You've probably already come across numerous predictions of fines and sanctions that LGPD brought along, right?

Now that we have the so-called "new" [General Data Protection Law, LGPD](https://goadopt.io/blog/en/lgpd-general-data-protection-law/), what's next?

Hold on!

Before adopting an alarmist or even pessimistic perspective on the law, it's essential to make it clear that the use of personal data (read: processing and treatment) is not prohibited by the law, but merely regulated by it. As a result, you, as an entrepreneur or an expert in your field, can and should continue your work and strategies as a whole. However, you now need to understand how to adapt your business model to the regulations prescribed by the law for the use of such personal data.

So, what does the [LGPD](https://goadopt.io/blog/en/lgpd-general-data-protection-law/) mean for your company?

My goal here is to provide you, as succinctly and practically as possible, with a compilation of key information that will serve as a guide amidst the questions and forks you'll encounter on your path to understanding and, above all, compliance!

## Introduction

### Before We Begin, Who Is AdOpt to Help Me with This?

After several years at the forefront of work and studies on data, marketing, and internet privacy, a confession is in order. We've genuinely seen it all. We've been in this market since the birth of predictive analysis concepts, and all the AdTechs that have emerged since then. We witnessed the rise and fall of Cambridge Analytica and its scandals and leaks, numerous analyses and documentaries, Wikileaks, Snowden, and so on.

Naturally, we followed the entire market with the emergence of GDPR, CCPA, and their derivatives worldwide, which now, here in Brazil, culminate in LGPD. For almost 8 years, we've been working daily on several of the pillars that the "Data-Driven Marketing" market is so familiar with today. - Building data models for performance metrics analysis,

\- Sequential databases, non-relational databases, physical, cloud, and so many others that have passed through our hands.

\- Numerous tracking tag characteristics, fingerprints, SDKs, etc. - Endless technology updates, privacy issues, rumors, and browsers with their third-party cookie blocking. - Various integrations with Ad servers, CRMs, email tools, DSPs, Cookie Syncs with DMPs, Data Providers, Credit Bureaus, etc. - Firewalls, Backdoors, Security Routines, DNS, etc.

In short, more than 200 million unique users mapped in our systems, and 40 thousand websites have passed through our network since 2015, when we created our first Tag and Cookie version.

All of this is to tell you that all this knowledge we've accumulated until today gives us one certainty. It's worthless to know all of this if:

1 – We don't promptly execute best work and security practices, 
2 – We can't translate international theories into our local legislation and market realities. 
3 – We don't demystify the need for infinite, extremely elaborate resources to start good work. 
4 – If theory doesn't generate real benefits for clients and, consequently, sales for both sides.

Throughout 2019, we interviewed nearly 250 companies about LGPD and their perceptions of its impacts and challenges for compliance. Most of the difficulties listed at the time were: _the difficulty of understanding the law, a lack of skilled labor, difficulties with managing new technologies, and, not least, the administration and collection of consent from data subjects_.

Since then, we've had the same feeling: LGPD remains an enigma for most, and at the same time, we, who are a vital part of the market, have the opportunity to reinforce how seriously Privacy should be taken. Not just valued when lost but, in essence,** as an individual right of all citizens.**

Especially today, where it's impossible to ignore the elephant in the room, or rather, the increasing number of mobile phones and devices collecting text, audio, and video data in practically every household. Who hasn't felt like their phone is listening to them? Throw the first stone!

The fact is, all privacy regulations are here to stay! 

Yes, we're on an irreversible path when it comes to data usage by our favorite gadgets. Therefore, it's crucial that we understand the value of Privacy while theoretically, we still have control. But more importantly, we need access to technologies that work in our favor, not just collecting data but also giving us freedom in the face of the numerous data collection instances we encounter daily. 

Yes, before data collection, there's a choice made by a free citizen, which must be respected and informed clearly and transparently.

So, in the midst of all this data, services, endless questions, and technology tests, AdOpt was born.

These are years of study and practical applications aimed at minimizing the consequences that the marketing and advertising market has faced. Not just when GDPR came into effect in Europe and drastically reduced the revenue of major publishers but also due to the maturation of our local market - Brazilian, facing the numerous technologies we couldn't even test, thanks to our limited budgets.

AdOpt starts as a quick and practical way for all companies to communicate and collect consent from their visitors without risking destroying their metrics and engagement with yet another ugly notice that looks more like a Pay Wall, or shall we say - Cookie Wall?

In the entire roadmap of AdOpt and its evolution as a product, our goal is also to democratize access to information about the legislation and its applications so that we respect everyone's privacy! Again, the context in which AdOpt was born makes it impossible to ignore, given its immense importance in today's world.

#### From a commercial standpoint, we've come to the conclusion that the market lacks easily understandable positions, and above all, demystifying the interests of certain market segments concerning the new General Data Protection Law, LGPD. It's certain that lawyers, accountants, marketing agencies, IT professionals, and various other "experts" are eager to grab their share of the market. This is perfectly understandable because the law encompasses knowledge from various areas simultaneously. However, before any market advantage or class of workers, we at AdOpt believe that there are 2 principles that should always guide our interpretation of all this, in light of privacy; exalted by the numerous privacy laws worldwide.

## 1 – **A principle of freedom.**

Yes, freedom is of immeasurable value, and only those who lose it can truly describe the impact of its absence. Whether in access to information, the right to move freely, freedom of the press, or the simple right to be forgotten. We are the generation that created memes, but also "cancel culture," fierce criticism of Fake News, banning some social networks, and more. Guided by the premise of valuing truth, sometimes we forget to measure the real impact of some unilateral mechanisms that end up overshadowing the true value of freedom. 

LGPD, GDPR, CCPA, and many others are also mechanisms that help citizens maintain their freedom in the face of internet giants.

#### 2 – **Without content creators, we wouldn't have the internet.**

When this (the internet) "was all wild territory" and we had a handful of blogs and news portals, LGPD would never make sense. However, it was thanks to these internet anchors that the opportunity to monetize people's attention on certain pages was created! Without major publishers, we wouldn't have programmatic advertising and all the opportunities to automate the cash flow generated globally today, at the scale and proportion we experience.

#### Without programmatic advertising, we wouldn't have social media as we know them today. After all, as Mr. Zuckerberg would say.

"We Run Ads."

Perhaps this introduction has a touch of a "Manifesto" for you, as we emphasize the value of Privacy and Freedom, expressed in free access to information and, consequently, content production.

Here's another confession for you, dear reader. AdOpt today serves as a cookie notice, assisting as a [CMP](https://goadopt.io/blog/en/what-is-a-cmp/)._ But you have no idea what lies ahead when we connect all these points above and provide you with access to the technologies we're designing!

#### If data is the new oil, then Privacy will be the new currency!

The discussion isn't over yet, but I hope you've understood how passionate we are about this subject and want to guide you through it!

In our next chapter (article), I want to show you the foundation of understanding the law: [The Legal Bases of LGPD,](https://goadopt.io/blog/en/legal-bases-of-lgpd/) see you there!


Understand the meaning of the LGPD for your company

João Bruno Soares

## Want to understand why there are cookie banners on every website you visit today? This article is for you!

Cookie banners, cookie notices, GDPR notices or Privacy Notices… call them what you want. (We’ve even heard them called “that boring legal notice,” but more on that later.)

In fact, all the world’s largest and most serious companies have already added a cookie banner to their website, and this is for a good reason: GDPR, LGPD, CCPA and many others are live!

