also welcome you by recognizing your previous access, without needing to log in to your account hundreds of times a day.

## What are the Key Differences Between [Cookies](https://goadopt.io/blog/en/cookies-and-lgpd/), Local Storage, and Session Storage?

Now that we've discussed the similarities, let's delve into the differences using three main criteria: **storage capacity, storage location, data persistence, and performance.**

**- Storage Capacity**

This capacity usually varies between browsers. In general, cookies can store up to 4096 bytes or 4KB, while Local Storage can handle 5MB, and Session Storage ranges from 5MB to 10MB.

Moreover, there's a maximum limit on the number of cookies per domain, and it's not recommended to exceed 30 cookies.

Some browsers, such as Opera, will prompt the user to allow more data usage when this limit is reached.

**- Storage Location**

Cookie information is stored in both the browser and the originating server of the referenced service.

Local Storage and Session Storage use only the browser as the storage location for data.

**- Data Persistence**

Data persistence refers to HOW and WHEN the stored information is deleted, erased, or invalidated.

**Cookies**

Cookies have an expiration date, causing the stored information to become invalid and outdated when that date is reached. However, whenever a visitor deletes cookies from a website, that information is also removed from the browser.

Some browsers automatically clear cookies periodically, and you can usually configure this in settings.

[Learn how to clear cookies and browser cache.](https://goadopt.io/en/blog/delete-cookies-cache-chrome/)

Today, due to privacy regulations like LGPD, GDPR, and CCPA, websites using these trackers must inform their visitors of their existence using a cookie notice. This technology, called a [CMP (Consent Management Platform)](https://goadopt.io/blog/en/what-is-a-cmp/), must then block cookies based on user consent.

[To learn all about GDPR, CCPA, and LGPD, we have this article for you.](https://goadopt.io/blog/en/lgpd-general-data-protection-law/)

**Local Storage**

Local Storage has no expiration date, so the information persists in the browser until the user performs a cleanup and deletion. Additionally, there are fewer browsers that offer features to block or periodically delete Local Storage data.

Regarding privacy regulations, especially [GDPR](https://goadopt.io/), the same obligation to inform its usage applies to Local Storage. Therefore, when choosing your cookie notice, ensure that it also lists third-party tracker Local Storage used on your site.

To learn more about [how a CMP works](https://goadopt.io/blog/en/what-is-a-cmp/), here's an article to help you understand.

**Session Storage**

In Local Storage, information remains stored until a deletion is performed. However, in Session Storage, the information is automatically deleted whenever the visitor leaves the site or closes the browser tab.

This is the main difference between Local and Session Storage.

**- Performance**

To analyze performance between web storage (Local and Session) and cookies, a highly technical language would be necessary. However, let's try to simplify the facts.

Every website has a visually coded part connected to a server. The server keeps the site online, and when someone accesses that URL, it operates those visual settings and responds to interactions on the screen.

This interaction is performed by the [browser (Chrome, Safari, Opera, Brave...)](https://goadopt.io/en/blog/delete-cookies-cache-chrome/)

If your browser has cookies from that site, in addition to communicating with the site's server, it must also await the server's reading of those cookies and their respective servers. This is because there may be cookies from that specific site and cookies from third-party companies installed.

Therefore, when using cookies, all requests you make to the site also depend on sending cookie information to your origin server and then to the site. Hence, simply using a cookie in your application consumes a bit more "bandwidth" and "data" to read and execute it on the site, and present it in the browser.

**In contrast, Local and Session Storage do not require this triangulation between servers, resulting in less bandwidth needed for the site to respond to the information contained in web storage.**

## How to Create a Consent Strategy as the [Legal Basis for LGPD](https://goadopt.io/blog/en/legal-bases-of-lgpd/)?

Want to learn more about [how a LGPD cookie notice works](https://goadopt.io/blog/en/operation-of-cookie-banner/)? In this link, I explain the step-by-step of the technology developed by [AdOpt](https://goadopt.io/blog/en/why-the-cookie-banner/) and used on thousands of websites.

After all, if your site uses cookies, you can't simply [ignore LGPD](https://goadopt.io/blog/en/ignoring-lgpd/). You need to choose a strategy to avoid the [fines](https://goadopt.io/blog/en/fines-in-lgpd/) associated with this new legislation.


What is the difference between cookies, local storage, and session storage?

Having a cookie banner on your brand's website has become essential for many. For e-commerce, it has practically become an obligation. This type of website has a technological composition in which cookies are a structural part. Login flow, items in the cart, recommendation showcase, remarketing... Most of them rely on cookies.

As a result, the use of cookies is essential for the survival of online commerce. Therefore, cookie banners are also necessary to avoid fines and other penalties that may be imposed after the enactment of the [General Data Protection Law (LGPD)](https://goadopt.io/blog/en/lgpd-general-data-protection-law/).

However, beyond the simple legal obligation, cookie banners maintain a transparent and open relationship with the public.

Our experience allows us to anticipate some "consequences" of the cookie banner on your online store. It is important for you to understand each of them so that you are not caught off guard and can adjust to this new reality.

## Cookie Banner: What Is It?

As the name suggests, a cookie banner is simply an alert about the use of this type of data by your website. Through it, visitors become aware that the page uses these files, which are essential for its operation and to enhance the user experience.

However, it's not just that. With the enactment of LGPD in 2020, data subjects gained the power to authorize or refuse the use of these tools during their browsing. In other words, they can accept or reject cookies at any time.

Therefore, the cookie banner informs visitors about their website's use of cookies and, at the same time, requests the user's authorization to use them. The user has the power to choose which types of cookies to allow.

Thus, all the management of these variables is contained in a platform called CMP - Consent Management Platform.

[To learn more about what a CMP is, we've prepared this article for you.](https://goadopt.io/blog/en/how-to-choose-cmp-consent-management-platform/)

**## Some Tips for Configuring the Cookie Banner**

According to the [LGPD text, consent is defined as a free, informed, and unequivocal expression by which the data subject agrees to the processing of their personal data for a specific purpose.](https://presrepublica.jusbrasil.com.br/legislacao/612902269/lei-13709-18#art-5) Here are some points to consider when setting up consent collection for your e-commerce:

- **FREE**: Collecting consent in exchange for some benefit is prohibited. This can constitute what's called "consent bias." Visitors cannot be forced or coerced into accepting.

- **INFORMED**: Citizens must be informed about the details of consent. Only with free access to this information can consent be "celebrated" between the parties.

- **UNEQUIVOCAL**: Consent must be provided in writing or by another means that demonstrates the data subject's will, which can be evidenced by a record, date, and time.

- **SPECIFIC PURPOSE**: Consent must be given for a specific and not a generic or general use.

Only with the four points listed above can various interpretations be drawn for the consent collection flow. In [this article](https://goadopt.io/blog/en/how-to-choose-cmp-consent-management-platform/), we've provided a specific analysis of each of the flow, design, and legal arguments to help you choose your cookie banner.

## The Most Overlooked and Feared Configuration in the Market

The most complex and overlooked configuration in the market is the blocking of third-party cookies, releasing them only after consent. In other words, tags like Google Analytics, Conversion Pixel, Remarketing, etc., can only be fired after visitor consent, with the exception of essential tags, of course.

This is one of the most important points that ensure the rights and privacy of data subjects, which many companies struggle to understand, adopt, and implement. After all, this would completely impact the site's performance, conversion KPIs, and numerous tracking metrics.

However, it's worth noting that this configuration is also one of the first things auditors and authorities look at when assessing whether a website is compliant or not. Firing cookies before consent leaves a poor impression and is certainly a red flag for audits and authorities.

Unfortunately, many SEO, performance, and analytics tools do not prioritize privacy. Google itself favors sites that use its services and share data with it. So, the entire market will have to adapt. An interesting alternative for those looking for privacy-respecting analytics services is [Fathom](https://usefathom.com/).

## How Does a Cookie Banner Impact Your E-commerce?

Delving a bit deeper into the direct and indirect impacts of the cookie banner on e-commerce, we've listed some of the main influences below.

**1. Bounce Rate: Be Cautious About Size and Design Harmony**
Any popup, banner, or notice that appears on the screen tends to prompt an immediate reaction, often rejection (especially on mobile). To prevent this, it's important for the Cookie Banner to have a minimalist design that harmonizes with your site's style. Otherwise, the chances of rejection or a bounce increase significantly. Look for opportunities to customize colors, formats, fonts, text, and images to make the banner's communication as unobtrusive as possible.

**2. Cookie Blocking and Metric Impact: Balloon Banners Are More Accepted Than Bottom Bars**
As explained in the previous item, once third-party cookie blocking is implemented, the metrics associated with this firing are directly impacted. From our experience, we've observed that about 25% of site visitors give consent. Sites that use balloon-style cookie banner have an 80% higher acceptance rate than the bottom bar format.

**3. Data Subject Requests Create a New Workflow/Process in Your Company**
One of the obligations brought by privacy laws ([LGPD, GDPR, CCPA, PIPEDA](https://goadopt.io), etc.) is the free access of citizens to their data and direct queries to companies. In other words, a citizen can at any time inquire if your company holds any data related to them and request more information, portability, or even deletion of it.

That's why, at AdOpt, we place such importance on data subject request workflows. Each AdOpt banner also generates an Opt-out page where people can make their requests at any time. This generates an email sent to the [Data Protection Officer](https://goadopt.io/blog/en/responsibilities-of-a-data-protection-officer/) (DPO) of the company, which, by law, must be responded to within 15 days.

So, your company needs a structured process to ensure that requests and their responses are fully met within the deadline. Someone must be trained and responsible for this workflow.

Would you like more tips on how to organize your operations to better handle these requests? I've selected two articles for you:

- Learn more about the [ROPA document of LGPD](https://goadopt.io/blog/en/ropa-for-lgpd//).
- [Data Mapping or Data Inventory, the DPO's Lifesaver](https://goadopt.io/blog/en/data-mapping-or-data-inventory-lgpd/).