Completely inspired by the GDPR ,the LGPD in Brazil, as it’s commonly known, is a regulation that was created in 2018 specifically to address the way that personal data, such as a user’s name, e-mail, telephone number, address, etc.,  is collected and utilized by companies.

## The GDPR, LGPD…CCPA and cookie banners are here to stay!

Why does the GDPR require cookie banners? Does every website now need a banner?

The LGPD, as said, was inspired by the European Union’s General Data Protection Regulation (GDPR), and similar laws are already being enacted all over the world. Even North Korea now has its own privacy regulation! That is to say, this is not a passing trend and must be taken seriously. 

This shift does not necessarily mean more bureaucracy, but it does mean real empowerment. Thanks to these new privacy laws, ordinary citizens now have the right to authorize, deny, or even revoke companies’ ability to use their data!

## You mean I didn’t already have the right to decide what happens with my data?!

Don’t worry, we can explain! 

The answer is not that simple, as this law needs to function in parallel with innumerable others that also govern individual rights, including consumer, health, and internet law, among others. 
Keep going, it will be worth it! Soon you’ll be able to speak like an expert on this subject. 

With the advancement of advertising technologies that are linked to [digital marketing](https://br.sharpspring.com/marketing-digital/) and the exponential growth of social media, everyone now has a machine that generates and stores valuable data in the palm of their hands: cellphones. Every time an individual accesses a website, e-commerce account, Instagram, Facebook, or any similar platform, the visit generates data that is collected and stored by cookies. 

Cookies are simply text files that are capable of storing information generated by websites. 

## Want a practical example of cookie technology? 

I'm sure you know when you enter a website through your browser and it recognizes that you’ve already accessed the page before, allowing you to re-enter the site without signing in again? This happens because your browser has already stored a cookie from that site which can authorize your access. 

In the same way, cookies can also store data like which photos you’ve liked on Instagram or if you “forgot” a product in your shopping cart. All of this information is saved for later use.  

## And this is very valuable! 

Did you know that a person needs, on average, at least six interactions with a product or service before making the decision to purchase? 

It’s no wonder that when you “forget something in your shopping cart,” the product seems to follow you all over the internet with ads. Only then do you end up making the purchase. Is this a coincidence, or magic? 
Neither, these are the processes and technologies that utilize cookies for advertising.

If you’ve been through this, welcome! You’re in good company. 

Simply put, cookies are a piece of the wheel that moves the internet. It’s the use of data for advertising that allows us to consume the content that we love for free. After all, who do you think pays for that cool, free YouTube video? Advertisers! And now you know they use cookies to find you on your favorite channel. 

The use of cookies is not necessarily positive or negative, but it reached a point where individuals like you or I were not fully in control of what the internet giants were doing with our data. This is why privacy laws like the GDPR, LGPD and CCPA were created: to rebalance the relationship between companies and people.   

Ok, but weren’t you going to talk about data, privacy, and the rights I have? 

Yes! When the LGPD was enacted by Brazil in August of 2020 it forced companies to examine the way that they handled the plethora of consumer data generated by their business, and to make changes to their processes and databases. One of these changes was the obligation to inform visitors of the reason for their data collection, as well as the legal basis for it. 

Thus, in accordance with the LGPD, GDPR, CCPA and several others, every business must present a clear and objective communication that informs visitors of their purposes for collecting personal data. Whether on or offline, it is essential that every citizen is notified of the collection of their personal data as well as the many ways it might be used. 

As for us data “subjects,” as some law refers to us, we are now able to make a “free, informed, and unequivocal declaration,” as to whether or not we permit its use. That is to say, if we consent to the terms outlined by the business, we authorize them to use our data. In Brazil, for example if businesses violate this flow by collecting data without consent, they could face serious consequences including being fined up to 2% of their annual revenue, with a ceiling of 50 million real. Has your business ever considered the threat of being fined simply for not having a cookie banner on its website? 

Want to understand exactly how the GDPR, LGPD and CCPA impact your business? Here are some articles on the subject.

## But how do I know what they already do, or will now do with my data? Will the cookie banner tell me? 
Who among us has actually read the privacy policy or terms of use of a website we use? Not many, but it’s precisely in these official documents that these answers are found.

According to the Privacy Laws, businesses must comply with certain official documentation requirements and legal basis to inform users of their entire data collection process and its purposes. Well-known by lawyers, the “Privacy document kit” fulfills the standard that every company must meet, including a privacy policy, terms of use, data mapping, and contact information of the DPO, among others.

## Now the good news! 
These documents don’t need to be written in “legalese,” nor should they be, as LGPD, GDPR and CCPA requires that the information presented be “clear and accessible.” A user cannot consent to the collection of their data if they cannot understand the banner. 

What’s the use of a company acting cool in its marketing and communications, or speaking beautifully in advertisements, if when addressing privacy and transparency it starts speaking in code? It doesn’t make sense, right?

Anyway, this article aims to inform you that, along with the laws like GDPR, LGPD and CCPA, we also have new rights and duties, both as citizens and, especially, as companies. In this matter, the cookie banners actually serve a noble purpose! Businesses that use these banners correctly are able to show customers that they care about their individual rights, freedom of choice, and privacy. 

## A good cookie banner should meet certain minimal requirements outlined by the GDPR, LGPD and CCPA: 

Inform users clearly and objectively of all of the ways in which the company collects consumer data. 
Point to official documents such as the privacy policy, terms of use, etc. (referring back to the Privacy document kit mentioned above). 

List the options that you as the data owner have to fully or partially accept “the rules of the game” with that company, thus allowing you to receive their content or consume their products or services. 

Make it clear where, upon accepting the cookies, you could access the data that the company will gather about you, and how to opt-out if you change your mind. 

Allow users to consent to the data collection in a way that is free, informed, and unambiguous. 

**Last but not least:**

When you see the banner: “If you continue browsing, we understand that you consent…” know that the law has determined this to be insufficient, and there are several arguments why. Mainly, this banner without further detail does not give the visitor enough information to give their consent in a manner that is “free, informed, and unambiguous.”

We hope this article helped you to understand the “why” of the now popular cookie banners, which will soon be installed on all company websites. With this new regulation, there is no going back. 

## We’ll leave you with two final invitations: 

1. Do you know a business that needs to know more about cookie banners?

Again, any and all companies that collect personal data, such as name, email, or telephone number on their site, and use third-party services like the Facebook pixel, Google Analytics, etc. MUST include this banner.

We at AdOpt are experts in cookie banners and can help them today! And even better, for many it’s free! Send this article to whoever you know that could use this content. They will thank you when they avoid an unpleasant fine!

2. Want to dive deeper into the subject of cookie banners?
We’ve got more articles for you [here](https://goadopt.io/blog/significado-da-lgpd/) para você:).



Why are cookie banners everywhere?

Tired of the ads from that site you visited following you around?
Is your computer running slow when accessing a particular site?
Want to delete all cookies from a specific service or site?

One of the alternatives is to **delete Cookies and Cache from your browsers!**
We'll provide you with step-by-step instructions for each of these options. But before that, to make things clear:

##What is cache?

The term cache is basically the storage of frequently used data or processes, which are stored for faster future access, thus saving time and unnecessary use of hardware processing.

This functionality is widely used in various types of devices and software, such as browsers, for example. You know when you first access a website and it takes longer to load than your favorite site that you visit every day?

That's precisely the practical application of cache! Your browser has saved various information and page structures in a reserved environment so that you don't have to download them again on future visits. This makes everything faster, especially for those with weaker internet or weak signals.

##What are cookies?