**4. Tag Changes, Tool Testing Will Have a Larger Workflow**
Some companies tend to test many tools and technologies on their websites, which is not a problem in itself. However, since many of these tools fire cookies, it's essential that the entire communication flow, now established by LGPD, be reviewed and, if necessary, updated with the introduction of a new technology that fires cookies or collects data.

Especially if your official documents, such as the Privacy Policy and, possibly, the Terms of Use, have already listed the cookies you use, their purposes, deadlines, etc.

Therefore, if there is any change in the listing of official documents, it is important that communication is also completely revised and updated. It's worth noting that whenever a new privacy policy or cookie policy is updated, all consents collected up to that point should be updated/replaced. This is because consent is an agreement between the company and the citizen, the terms of which are precisely in the policy. Therefore, if the policy changes, the agreement of the parties must also be collected.

- [Learn more about how to notify users about term updates.](https://goadopt.io/blog/en/notification-to-users-terms-of-use/)
- [Important Tips on the Ideal Privacy Policy for Companies.](https://goadopt.io/blog/en/is-there-an-ideal-privacy-policy/)

## Is a Cookie Banner the Same as a CMP?

No, a CMP (Consent Management Platform) is a tool where a cookie notice or banner is just one integrated feature among many.

This differentiation is important because some people think that a cookie banner is just a pop-up with a button for the website. However, the technology involved goes far beyond that.

The banner can identify whether the visitor is accessing for the first time or not. By collecting the visitor's consent, it triggers this record to the database and to other tools that also await consent to react to access. All of this happens in milliseconds.

This is just one of several functionalities. Others include:

- Blocking third-party cookies.
- Hiding after acceptance.
- Recognizing the browser's language so that the banner is translated into the visitor's preferred language.
- Recognizing the visitor's IP country to ensure compliance with the visitor's country's legislation.
- Redirecting to the Opt-out/rights of data subjects page.
- Alerting the DPO when a request is made, consolidating visitor information.
- Integration with systems via API, callbacks to feed other databases.
- And more...

- Want to know more about a [CMP and how to choose one for your company? This link can help.](https://goadopt.io/blog/como-escolher-cmp-plataforma-gestao-consentimentos/)

## Why Have a Cookie Banner?

In summary, based on what we've seen so far, this is important for two main reasons. First, because LGPD requires it. According to the law, all use of data from data subjects must have their knowledge and consent. If you can manage this information offline or in some specific way, great! If you need to scale and automate workflows, the cookie banner (CMP) is essential for you.

But it's not just that. The cookie banner is also important to demonstrate to your audience how you care about both their experience on your site and the transparency in the relationship between the page and them.

Therefore, it improves the reliability of the relationship and shows the site's responsibility to its audience, as well as its pursuit of the best possible experience without compromising privacy.

So, it's extremely important to have a good cookie banner. It should be intuitive, grab the audience's attention, and integrate naturally with your website. Below, you can see how to get a good information banner and consent management.

## How to Get a Good Cookie Banner that Helps with Data and Consent Management?

For this, you can rely on AdOpt! Our cookie platform not only includes the banner but also a management tool, i.e., a CMP.

The platform is adaptable to your website's design, seamlessly integrating with it. Thus, when the site opens, it's available and provides information about the cookies used, as well as offering personalized configuration options for which ones the data subject will authorize.

Similarly, AdOpt includes essential documents for LGPD compliance on the page: Terms of Use and Privacy Policy. Therefore, all this data is organized in one place.

To top it off, AdOpt combines all of this with a real-time update and tracking tool for all entries, exits, and changes in consent. By doing so, it ensures that data will only be used in accordance with the data subject's wishes.

So, don't hesitate to rely on AdOpt and check out our plans. You'll see how complying with LGPD is much easier and more beneficial than it seems!






The Impact of Cookie Banners on Your E-commerce - LGPD

With the approval of the GDPR - General Data Protection Regulation, implemented in May 2018 in the European Union, companies and organizations have started to pay full attention to consent, data processing, usage, and storage.

However, many companies make the mistake of focusing only on consent as a compliance strategy. Why would that be a mistake?

Because consent should be given throughout and for the entire data processing process, and it can be reviewed and revoked at any time. In addition, other [Legal Bases of LGPD](https://goadopt.io/blog/en/legal-bases-of-lgpd/), for example, require different conditions for data usage, including consent.

This work must be done carefully and in detail to actually be able to process a person's data. Now, can you imagine how to manage the data and consents of millions of customers? That's what a CMP is for.

## What is a CMP?

**CMP** stands for "Consent Management Platform."

A CMP is a tool/platform used to manage the consent of up to millions of users so that a company can use the data of these users for its previously stated purposes. Or, as required by [LGPD](https://goadopt.io/blog/en/lgpd-general-data-protection-law/), "for specific purposes."

This includes knowing what each user has consented to and giving them the opportunity to review their consents, which can be revised and even revoked, as allowed by the law.

In practice, the consent management platform works as an intermediary between the visitor and the website owner.

But, before understanding the purpose and usefulness of a CMP, we need to understand the importance of consent in the context of LGPD.

## Why ask for consent?

According to the [General Data Protection Law](https://goadopt.io/blog/en/lgpd-general-data-protection-law/), consent is the "free, informed, and unequivocal expression by which the data subject agrees to the processing of their personal data for a specific purpose." In other words, consent is permission given by the user for you to use their data.

What are the rules and guidelines for this consent? This is precisely what documents like the [Privacy Policy](https://goadopt.io/blog/en/is-there-an-ideal-privacy-policy/) and, in some cases, even the Terms of Use are for, as they materialize how the company intends to use the data.

That's why whenever there is a change in the Privacy Policy or Terms of Use, consents must be collected again!

Any data used without the user's consent (referred to by the law as the "data subject") would be infringing the regulation. The fines for such misuse and violation of privacy are high, and you can read more about them in this other article: [Learn more about fines under LGPD](https://goadopt.io/blog/en/fines-in-lgpd/).

The CMP's function, therefore, is to manage consents by recording in writing:

- What user X consented to?
- What user X no longer wants to consent to?
- Which consents did user X revoke and how does it affect you?
- When did these events occur?
- What is the order of events for a clear understanding of user X's interactions?
- Integrating user X's choices with other tools that need this information for data processing.
- Recognizing the visitor's access country and displaying the banner in the visitor's language and legislation.

This way, you won't run any risk of processing data in a way that is not authorized by law, ensuring the ethics of your work and the privacy of your customers.

But you might wonder: Can't I do this differently, saving money? Is a CMP only for this?

Well, that's what we're going to find out.

## Do I need a CMP?

To answer this question directly: no, you don't need one.

In simple terms, the CMP's function is to show the user, with a pop-up or banner, the consent options and prove that the user has actually accepted the processing of their data, as well as remove and update previously consented data.

However, doing this manually is impractical, especially considering hundreds of thousands (or millions) of visitors to your site. The CMP allows you to have all this recorded and even update the Privacy Policy and Terms of Use to keep the user informed.

And why is it important to document consent automatically?

Suppose several users whose data is being processed say, "We do not authorize the use of our data." How can you prove that consent was given among a queue of a thousand, two thousand, a million requests?

With a CMP.

Remember: the important thing is to comply with LGPD and not harm your business. After all, before the fines, this process is time-consuming, and instead of focusing on consent management, you could focus on making sales and selling your product!

The means used to comply with the law in practice are chosen by you. The CMP is here to help you.

## How does a CMP work in practice?

For the user, in practice, the CMP displays a banner that the website uses cookies and collects data and information from its users. The banner, usually in a pop-up, explains the purpose for which the site processes the data. Along with the banner, there are options: the user can accept all forms of processing, accept only some, or accept none.

The consent management platform is also responsible for integrating your Privacy Policy and Terms of Use. Furthermore, as required by LGPD, tags must be organized for specific purposes. A CMP like [AdOpt](https://goadopt.io/) allows this to be done simply in a customizable interface.

In this [article here, we delve into the step-by-step of a cookie banner!](https://goadopt.io/blog/en/operation-of-cookie-banner/)

## What is important for the DPO?

The Data Protection Officer (DPO) is the professional responsible for overseeing data preservation and compliance with the law.

Since the DPO is the link between the company and the ANPD (National Data Protection Authority), it is essential that they educate the company and teams.

The main task of the DPO is to accept requests, complaints, and communications from data subjects, taking steps to ensure their wishes are respected and met. The workload is significant. The CMP, in turn, ensures that data will be well managed and consent will be documented and easily accessible.

In this way, the CMP streamlines the work of the Data Protection Officer. They won't be overwhelmed, and the company won't need to increase the team to handle the task, which would significantly increase operating costs.

LGPD has already required all websites to update their way of working. It is normal for many questions to arise and initially seem difficult. But remember that we are here to answer your questions.

And if you want to know more about how a CMP can specifically help your site, click on this [link](http://goadopt.io/) and get in touch.


What is a CMP (Consent Management Platform)?

More than 30,000 people use [AdOpt's cookie notice](https://goadopt.io) daily to comply with various privacy regulations around the world.

In our "**Big Dream**," all goals and aspirations point toward a global operation.

Today, we can confidently say that AdOpt is getting closer to this goal every day!

#### Assisting small businesses worldwide in respecting the privacy of internet users.

The [Cookie Plugin for WordPress](https://wordpress.org/plugins/adopt/#description) is a crucial element in our global expansion strategy!

## One of the largest website-building platforms in the world!

The WordPress platform powers nearly 450 million websites globally, and it's estimated that 50% of Brazilian websites are on this platform. In other words, there are many people using and contributing to the community daily!

But getting here wasn't easy!

The initial sketches of the plugin began in 2020. At that time, AdOpt was virtually unknown, and very few believed that [LGPD](https://goadopt.io/blog/en/lgpd-general-data-protection-law/) would actually come into effect. So, as we always prioritize transparency, agility, and quality, our plugin, on one of the world's largest platforms, couldn't be "just another one."

Therefore, we outlined some key objectives that would lead us to develop our Cookie Plugin for WordPress with excellence!