In short, cookies serve the same function as cache in terms of storing information, but in different formats and processes. Many of the services we access daily use cookies for other functionalities such as remembering your browser as a returning client, keeping items you "left in the shopping cart," recording information about your browsing, etc.

In this [article](https://goadopt.io/blog/cookies-e-lgpd/), you can find a more in-depth explanation.

In other words, both cookies and cache store information in your computer's or mobile device's memory. As a result, they often overload the storage and slow down the system. That's why various browsers have rules to delete all cookies every three months, for example, or are starting to block third-party cookies to avoid this unnecessary accumulation.

However, sometimes the browser's cleaning cycle is not enough.
So learn from [AdOpt](https://goadopt.io/) how to delete your browser's cache and cookies:

##How to quickly delete cookies and cache?

Sometimes, when you're experiencing issues with using an online service or accessing a website, the technical team asks you to clear the browser cache.

To get rid of the data stored on your computer when you access a website, you don't need to go to the Google Chrome Preferences. Just use the shortcut below:

**On Windows**
Control + Shift + Del

Command + Shift + Del

After that, simply select the items you want to delete: cache, cookies, history... and DONE!

![clear_cookies_cache_chrome.png](https://strapi.goadopt.io/uploads/clear_cookies_cache_chrome_32fa1b37f4.png)

##Delete Cookies in Chrome

If you're using Google Chrome,

1. Click on the **three dots in the upper right corner** to open a configuration menu.
2. Go to **More Tools**.
3. Then click on **Clear browsing data**. A new window, as shown in the image below, will open, and in it, you just need to choose what you want to clear: - **Cookies and other site data - Cached images and files**.
4. **After selecting the options, click the "Clear browsing data" button.**

**Done!**


Then click on Clear browsing data. A new window, as shown in the image below, will open, and in it, you just need to choose what you want to clear: - Cookies and other site data - Cached images and files.



After selecting the options, click the "Clear browsing data" button.

Done!

By following these instructions, your computer will be lighter, and your browsing experience will improve.
**But be prepared because all saved logins and access will also be cleared, requiring you to sign in again and "prove that you are you."**

##Clearing Cookies in Internet Explorer

If your browser is **Internet Explorer**, for any version, follow the steps below:

1. Access the menu on the right **Settings** (indicated by the gear icon as shown below).
2. Click on **Security > Delete browsing history.** (A window will open, showing your browsing history).
3. By clicking the **Delete** button, you can delete all the data saved by the **Internet Explorer **browser.

**Clearing Cookies in Mozilla Firefox**
For versions of the **Mozilla Firefox **browser, follow the simple cleaning process below:

1. Menu **Firefox > Preferences**.
2. Choose the **Privacy** option.
3. Select the option **Clear your recent history**: *Here, you can determine **the time period** to be deleted and the respective details to select.
4. To finish, simply click **Clear Now.**
5. **Done**! You can now continue browsing peacefully!

##Clearing Cookies in Safari
For Safari users, the process to clear cookies is also straightforward.

Click on the **Preferences** option.
Select the **Privacy** option > **Remove all website data.**
After this click, confirm your decision.

How to delete cookies and cache in Chrome and other browsers?

In this article, you will have a great introduction to the topic, as well as various other variations that revolve around the subject: Cookies and LGPD.

We list concepts and examples of cookie types, how to classify them in your documentation, Privacy Policy, Legal Bases of LGPD, etc.

In effect since August 2020, the General Data Protection Law (LGPD) will require a drastic change in the operations of companies that use data from their customers and users. Starting from August, data can only be used if it complies with the principles of LGPD - the so-called Legal Bases of LGPD - and is transparently and objectively consented to.

This will cause numerous websites to not only change their privacy policies and the information their cookies store but also various processes and ways of handling people's data. In this article, we will see how the use of cookies will be affected and how your company can continue to use them in a way that respects the law.

## What are cookies?

Cookies are small text files that can store what the user is doing for a certain period. Some cookies store your browsing history, as well as logins and passwords. It is because of them that you can access your Facebook account without having to enter your email every time, as the browser (using cookies) does it for you.

In addition to various functional aspects, cookies also provide excellent service in well-known systems such as Google Drive, for example. Thanks to the cookie's ability to store information, we can work on our texts, spreadsheets, presentations, even offline, and when we reconnect, our work is not lost.

## There are two types of cookies:
**First-Party** and **Third-Party Cookies,** terms used to refer to cookies generated by the website owner or by third parties.

First-Party Cookies are those generated by the website's own domain. From the website owner's perspective, they are the information that visitors generate during their browsing session.

- Which tabs you visited;
- If you searched for a product, added it to a list, and "forgot it in the shopping cart";
- If you filled out any forms, etc.

Many website builders or e-commerce services use cookies to provide these functionalities to their customers. So, don't be surprised if you see that your website triggers first-party cookies without notifying you. They have practically become a "market standard."

Regarding the cookie's storage capacity, this information is indeed "generated" by our browsing, and cookies are one way to store it. How does it work?

When the system generates a cookie, it has an identifier that stores the information in the company's database as well as in the visitor's browser. A very simple example is when we access a news portal and encounter the famous paywall message, "you have reached the limit of daily free articles, subscribe to our services."

How does it know that you have already read a specific article?
Simple, through the cookies it stores in your browser for each article read.
(Does this mean that if I clear my cookies or browse anonymously, I can read freely?... Wait, wait... do you think they haven't thought about that too? 😉)

On the other hand, Third-Party Cookies are cookies from third-party sources external to the website's domain. In other words, they are cookies from third-party companies that also set cookies to record information about their visitors.

Most of the time, these third-party cookies should (or at least should) all be authorized to be present. Otherwise, the website owner may be surprised by the number of entities "sucking" data from their site(s).

Here are some common examples of services that use cookies:

- Facebook Ads
- Google Ads
- Google Analytics
- Hotjar
- Cloudflare
- Mixpanel
- Zendesk
...

## How does LGPD affect the use of cookies?

5th Article 5 of the _Lei Geral de Proteção de Dados_ - LGPD provides legal definitions of terms that you will come across frequently when researching the regulation. Among these definitions is that of personal data:

**"personal data: **information related to an identified or identifiable _natural person._"

We have the last two words in italic because they are the most important for the subject at hand.

Not all data that cookies carry is personal. For example, your visit to our website is not personal data. However, once you register your email on a site like Facebook, you are identifying yourself. Therefore, this is personal data that can be collected by a cookie.

And it is from there that the LGPD starts to affect how your data is used by websites and how your website handles user data.

The problem with the use of cookies arises when it is not known what data is being collected, for what purposes, and by whom. It is a matter of privacy and transparency, values that are the foundation of the LGPD.

The use of cookies that violates the LGPD will be penalized, and among the penalties are expensive fines.

## Who needs a cookie policy?

All websites that process data, specifically those that use First or Third Party Cookies. If your website processes personal data or data that, when combined, can identify an individual person, it needs even more careful review of how this information is processed.

But, should this be listed in the Cookie Policy or the Privacy Policy?

That depends on the company's choice to differentiate these aspects, as it may be a different approach based on the business model. Some companies address regulations for their "digital" data in the Cookie Policy and the "offline" data in the Privacy Policy. However, it varies greatly, so we recommend consulting an expert who can analyze your business model and all the data flows and mappings of your company to understand the need for such differentiation.

## Cookie requirements: How to keep your website compliant with LGPD.

To ensure that a website is compliant with LGPD when using cookies, there are certain principles to consider, especially if you have a valid "reason" or legal basis that supports the use of data and cookies on your site. For many, this legal basis is "Consent."