- **Implement Version 2 of the Platform, more robust and scalable** - Released in Dec/2021

- **Allow AdOpt users to comply with multiple regulations and languages!** - Released in Apr/2021

- **Provide more autonomy and flexibility for our customers to customize 100% of the Cookie Notice text as needed** - Released in Apr/2021

We have listed the above points as the pillars of our minimum requirements to offer a good plugin worthy of the WordPress community. We believe that in doing so, we reinforce our value of providing "[compliance with LGPD, GDPR, and CCPA... even with the free plan](https://goadopt.io)"!

At AdOpt, we are obsessed with a platform that is always easier and more intuitive for users.

So, know that many more exciting features are yet to come!

We are working tirelessly to expand our integrations and partnerships so that anyone, even without any coding or programming experience, can confidently ensure their websites comply with all the world's privacy laws with just a few clicks.

## Want to install the [Cookie Plugin for WordPress](https://wordpress.org/plugins/adopt/#description) from AdOpt on your website?

Below is a tutorial to help you!

1. Install the [Cookie Plugin for WordPress](https://wordpress.org/plugins/adopt/#description).

2. Simply copy the ID of your Cookie Notice from AdOpt.
![Fast tutorial WP 1.png](https://strapi.goadopt.io/uploads/Fast_tutorial_WP_1_4184f033e9.png)

3. Activate the Plugin and paste the Notice ID.
![Fast tutorial WP 2.png](https://strapi.goadopt.io/uploads/Fast_tutorial_WP_2_e1742f229f.png)

4. Save.

5. That's it! The plugin will automatically install AdOpt's tag on your site.
**No coding, no complications.**

#### If you have any questions, here's a [**more detailed tutorial**](https://goadopt.io/en/support/integrations/wordpress/adopt-cookie-banner-wordpress/) for your reference, okay?


We've created a cookie banner plugin.


Choosing a [CMP (Consent Management Platform)](https://goadopt.io/blog/en/what-is-a-cmp/) is a great way to make efforts to adapt to new privacy regulations like [GDPR, [LGPD](https://goadopt.io/blog/en/lgpd-general-data-protection-law/) (Brazilian General Data Protection Law), and CCPA](http://goadopt.io/). This, which is one of the main tools for compliance, can be the solution to avoid the dreaded fines that regulations foresee.

But, for it to really fulfill the promise, the CMP must meet certain requirements, as well as quality in services. So, how do you choose the best option?

You'll find the answer below. We've brought everything you should look for when getting a consent management tool.

Oh, a spoiler: at the end, we'll tell you which one is the best.

## How to Choose a CMP? Look for Key Points.

CMP stands for Consent Management Platform, in plain English. It's a tool that aims to assist in managing the collection of consents and their use in accordance with the user's authorization.

That's why it becomes even more important in times of LGPD! In addition to helping comply with the law, it's also important for building the website's image, showing how it cares about user privacy.

This platform is capable of managing all the authorizations a visitor gives to a website during their visit. With this, it becomes the database for guiding the brand's actions based on that information. Below, see how to choose one successfully.

## Look for a CMP That Provides Rich Information.

First and foremost, it's important that the platform you choose provides rich information. The CMP is not just a cookie banner but a data usage and consent management tool.

Therefore, it's important that it includes other information related to data.

So, the best CMP is the one that provides complete information that includes access to the Terms of Use, [Privacy Policy](https://goadopt.io/blog/existe-politica-de-privacidade-ideal/), and a detailed [Cookie breakdown](https://goadopt.io/blog/cookies-e-lgpd/) with the option to customize them. That is, to choose which permissions the user wants freely.

### [Learn more about best practices in Tag Classification for GDPR, LGPD, CCPA, POPIA...](https://goadopt.io/blog/en/best-practices-in-tag-categorization/)

## Prefer a CMP That Allows Customization of Consents One by One.

It's not enough to have a cookie banner where the user can give permission for their use. It's also necessary that they can customize which ones they accept to be used by the website and which ones they don't.

In this way, avoid platforms that only offer an "all or nothing" consent option.

## Think Beyond Your Country.

Have you investigated how many people access your website from other countries?

Did you know that this will make all the difference when choosing a CMP?

The fact is, when someone accesses a website from another country, the legislation of the visiting country may override that of the website owner's country. In other words, LGPD may be overridden by GDPR if someone accesses a Brazilian website from Europe, for example.

How is that possible? It all depends on the aspect analyzed and which legislation is more "pro-privacy" or "pro-citizen." Thus, a great feature brought by CMPs is the automatic detection of access origin. That is, if someone accesses your website from another country, the collected consent will be 100% adjusted to the visitor's legislation, avoiding any conflicts and increasing your security.

If you're not familiar with the concept of [Privacy by Design](https://goadopt.io/blog/en/what-is-privacy-by-design/), this can help you understand these aspects.

## Know What Type of Data Security the Platform Provides.

The CMP you choose will have access to user data because, in addition to managing consent, it also helps manage the data collected regarding the types of consents they received.

Therefore, it's crucial to know what tools and security strategies this platform uses. In other words, how it ensures data security against leaks.

Ideally, the platform should use data encryption, as well as other types of data security protocols and tools that are essential when it comes to data processing.

## Customize Visual Preferences of the Banner

The design of your website matters a lot. Therefore, when choosing a CMP platform with a [cookie banner](https://goadopt.io/blog/por-que-do-aviso-de-cookies/), it's important that there is an option to customize it. That is, to match it with your site's design. So, prefer platforms that offer this possibility.

Naturally, the CMP reflects the company's perspective toward visitors. But what's the visitors' perspective toward the company? When we put ourselves in the shoes of a visitor accessing the site, the design's simplicity and lightness speak volumes!

## Get to Know the Platform's Reputation in the Market.

Also, be sure to know the platform's reputation that caught your attention. Analyze the types of websites that use it, for example. Similarly, don't forget to do some research on potential data leaks, for example.

Or, on issues with data security or even platform usability. All of this is important, especially because the CMP becomes an essential figure in complying with [LGPD, GDPR, CCPA, POPIA...](http://goadopt.io), the list goes on.

Through it, you can obtain consents and manage them in a way that data will always be used correctly. That is, within the limits of consent given by the data subject.

Is the CMP you're researching known for good customer service? What will happen if you need to talk to them and ask questions? Or if some authority questions the consents collected, will they be on your side?

## So, What's the Best CMP Platform?

Now that you know what's relevant when looking for a tool for LGPD, it's time to find out where to find all that support and structure.

The best solution when it comes to a consent management platform is AdOpt! Our tool can manage all the interactions a user has with the site regarding the authorizations they grant.

Furthermore, it features a simple and intuitive cookie banner that's easy to use. In it, you can not only find information about cookie usage but also customize the consents given to the page, as required by the law.

At AdOpt, the [cookie banner](https://goadopt.io/blog/en/why-the-cookie-banner/) is adjusted according to the visitor's country, ensuring that the smallest details comply with your site globally.

Likewise, you'll find links to the Privacy Policy and Terms of Use, with the possibility to consent to all of this in one place. That is: complete information to the user, organization, and ease of operation.

Additionally, the platform uses cutting-edge technology. With the use of encrypted data, we ensure the security of the information collected. That is, its confidentiality and protection against leaks.

Finally, AdOpt's reputation as a tool for LGPD, GDPR, and CCPA is unquestionable. After all, we're present on highly relevant websites like **Exame**, **Metrópoles**, **Baixaki**, **GoPro**, **TecMundo**, and others.

So, don't hesitate to rely on AdOpt when hiring a consent management tool for your visitors and customers. With this, you have all the information organized and secure for data usage in accordance with LGPD.

Want to know more about [how a cookie banner works](https://goadopt.io/blog/en/operation-of-cookie-banner/)?

I've prepared this article for you!

How to Choose a CMP (Consent Management Platform)?

Have you ever thought that your marketing agency could find a great business opportunity in LGPD, GDPR, CCPA...?

Well, unlike what many think, it brings changes that can accelerate the demand for the services of these companies.

After all, the new privacy regulations like the GDPR, CCPA, and the LGPD ([General Data Protection Law (LGPD)](https://goadopt.io/blog/en/lgpd-general-data-protection-law/)) - as it shouldn't be news to anyone - has brought significant changes to how companies handle third-party data. This applies to data processed on the internet or not.

And marketing is one of the areas directly affected by the new rules because its digital operations depend on third-party data, which is precisely the focus of the LGPD, for example. 

So, how about learning more about how to leverage this new law to create opportunities in the field of marketing?

To do that, keep reading and see everything about the subject below!
(I'll keep using the LGPDas an example, but, the same logic applies to any privacy regulation.)

## LGPD Doesn't Mean the End of Digital Marketing, Quite the Opposite

Like other novelties, the [emergence of LGPD](https://goadopt.io/blog/en/lgpd-general-data-protection-law/) has also brought many rumors, created legends, and generated a lot of apprehension! After all, it changes how data was previously treated and introduces new obligations.

[LGPD](https://goadopt.io/blog/en/lgpd-meaning/) aims especially at transparency regarding data usage, as well as using data in accordance with the consent of the data subject and within the limits of this authorization.

For this reason, many believed that it would bring an end to the golden age of digital marketing. After all, it requires user information, which, in turn, requires their consent.

Considering the various accesses and actions that occur on web pages, as well as the numerous impressions and reach that marketing aims for, this seemed impossible.

However, it's not.

It's possible to organize digital marketing in accordance with the General Data Protection Law in a way that it continues to generate leads and attract customers and interested parties. Below, I've included an article to help you on this journey:

[### TIP: 10 marketing processes you should reconsider due to LGPD.](https://goadopt.io/blog/en/10-risky-processes-in-your-marketing/)

## Significant Changes for Marketing Have Emerged with LGPD

Marketing hasn't died, but that doesn't mean it doesn't require updates in its tools and how it operates.

For example, consent will always be present in the collection of any data that the user provides, either directly or indirectly. It is only with consent that a company can use the information for any purpose, including marketing.

Certainly, other [legal bases of LGPD](https://goadopt.io/blog/en/legal-bases-of-lgpd/) serve as the foundation for data permission and usage. But, in any case, consent ends up being a part of all of them since at some point in the data flow, the individual consented to providing that product/service.