What does that mean?
In order for companies to process personal data of data subjects (individuals like you and me), they now need to have a strong legal basis provided by the law (LGPD). This "permission" is known as the Legal Bases of LGPD.

Therefore, while consent is not the only legal basis that allows companies to use data, it plays a crucial role when it comes to cookies. This is why cookie banners serve an essential purpose: notifying and informing visitors, as well as correctly collecting and storing individual consents.

Regardless of the information carried by a cookie, it should have been consented to by the user. But what makes consent valid? And what should be communicated to the user?

The user must be clearly and objectively informed about the purpose for which their data will be collected. Additionally, they must give their explicit consent, or opt-in, by clicking on a banner.

To automate this process, Cookie Notices or Cookie Banners are used.
They serve to fulfill the sixth principle of the law: transparency.

## Cookie Banner or Cookie Notice
The Cookie Banner is that little pop-up window you can see on most websites nowadays, including when you entered our blog. This banner communicates that the site uses cookies. Ours says the following:

"Take control of your privacy. Our site uses cookies to enhance navigation." Then, there are two links: Privacy Policy and Terms of Use. Right after, there's a button for you to view your privacy options and an "accept" button, indicating that you agree to the use of your data.

The cookie banner, or cookie notice, which is a feature of the Consent Management Platform, serves to explicitly state the practice (use of cookies), the purpose (enhancing navigation), and offer users the possibility to fully or partially agree to the data processing.

This is what LGPD requires: transparency and objectivity, without complications.
In this way, the use of cookies is permitted and can greatly assist in your business operations.


## What is the expiration period of a cookie?

GDPR, the European data protection regulation, has a limit of twelve months for the use of a cookie. However, LGPD does not establish an "expiration" deadline.

But one of the principles for data processing is necessity. According to the regulation, data can only be retained for the time necessary to fulfill its purpose. If a cookie carries information that no longer needs to be used, it becomes invalid under the law.

Additionally, there are various initiatives by browsers—especially Apple's Safari, which automatically blocks third-party cookies. This "trend," as it is known in the market, has been widely discussed since 2015, even before GDPR. However, it is always being rethought or adapted because the entire advertising and analytics market relies heavily on the widespread use of cookies.

Thus, any changes in this regard will indeed be revolutionary and will bring many changes to the ecosystem as a whole.

## Cookies and LGPD in the privacy policy.
It is important that your privacy policy includes a detailed and specific explanation of how your website uses cookies.

As described earlier, many companies make distinctions between the cookie policy and the privacy policy. This is not mandatory, but it may be necessary based on the business model. So, don't cling to templates, but strengthen transparency and accessibility for the information listed there.

## Cookie Pixel and Tag, what's the difference?
It is important to avoid confusion at this point, as many people end up mixing up these concepts. I'll provide a simple explanation below, which will help us understand the order of things and facilitate overall comprehension.

Remember: Tags and Pixels trigger Cookies.

- Tag & Pixel: Code that goes into the HTML of your website to call a specific service. These are scripts (programming codes) that call a server and perform specific functions based on these requests.

- Cookies: Text files read and triggered by Tags & Pixels, which store data and serve to identify whether a browser is new (if there is no cookie, the tag triggers) or already known (if It has the cookie, It will overwrite it).

##What is the correct way to use cookies under LGPD?

To maintain compliance with the law, it is necessary to pay attention to the principles of LGPD and have knowledge of the regulation as a whole.

Furthermore, once it is decided that the company will indeed use first-party or third-party cookies in its operations, the categorization or organization of these cookies is the basis for communicating with visitors in your cookie policy and banner.

In general, the market uses five main groups to classify their tags and consequently the cookies triggered by them:

- **Necessary**: Without them, your business model doesn't work, or you have to use them due to legal requirements/legislation.
(e.g., first-party cookies, gateway authentication, etc.)

- **Advertising**: With them, you trigger remarketing, populate ad pixels, email sequences, etc.
(e.g., Facebook Pixel and Google Ads)

- **Analytics**: With them, you have an analysis of what visitors do, where they come from, how they behave on your site.
(e.g., Google Analytics, Hotjar, etc.)

- **Performance**: Tags that maintain site functionality and ensure its operation, e.g., preventing DDoS attacks.
(e.g., Cloudflare)

- **Functional**: Tags that handle functional aspects, such as remembering preferences or recognizing that the user is already logged into the system.
(e.g., Chatbots, Helpcenters)

## How to manage cookies and visitor consent under LGPD?
To facilitate data collection and record user consent, there are Consent Management Platforms (CMPs) like [AdOpt](https://goadopt.io/).

In this [link](https://goadopt.io/en/), you can learn more about our service: In summary, a Cookie Banner that helps your website comply with LGPD, GPDR, CCPA... standards while also being a comprehensive tool for managing consent and communicating with visitors. 

Get [started for free now](https://goadopt.io/en/) and avoid LGPD, GPDR, CCPA... fines!






LGPD and Cookies what do you need to know?

In July 2019, the General Data Protection Regulation (GDPR) of the European Union issued the largest fine in the history of the law: 183 million euros. The fined company was British Airways, the English airline. The reason for the fine was a security breach that resulted in the personal data of over 500,000 customers being leaked.

Although the LGPD (Brazil's General Data Protection Law) has been in effect for some time now, the subject still generates many questions among Brazilians. What fines are specified in the LGPD? What is the maximum fine a company can receive? What is the deadline for a website to comply and avoid fines?

In this article, we will answer all your questions regarding fines under the LGPD (Brazil's General Data Protection Law).

##What fines have been imposed under the GDPR?

In the European Union, companies can be fined up to 20 million euros or 4% of their annual revenue, whichever is higher. As we saw, British Airways incurred a loss of 183 million euros due to mishandling of data.

In Germany, a police officer was fined 1,500 dollars for using a citizen's license plate to find his phone number for personal purposes. This shows that it is not only large companies that draw attention with their mistakes and get penalized.

But what about our LGPD? Will the fines be the same under Brazil's General Data Protection Law, which is inspired by the European regulation?

##What cases under the LGPD are subject to fines?

The LGPD must be fully complied with, not in parts. British Airways was fined a record amount for an unintentional slip.

Therefore, it is extremely important that you read everything about the LGPD and make the necessary adjustments as quickly as possible. Every company must have a Data Protection Officer, and it is recommended to use a [CMP](https://goadopt.io/en/), which makes the work much easier.

More significant slip-ups will result in higher fines, while minor slip-ups will obviously be penalized differently. The law states that the following factors will be taken into account:

• The severity and nature of the violations and the affected personal rights;
• The good faith of the infringer;
• The advantage gained or intended by the infringer;
• The economic condition of the infringer;
• The recurrence;
• The degree of harm;
• The cooperation of the infringer;
• The adoption of good practices and governance policies;
• The prompt adoption of corrective measures; and
• The proportionality between the gravity of the offense and the intensity of the sanction.

The complete administrative sanctions are specified in 52nd Article of the law, which can be consulted [here](http://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/L13709.htm).

##What are the fines and penalties under the LGPD?

The LGPD provides for six penalties or fines. They are as follows:

1. **Warning**: This warning comes with a deadline for the company to comply with the law. If the company fails to make the necessary corrections within the specified timeframe, penalties will be imposed.

2. **Simple** fine based on revenue: This fine can be up to 2% of the legal entity's revenue. The maximum limit is 50 million Brazilian reais per violation.

3. **Daily fine**: This fine is also limited to 50 million Brazilian reais.

4. **Public disclosure of the violation**: The violation becomes public, and the damage to the company's reputation can be significant.

5. **Blocking of personal data**: This administrative sanction prevents companies from using the collected personal data until the situation is regularized.

6. **Deletion of personal data**: The sixth penalty provided by the LGPD requires the company to completely delete the data collected in its services, causing harm to the company's operations.

The maximum limit for fines under the LGPD is 50 million Brazilian reais. However, some of the penalties can be even more severe, depending on the company. For example, publicly acknowledging the leakage of personal data from thousands of customers can undermine even solid companies, completely eroding the credibility of a brand.

But do these fines also apply to smaller businesses with minimal data processing operations? Or only to large companies like British Airways and Google?

**Can anyone be fined?**

The law refers to "data controllers." Any website or company that collects data automatically becomes a data controller.

However, there are exceptions. They are as follows:

• Natural persons who use data for personal and non-economic purposes;
• Persons who use data for journalistic, artistic, or academic purposes;
• Public security or national defense agents who use data to enforce the law.

In these cases, there is no need for formal consent. Therefore, there is no possibility of a fine since these activities do not violate the law.

However, every business, without exception, will be subject to fines once the law comes into effect. But until then, you have a task:

What is the deadline for compliance?

The deadline has already passed! The law came into effect in Brazil on August 16, 2020.

If your company is not yet compliant, we recommend that you start as soon as possible and gather as much information as possible about the law to avoid fines and penalties. 

To better understand the regulations, read the article **Everything about the LGPD**!







Fines in LGPD - What are they, amounts, and compliance deadlines

One of the biggest dilemmas for those who start studying and understanding the LGPD more deeply is the realization that, as challenging as the compliance process may be, it is only the beginning. Yes, a series of changes and adjustments should now become part of the company's routine. There are several marketing processes involving personal data that you must reconsider now because of the LGPD!

Therefore, compliance with the LGPD goes beyond setting up a cookie banner or updating the privacy policy. Depending on the size of your company, numerous processes need to be reviewed and adjusted to the new realities established by the law.

The bureaucracy may seem extensive and never-ending for companies. However, we always need to put ourselves in the shoes of visitors, data subjects. Remember, both you and I are data subjects before being companies or professionals – we are citizens! The LGPD's priority is precisely to empower data subjects so that they, as individuals, have full rights and access to the necessary information regarding the use of their personal data.

That's why we're here!

Let's be the professionals who see the legislation as a new opportunity to raise the bar, to apply our knowledge with quality and respect to our clients and visitors!

The LGPD has brought new rules, new marketing processes, new positions...

So, how can we not anticipate the new standards and the new quality references that will ultimately be perceived by our clients?

One of the beautiful concepts, such as Privacy by Design (we've already discussed it here on the blog), can and should always be brought to the forefront!

That being said, I want to help you! Below, then:

##The 10 marketing processes you should rethink because of the LGPD!

###**1 - Sharing data lists with suppliers and third parties (freelancers, real estate agents, salespeople...)**
If by this point it's not already obvious to you, I don't know how else to make clear the risk of this type of sharing. After all, the visitor has provided their personal and sensitive data to the company. They have no way of knowing that you have numerous other people hanging on to your mailing list.

So be very careful with this practice! Especially if there is no confidentiality or liability agreement between the parties involved!

It may be that your business model requires this distribution of data, so reinforce it - clearly, in your policy and terms! Remember, when in doubt, prioritize privacy!

###**2 - Receiving customer email lists to upload to Facebook for matching and look-alike audiences.**

Does this list have consent for Facebook actions? What is the origin of the list? You may have noticed that since GDPR, Facebook has already been questioning advertisers when they upload email lists... I wonder why, right?

Whether you are a marketing department or a third-party agency to the client, always question these lists and avoid extending the channels of direct communication with the customer as much as possible, as it may violate consent and/or the legal basis that supports the use of the data.

###**3 - Buying cold lists to send emails, SMS, and SPAM. (If it was a crime before, now it's even more so)**
Who hasn't thought about "obtaining" a contact list, cast the first stone! Or even, who has never been approached by companies that sell these cold leads!

Lucky are those who generate quality content and transparency to the point where visitors trust the company with their data...

It's no wonder that email marketing tools have numerous warnings to avoid spam. It harms everyone's reputation, and the internet has no patience for spam, agree?

###**4 - Exchanging email lists for sending articles and newsletters with partners and clients. **
(A practice that may seem innocent but can violate the rights of data subjects)

It may seem innocent, but it's only an appearance! Just like the points above, data subjects have entrusted their data for that exclusive purpose. Any interaction that goes beyond that can directly violate the rights acquired through consent and/or legal basis.

###**5 - The agency as a whole has access to clients/visitors' email lists.**
(Access levels for sensitive data - responsibility contract)

Here we enter the realm of management and processes! 
Several marketing tools allow us to create hierarchies within their user accounts. This is precisely because each person has their level of activity and responsibilities.

It is a fact that many companies today work with decentralized or even horizontal management. But when things go wrong, who will be held responsible? Avoid problems by reviewing approval levels and access to data according to your team's responsibilities. After all, the actions of one employee affect the entire organization, and this should be considered as a contingency.

###**6 - Hiring freelancers and professionals with high turnover without a data responsibility contract with clients.**
(the infamous "flash drive")

This point is quite similar to the previous one bu,t has an even greater detail. Third-party professionals have limited or even extended responsibilities based on their contracts and the criteria they are bound to. So, every time a third party has access to your company's database, what security do you have over that data?

What guarantee does the data subject have when the data is exposed? Yes, it's basic! But there have been many cases of Employee X or Agency Y who deleted everything before leaving or took everything with them. And then? Was there a contract?

###**7 - CTAs in campaigns and ads saying "leave your contact information below if you want to receive..."**
This CTA (call-to-action) may seem "cheesy," but it is still widely used, and as they say, "if there's a rule, it's because there's a story behind it," meaning it works.

Be cautious with this kind of approach, especially if your audience is less tech-savvy and unaware of the risks of the internet.

Remember the case of people providing their data on a Facebook post to get a superhero credit card? Well, you don't want your company's reputation to be associated with an opening for scammers.

###**8 - Offline actions without a strong data collection guideline (legal basis) or associated consent.**
The LGPD is not only applicable to the online environment.
So, which offline, in-person actions should also be adapted to comply with the guidelines? Do you use registration forms? What is the data collection process in physical environments?

Every company has its own reality, but I have seen companies using "offline" consent forms (actual printed forms) to be attached to visitor registrations! Or even collecting all registrations via tablets, where consent is also recorded in the CRM.

Our radar should be tracking both online and offline! If you bring everything online, for example, through QR codes, you can use the AdOpt cookie notice as your consent tool and also implement tracking tags on the same landing page!

Perhaps this way, you can not only automate the opt-in process but also have authorized remarketing at the same time!

###**9 - Maintaining email lists out of vanity.**
The days when that Excel spread sheet full of emails from the 90s was considered a treasure for a company are gone.

Aside from being a vanity metric, it is also a significant cost within automation tools. Outdated and cold email lists pose a huge risk to the organization today. Avoid it, eliminate all of that, and make an effort to obtain updated consent from your active base as soon as possible!

Don't say I didn't warn you!

###**10 - Including personal data (such as personal cell phone numbers) in the Company's organizational chart without obtaining approval in the employment contract.**

Some companies like marketing agencies, have their organizational chart, a source of joy for SDRs when making those old-fashioned cold calls and scheduling appointments for the Field Sales team! #WhoHasNeverDoneThat?