Similarly, the use of this data must always be clear, whether the user voluntarily provides their information (such as in form submissions) or if it's collected automatically through cookies and other tools.

In this sense, it's important to keep in mind that marketing only succeeds when it has data to guide its actions, including now the confirmation that proves the data was collected regularly.
Therefore, this data can only be collected and used after the user is notified of it and grants their consent, or through another legal basis.

To obtain consent, numerous tools are available, as we'll see next.

[### Learn more about adapting digital marketing to the General Data Protection Law.](https://goadopt.io/blog/en/how-to-adapt-digital-marketing-to-lgpd/)

## Outsourcing Marketing Becomes an Interesting Option, Provided Agencies Know How to Handle It

So, you might be wondering: Ok, LGPD brought changes regarding marketing. But where do agencies fit into this?

Many companies choose to conduct marketing activities themselves or even outsource a large portion of them. In any case, the service needs to be done and now fully compliant with LGPD. That is, whether they are internal actions or third-party actions conducted by specialists, all must adjust.

This leads to a series of new demands, routines, and daily processes that someone will have to be responsible for.

### Can some of the new demands created by LGPD become part of the agency's service portfolio?

We already know that simply ignoring them can lead to [fines and sanctions under LGPD](https://goadopt.io/blog/en/fines-in-lgpd/) which can require significant amounts of money and even lead to the suspension of the website or database.

Furthermore, there's another very important aspect for marketing agencies regarding LGPD. After all, as of LGPD, captured data will only be what's consented, which provides a rich ground for campaigns.

In other words, the law requires data to be collected with the user's authorization, which they provide voluntarily.

This means that marketing now has data that genuinely directs it toward those who are already interested in the company's services or products and are engaged!

Therefore, LGPD is an opportunity for marketing agencies in that they can present themselves as experts in adapting product promotion and customer acquisition strategies to comply with the law!

## Develop a Marketing Policy Based on LGPD
Agencies have various ways to adapt marketing strategies. For example, here are some of the tools that need to be reviewed:

- Marketing emails;
- Sponsored ads;
- Forms;
- Landing pages, and more.

Note that all these tools collect user data, whether through the use of cookies or by requesting contact information (among others) to access information, promotions, and products.

Therefore, all of them should follow the development of a policy that makes it clear to the user that this data will be used, as well as the limits of data usage.

A good [LGPD tool](http://goadopt.io/) is the [cookie banner](https://goadopt.io/blog/banner-de-cookies/) that asks for a "check" before data is sent and consent is granted, among other things.

[Learn more about how a cookie banner works!](https://goadopt.io/blog/en/operation-of-cookie-banner/)

## Other LGPD Adaptations Beyond Digital Marketing

Furthermore, it's important to consider the website itself, where advertising pages can drive user traffic.

In this case, it's interesting for the website to be equipped with a tool that presents all the company's policies regarding data usage in one place.

That is, the Terms of Use, Privacy Policy, and also the Cookie Policy. In this case, all of them provide information about data usage and related information.

[Learn everything about the Privacy Policy, how it works, and its requirements!](https://goadopt.io/blog/en/what-is-privacy-policy/)

For this, count on AdOpt! Our tool works by granting a tab as a pop-up that opens on your website every time someone accesses it.

There, it's possible to access the website rules, data usage policies (in their various forms), and consent collection.

[Learn more about the Cookie banner, its advantages, and how to use it.](https://goadopt.io/blog/en/operation-of-cookie-banner/)

LGPD: An Opportunity for Digital Marketing Agencies!

How does your website handle LGPD, CCPA, GDPR...?

What strategies does it use to comply with the LGPD [_General Data Protection Law_](https://goadopt.io/blog/en/lgpd-general-data-protection-law/)? Have you thought about using a [cookie banner](https://goadopt.io/blog/en/why-the-cookie-banner/) but don't know if your site has [cookies](https://goadopt.io/en/blog/lgpd-cookies-all-you-need-to-know/) or if it's enough? If you can't answer these questions, be cautious! Your page may be exposed to fines and other sanctions.

Below, check out 5 signs that indicate your strategies either don't exist or aren't working as they should. So keep reading to ensure the necessary compliance of your site with the principles of the law that regulates data consent.

## 5 Signs You Need an LGPD Consent Strategy Right Now

Check out the top 5 signs that your website isn't in compliance with LGPD and then see how to start your adjustment!

## 1 - You Have No Control Over the Data You Collect and Use
This is an undeniable sign that you need to reconsider how you view LGPD. After all, it regulates the use of third-party data.

It requires respect for user privacy and their consent. Therefore, data usage should always be informed. Not only that, but also the purposes to which it is directed, the way it is stored, and the period of use.

So, consider that if you don't know what data you collect, how will you inform the visitor? Furthermore, how will you ensure that the use of this information complies with the limits imposed by the data subject?

These are important questions that indicate that something is not right on your website regarding LGPD and its requirements.

LPs created without control, rich content available for download without accepting terms and policies, mailing lists being shared and passed from campaign to campaign... Be cautious!