If you're not familiar with it, let me explain!

Many agencies, especially the larger ones in São Paulo/BR, still have the infamous "organizational chart" displayed at the reception.

Accessing this file brings great joy to the sales team because it not only reveals the decision-makers but also provides their contact information!

However, there is also a potential danger lurking here!

If your organizational chart contains not only employees' professional data but also the personal cell phone number of an employee who didn't want to use two phones, for example...

Is this sharing of personal data specified in the employment contract?

It may not be a problem now, but in times of crisis, labor law can utilize all available resources. Why wouldn't it consider this aspect as well?

In the end, our goal has never been to predict doom for companies or to be part of the LGPD's Apocalypse Cavalry. But since we've been in the market for some time, these kinds of issues always catch our attention when we start data mapping and having conversations with colleagues.

Do you remember any other processes that could be included in this list?

Comment below, maybe it will help colleagues in the journey of compliance!

10 Marketing Processes You Should Rethink under the LGPD!

Protecting personal data has become a fundamental issue in the digital age, leading to the implementation of regulations worldwide to ensure individuals' privacy and security. Two of the most well-known and comprehensive regulations in this regard are the General Data Protection Law ([LGPD](https://goadopt.io/blog/en/lgpd-general-data-protection-law/)) of Brazil and the General Data Protection Regulation (GDPR) of the European Union. After all, they cover vast populations in their territories, consequently resonating beyond their borders.

However, while both aim to protect individuals' rights regarding the processing of their personal data, there are some important differences between them.

## The Difference in Geographical Application

The first significant difference between [LGPD](https://goadopt.io/blog/en/lgpd-general-data-protection-law/) and GDPR lies in their geographical application. GDPR applies to all European Union (EU) member countries and also **to companies outside the EU that process data of EU individuals.**

On the other hand, LGPD applies to all organizations processing personal data in Brazil, regardless of their geographical location. This means that both Brazilian and foreign companies dealing with personal data of Brazilian individuals must comply with LGPD provisions. Hence the importance of transparency in international data transfers.

## The Difference in [Fines](https://goadopt.io/blog/en/fines-in-lgpd/) and Sanctions

Another significant difference is the amount of non-compliance fines. Under GDPR, fines can reach up to 20 million euros or 4% of the company's global turnover, with the higher value prevailing. Meanwhile, LGPD establishes fines that can go up to 2% of the company's revenue in Brazil, capped at 50 million Brazilian reais per infringement.

It's important to note that these values represent maximum penalties, and the severity of the infringement and the organization's financial capacity are considered when determining the fine. Another point is that the fine is per infringement, meaning that 1 citizen who has their data compromised equals 1 infringement. How many infringements would be calculated for a database with thousands, millions of data?

## The Difference in Categories of Considered Sensitive Data

The definition of sensitive data also differs between the two regulations. While [GDPR](https://goadopt.io/blog/en/gdpr-lgpd-and-ccpa-what-are-these-laws-similarities-and-differences/) includes specific categories of data such as race, ethnic origin, political opinions, religious beliefs, health, sexual orientation, among others, LGPD goes further and also includes biometric and genetic information as sensitive data.

This broadening of the definition of sensitive data in LGPD reflects the concern to protect even more sensitive personal information and ensure that it is processed with due care.

## The Difference in Consent Collection and Processing

[Consent](https://goadopt.io/blog/en/consent-website-lgpd/) for data processing is another aspect that differs between GDPR and LGPD. Under GDPR, consent must be explicit, specific, and freely given by the individual. In contrast, LGPD requires unequivocal consent, provided through a statement or other affirmative action by the data subject.

Both regulations emphasize the importance of informed and free consent, ensuring that individuals have control over how their personal data is used.

However, you might wonder:
_Wouldn't it be the same thing but worded differently?_

Nevertheless, despite both regulations emphasizing the importance of consent, there are subtle differences in how they approach this aspect.

According to GDPR, consent must be **explicit**, meaning it must be given through a clear and specific affirmative action by the individual. **This implies that consent cannot be presumed or obtained through omission or pre-selection.** Furthermore, consent must be **specific**, **clearly indicating the purpose for which the data will be processed**. It must also be **freely given**, meaning the individual must have the freedom to choose to consent or not, **without suffering pressure or coercion.**

On the other hand, LGPD requires **unequivocal consent**, which means that consent must be **clear and indisputable**. It must be **provided through a statement or other affirmative action by the data subject**, indicating their agreement to process the data for a specific purpose. LGPD does not use the term "explicit" like GDPR but requires consent to be unequivocal, meaning it leaves no doubts or ambiguities.

Although the nomenclature and words used to describe consent may vary between the two regulations, the differences go beyond that. GDPR sets specific requirements for explicit consent, while LGPD emphasizes the need for unequivocal consent.

These differences reflect the distinct approaches taken by each regulation, although both aim to protect individuals' rights and privacy regarding the processing of their personal data.

In conclusion, LGPD - recently published its guidance on the use of cookies. In this regard, they draw heavily from GDPR's defaults regarding specific requirements for explicit consent in consent collection.

## The Difference in the Naming of the Data Protection Officer (DPO)

Another relevant point is the appointment of a Data Protection Officer (DPO). Under GDPR, some organizations are required to appoint a DPO to oversee compliance with the regulation and act as a point of contact for data protection-related issues. This obligation applies to organizations that carry out systematic monitoring on a large scale of personal data or process special categories of data, such as health-related or ethnic origin-related data.

In contrast, LGPD, while not requiring the appointment of a Data Protection Officer, recommends that companies designate a professional responsible for dealing with privacy and data protection issues. Ultimately, the company's managing partner would already be responsible for this aspect.

## The Difference in the Use of Internet Cookies

Regarding the impact of [internet cookies](https://goadopt.io/en/blog/lgpd-cookies-all-you-need-to-know/), both GDPR and LGPD address the issue similarly. Cookies are small text files stored on users' devices when they visit a website. They play a crucial role in personalizing the online experience but can also collect personal information. Both regulations require websites to obtain user consent before storing or accessing cookies that collect personal data.

GDPR establishes that consent must be obtained through a clear affirmative action, such as checking a checkbox or clicking a button. Additionally, users must be informed about which cookies will be stored, for what purpose, and for how long. They also have the right to withdraw their consent at any time.

Similarly, LGPD follows a similar approach, requiring websites to obtain prior and unequivocal consent from users before using cookies that collect personal data. Users must be informed about the purpose of the cookies, as well as the option to refuse or revoke consent. Moreover, LGPD also provides users with the right to access, correct, and delete their personal data collected through cookies.

Therefore, both GDPR and LGPD aim to ensure that users have control over their personal data, including those collected through cookies. Companies operating in both the European Union and Brazil must be aware of the provisions of these regulations and take appropriate measures to ensure compliance.

## Transparency, Security, and Control: The Synergy Between the Regulations

In summary, GDPR and LGPD are comprehensive data protection regulations aimed at protecting individuals' rights and privacy. Although there are differences in their geographical applications, fines for non-compliance, definitions of sensitive data, and consent requirements, both share the goal of promoting transparency, control, and security in data processing.

Furthermore, both regulations recognize the importance of consent for the use of cookies and require websites to obtain user consent before collecting their data through these technologies. Therefore, companies operating in compliance with GDPR and LGPD must closely observe the guidelines related to internet cookies, ensuring they obtain appropriate consent and provide clear information about the collection, storage, and use of these cookies.

[Learn more about the 10 risky processes in you marketing you should revise.](https://goadopt.io/blog/en/10-risky-processes-in-your-marketing/)

## Privacy and the Use of Cookies

The impact of internet [cookies](https://goadopt.io/blog/en/cookie-banner/) is significant for companies that must comply with both GDPR and LGPD. Cookies are widely used to track user behavior, personalize ads, and enhance the browsing experience. However, they also raise concerns regarding privacy and the protection of personal data.

For companies operating in compliance with both regulations, it is crucial to ensure that cookies are set up and used in accordance with consent and transparency requirements established by the regulations. This entails obtaining explicit consent from users before activating cookies and providing clear information about the types of cookies used, their purpose, and storage duration. Additionally, companies should allow users to opt out of accepting cookies or easily manage their cookie preferences.

Non-compliance with provisions related to cookies can result in substantial fines, as well as loss of user trust and damage to the company's reputation. Therefore, it is essential for companies to be vigilant about the obligations imposed by both GDPR and LGPD regarding internet cookies.

To ensure compliance with GDPR and LGPD regarding cookies, companies should take the following measures:

1. **Transparency**: Companies must provide clear and accessible information about the use of cookies on their websites. This includes explaining what types of cookies are used, for what purpose, and how long data is stored.

2. **Proper Consent**: User consent must be obtained before activating cookies that collect personal data. Consent must be obtained clearly, specifically, and unequivocally. Users should have the option to consent or refuse the use of [cookies](https://goadopt.io/blog/en/cookie-banner/) and manage their cookie preferences.

3. **Preference Management**: Companies should offer users clear options to manage their cookie preferences. This may include the ability to accept or reject specific categories of cookies or revoke previously given consent.

4. **Data Security**: Companies should implement adequate security measures to protect personal data collected through cookies. This includes safeguarding this information against unauthorized access, misuse, or disclosure.

5. **User Rights**: Companies must respect users' rights regarding their personal data, as established in GDPR and LGPD. This includes the right to access, correct, update, or delete data collected through cookies.

By adopting these measures, companies can ensure they are acting in compliance with data protection regulations and demonstrating their commitment to user privacy and security.

Need assistance in implementing a cookie policy and consent collection on your company's websites? We at [AdOpt](https://goadopt.io) can help!


Key Differences between LGPD and GDPR and the Impact on Internet Cookies

If you've reached this article, you're certainly searching and wondering: What is the best cookie notice for your website, and how do you choose among the many options on the market? What are the criteria for this choice, and what are the strengths and weaknesses of each option? Well, we're here to help you because this decision needs to be well thought out!

Therefore, below we have listed the answers into key points that should be carefully analyzed.

1. Why do I need this banner, really?
2. But cookies are anonymous, so why all this?
3. Legislation and Language.
4. LGPD and the cookie notice, technical aspects of the Law.
5. Design.
6. Truth.
7. Detailed Purposes.
8. Freedom of choice.
9. Blocking third-party cookies.
10. Price
11. Integrations.


##Why do I need this banner, really?

First of all, **does your website REALLY need an LGPD Cookie banner?**

What do you mean? I'm already in this article to choose a cookie software, and you still want to tell me who actually needs the LGPD Cookie banner?

Exactly! Because there are many people who come to us to install the cookie banner on a website that simply does not use cookies. Seriously! Sometimes it seems like our banner is synonymous with website quality (okay, I confess, I agree), but there are limits.

It's like buying sunscreen for a nighttime stroll or mosquito repellent for diving.

The key point is confusing for many!

1. Just because many websites are using it doesn't mean you need to as well!
2. Pay attention to other legal bases that can support your business, in addition to consent.
3. The key question: If you don't use cookies on your website, why have a cookie banner? In times of such complex legislation, less is more!

Here, we have highlighted some points from the LGPD to support our reasoning:

**Article 8** addresses how the controller should request the data subject's consent. The first and most important rule is that the consent clauses must be separate from others, allowing the data subject to have a clear understanding of what they are consenting to.

Article 8 - § 2: The burden of proving that consent has been obtained in accordance with this Law lies with the controller.

_What does this mean? _
As the controller (your website), you must keep a record of all consents obtained, and these must be stored and documented.

Because at any time, data subjects have the right to request such records and any data you may have about them.

Refer to Article 19:

**Article 19: Confirmation of the existence of personal data or access to personal data shall be provided upon request by the data subject:**
_
I - in a simplified format, immediately;_ or

_II - through a clear and complete statement indicating the origin of the data, the absence of a record, the criteria used, and the purpose of the processing, subject to trade and industrial secrets, provided within a period of up to 15 (fifteen) days from the date of the data subject's request._

1. Personal data shall be stored in a format that facilitates the exercise of the right of access.

2. Information and data may be provided, at the data subject's discretion. § 3. The processing of personal data based on defective consent is prohibited. § 4. Consent must relate to specific purposes, and generic authorizations for the processing of personal data shall be void. § 5. Consent may be revoked at any time by the data subject's express manifestation, by means of a free and facilitated procedure, without prejudice to the processing carried out under the previously given consent until the request for elimination, as provided for in item VI of the main section of Article 18 of this Law.

##But, aren't Cookies anonymous? Why all this?

If you're not familiar with the digital world, let me explain to you with the most popular phrase from privacy policies ("Cookies are small pieces of text that are stored in your browser when you access a website on the internet.")

With this information from cookies, companies can do a lot, and I mean a lot! They can accurately profile your psychology and cross-reference this information with extremely personal data, known in the market as data enrichment or "data farming."

###The logic is always very similar: Browser -> cookie -> personal data (email, phone) -> person/registration -> CPF (Brazilian individual taxpayer registry) -> income, IRPF (Brazilian income tax return), marital status

Several companies do this, and virtually all of those that have tags installed on their websites can somehow convert this information and target any individual specifically. Whether it's directly through their own database (Google), or by cross-referencing with third-party databases (such as Serasa).

In other words:

**Cookies are not anonymous but rather anonymized.**

##Legislation and Language.
This is an excellent variable to consider when looking for a cookie banner! Questions like: Does it support multiple languages, can that be an advantage? But, before that, does it accept multiple legislations?

For example, if your website is Brazilian and someone accesses it from Italy, it wouldn't be enough for the banner to be in Italian. The visitor is actually under the jurisdiction of the GDPR, unless the LGPD has more "private" provisions in those specific areas (as required by the visitor's country's law).

In other words, just because your site has multiple languages and versions doesn't mean that all the legislations are correctly implemented and complied with regarding the cookie notice. Is it clearer now?

Pay attention to compliance with the applicable legislations, especially for your target audience! Language and accessibility are crucial, but not the only factors when it comes to foreign accesses.

##LGPD and the Cookie Banner, Technical Aspects of the Law.
Now that we understand the context of the law, the complexities of cookies, and the parallel legislations that may influence the use of the Cookie Banner on your website, let's discuss some key points that will help you make this choice.

1. **Design**
Why design when we're talking about technical aspects? Precisely because of that, after all, what are the main metrics of a website, an e-commerce? How do you analyze the conversion from visitors to leads and then to sales? Is Bounce Rate a concern? What are the KPIs of your site? Does usability and visitor experience matter?

Yes, they matter A LOT!

Therefore, look for a cookie banner with refined and responsive design that allows you to customize colors, logos, and placement on the site in a way that harmonizes with the overall structure of the site. Don't just throw a senseless banner in the middle of the visitor's screen; respect the attention the visitor is giving you!

Be cautious with designs that occupy the entire screen! We understand that the law requires clear and assertive communication, and many are overwhelmed by the uncertainties in the market. However, you shouldn't disturb the visitor or act impulsively because of that!