I've separated this article for you, in case this is your situation:

[Understand the meaning of LGPD for your company.](https://goadopt.io/blog/en/lgpd-meaning/)

## 2 - There's No Information About the Use of Cookies

Cookies are another type of data that, in principle, should be informed by websites to their visitors. After all, they also capture information about these data subjects and, therefore, fall within the concept of data usage that LGPD addresses.

The use of cookies is almost natural for most websites, especially if they come from e-commerce platforms, for example.

_### To check if your site triggers cookies, access it from a computer and - in Google Chrome, click on the padlock just to the left of the address. It should show exactly which ones and how many there are._

However, many pages fail to see cookies for what they really are: data files and personal information. Therefore, the absence of this communication to your site's visitors is dangerous as it can be a violation of the law.

In fact, not just that, but the collection of them without prior consent is also a violation. You know that "We use Cookies" pop-up? Well, it's not there for no reason.

It's a way to comply with LGPD as it informs the use of this type of file while capturing authorization to use them.

- In this article, I help you understand more about [consent as a Legal Basis of LGPD.](https://goadopt.io/blog/en/legal-bases-of-lgpd/)
- In this one, [how to choose an appropriate CMP - Consent Management Platform for your website.](https://goadopt.io/blog/en/how-to-choose-cmp-consent-management-platform/)

## 3 - Generic Privacy Policy and Terms of Use

Your site probably has documents such as Privacy Policy and Terms of Use. They inform, respectively, the use of visitor data (and capture authorization for it) and the prevailing rules, rights, and duties.

Therefore, they are very important, especially in the time of LGPD! They stand out for their informative content to promote transparency with the data subject.

It is up to the data subject, then, to accept or not the conditions therein. In this sense, it is worth noting that the site may suspend access to some services, for example, due to a lack of acceptance of the rules and conditions. And that is natural since some of them are only possible with the authorization to use certain data.

Either way, these are important documents. But they shouldn't just be there. They should be specific to what the site offers and how it operates. So if you made your terms and policies based on Ctrl C + Ctrl V, pay attention!

It's time to review these documents and rewrite them to make them compatible with the reality of the site. Also, to fill gaps and clarify data usage. Below, I've separated a few more articles for you:

- [What is a Privacy Policy?](https://goadopt.io/blog/en/what-is-privacy-policy/)
- [What's the Ideal Privacy Policy for Your Company?](https://goadopt.io/blog/en/is-there-an-ideal-privacy-policy/)
- [What are Terms of Use in LGPD?](https://goadopt.io/blog/en/terms-of-use-lgpd/)

## 4 - Data Loss or Data Breach

When it comes to data loss, it's time to sound the alarm. Data breaches are a clear sign that your LGPD strategy needs urgent correction or revision.

After all, it should be developed to maintain the confidentiality of data and their use in accordance with the data subject's consent or the [legal basis](https://goadopt.io/blog/en/legal-bases-of-lgpd/) chosen. Also, to ensure the protection of this information.

Data breaches are compromising! They can tarnish the company's reputation and often that of its customers and suppliers as well. Furthermore, the company can be held responsible for them and, as a result, face significant sanctions, including hefty fines.

[**Understand the difference between Data Controller and Data Processor in LGPD here.**](https://goadopt.io/blog/en/differences-operator-controller-of-data-lgpd/)

And it's not just data loss itself. The lack of a clear plan of action in the event of information leaks is also an indication that you urgently need to work on your LGPD strategies. Below are some more articles to help you with this review:

- [Data Mapping or Inventory in LGPD, the DPO's life jacket.](https://goadopt.io/blog/en/data-mapping-or-data-inventory-lgpd/)
- [How to Adapt Your Marketing to LGPD](https://goadopt.io/blog/en/how-to-adapt-digital-marketing-to-lgpd/)
- [10 Risky Processes in Your Marketing](https://goadopt.io/blog/en/10-risky-processes-in-your-marketing/)

## 5 - Absence of Designation of a Data Protection Officer

Finally, the last sign that your website needs an LGPD strategy is the absence of the designation of a Data Protection Officer or DPO (Data Protection Officer) for the processing of data on your site.

This figure is a requirement of LGPD and, according to the law, is responsible for controlling and managing data processing. They carry out tasks determined by the Data Controller.

They are also the ones who handle complaints from personal data subjects, provide explanations, and communicate with them. Similarly, they control the entry and exit of consents, so they take the necessary actions to ensure compliance with authorizations. In this article, I explain more about [the responsibilities of a Data Protection Officer or DPO in LGPD.](https://goadopt.io/blog/en/responsibilities-of-a-data-protection-officer/)

## So, how about adapting your site to LGPD?

If you have recognized that your site falls into any of the signs above, it's a sign that you should take action to align it with the law. Otherwise, you may face [fines](https://goadopt.io/blog/en/fines-in-lgpd/) and other penalties that could even lead to the suspension of your page's activities.

Not to mention the impact on your brand's image in the eyes of the public, as someone who could care more about data privacy.

So, it's more than time to review your privacy strategies in the face of LGPD. For this, count on [AdOpt](https://goadopt.io/), which helps you not only organize them but also control the entry and use of data, as well as consents about them.