We know how every second counts in capturing visitors' attention, so make it count!

Do you really want to use a banner that steals attention instead of fulfilling a simple and even basic role required by the law?

![aviso barcelona.png](https://strapi.goadopt.io/uploads/aviso_barcelona_1cc05ad647.png?updated_at=2022-08-17T18:16:59.332Z)

This Barcelona F.C. banner is like having ten players blocking the goal...

2. **Transparency**
I may sound sensationalistic, but I dare say:

**"Most of the cookie plugins and banners we see on the internet are just fake buttons. Yes, digital components that don't record or organize anything."**

In addition to the "fakeness" of these mentioned points, always use assertive and direct language. Don't try to be "cool" or trendy. Of course, using too much legal jargon can push people away.

![aviso seção verdade.png](https://strapi.goadopt.io/uploads/aviso_secao_verdade_3a5ce550cc.png?updated_at=2022-08-17T18:18:11.830Z)

Not to mention that if I have no way to refuse, how would it block then? So, in the end, it's the same thing, don't you agree?

##Detailed Purposes.

This is one of the crucial points we consider in a good cookie banner. According to LGPD, consent must be given for specific purposes. Therefore, a simple "OK" or even "Accept" without the option to explore my choices and understand their purposes and legal bases can be somewhat coercive.

Consent is not a salvation or a general acceptance. It is the formalization of acceptance for that specific purpose presented.

![aviso sem finalidade.png](https://strapi.goadopt.io/uploads/aviso_sem_finalidade_db0539333e.png?updated_at=2022-08-17T18:18:58.036Z)

##Freedom of Choice.
The General Data Protection Law (LGPD) lists a series of legal bases through which companies can use data with ease. If you have chosen consent for your company, use it with respect and always value the privacy of your data subjects.

There is no better or stronger legal basis. Instead, choose the one that best fits your business model and market. Similarly, a cookie banner should understand the context in which consent will be communicated and collected, and should provide visitors with the freedom to choose fully, partially, or not at all.

Always look for cookie banners that break down the listing of tags and cookies into categories and subcategories. This is essential to demonstrate that a particular purpose is presented within category "X," and visitors can freely choose whether to accept it or not.

##Blocking Third-Party Cookies.
The cookie banner is not just an interactive button; it must have authority over the behavior of other tags used on the website, authorizing or blocking their firing based on the consent collected during that visitor's session.

For example, the Google Analytics tag should only be fired when the visitor accepts the statistical category of tags. Before that, the notice informs and waits for visitor interaction.

For more information on how to configure the AdOpt Cookie Banner to enable automatic blocking of third-party tags, see our tutorial.

##Price
The price of a cookie banner should be:

**- Affordable:**
Low prices that do not eat into your marketing budget. If there is a free plan, even better! The cookie banner only solves a part of the law's compliance, and it's likely that you will need other services or consultations in the future. Therefore, don't spend too much of your budget on this product.

A cookie banner does not cover all the obligations of LGPD, for example.

If you have other internal processes that use personal data, you will need to use other controls and even systems for that management.

The cookie banner should take care of the "digital gates" and reinforce the legal basis of consent.

How?

By recognizing and categorizing all users with their choices of total opt-in, partial opt-in, or opt-out and sending these requests directly to the Data Protection Officer (DPO), or even systems like CRM, ERP...

**- Scalable**
Look for cookie banners that offer billing with scalability parameters. In other words, they should have little to no impact initially, and as your website grows and your audience expands, you will pay for that processing power.

Additionally, the volume and value tiers should be broad enough to accommodate any seasonality, so you don't

How to choose a Cookie Banner for your website

It's time to talk about one of the most impactful tasks, both for the company and for the visitors of your websites: tag categorization. But why is it so impactful? What is the relevance of this configuration and how can it affect us? It is precisely because of these common questions we receive from our clients that we have written this article on best practices in tag categorization.

## What is a tag?

To start off on the right foot, let's clarify some basic concepts that will help situate each one of you at AdOpt and in the market as a whole.

In a straightforward manner: **1 Tag = Trigger for 1 or more Cookies.**

What does that mean?

Basically, most Tags or pixels – as they are also known – when installed in the HTML of a website, are responsible for triggering cookies for each visitor on that specific page. A Tag can perform various functions such as tracking button clicks, page scrolling, collecting text fields, always associating these behaviors with that specific visiting browser.

Once this is possible, the way the Tag stores the data generated by the visitor is:

- Sending it to their server (the service provider's server that created the Tag) and;
-It can also record all the information in cookies that it generates and stores on your machine.

For example, when we visit an e-commerce website and it recognizes that we are returning after a previous visit, showing products that are of interest to us, it happens thanks to cookies and tags doing their job. In summary, 1 Tag can trigger N cookies and perform N functions.

Ultimately, the Tag itself is not inherently good or bad; it all depends on its application.

## What is tag categorization?

Categorization involves the work of the Data Protection Officer (DPO) in organizing all the tags installed on the website(s) under their responsibility into specific categories that represent their purpose and reason for being there.

Since GDPR, which was the pioneer in this regard, the market has created "standard categories." These categories are:

- **Essential / Necessary**: Without them, your business model or website does not function, or you are required to use them by law or regulations.

- **Marketing / Advertising**: With them, you can trigger re-marketing, populate ad pixels, automate email sequences, etc.

- **Statistics / Analytics**: With them, you have an analysis of what visitors do, where they come from, and how they behave on your website.

- **Performance**: Tags that maintain website functionality, ensuring its operation and response speed. For example, they can prevent DDoS attacks.

- **Functional**: Tags that handle functional aspects, such as remembering preferences or recognizing that you are already logged into the system, chatbots.

In other words, each company may have a group of tags installed on its website, with their purpose described and detailed in the Privacy Policy (or cookie policy). This purpose should be replicated in communication with visitors - the cookie banners - as well as in all processes that use this data.

## Why categorize tags?

Many companies use cookie banners that do not organize tags or cookies into specific categories, forcing visitors to accept all tags without distinction.

This poses a significant risk of fines for your operation since various regulations require that consent be specific and detailed for a particular purpose. In the LGPD, for example, Article 5, Item XII is clear:

> #info XII - consent: the free, informed, and unequivocal expression by which the data subject agrees to the processing of their personal data for a specific purpose.

This is one of the reasons why AdOpt has always worked with a design that prioritizes freedom for all visitors to navigate through categories and their respective tags.

## How to differentiate the function of each tag?

Certainly, the market already anticipates some purposes and their respective categories. However, it is worth noting that this step often involves areas of the company that go beyond those apparent on the website. A collection made through cookies can be the operational basis for an entire department and all processes within a company.

This means that, although the market already provides a standard for the category of each tag, especially the most popular ones, data controllers must adjust this difference within the company's operation, ensuring the reality of the situation and primarily supporting such choices with the chosen legal bases.

Therefore, even though there is a standard, companies are free to adjust the facts and must be prepared to respond to them with complete clarity to individuals.

That's why at AdOpt, when tags are scanned, some of them already come with a pre-classification. However, this does not prevent the data controller of a specific company from adjusting this categorization according to their Cookie and Privacy Policy.

As a platform, AdOpt cannot enforce a specific configuration or principle. However, it values freedom within its environments so that the responsibilities of the data controller are respected at all times.

## What do privacy regulations say about classifying each type of tag?

Privacy regulations do not delve into this "micro" analysis of tag categories. It would be impractical for national authorities to issue a classification opinion for every new tag that emerges in the market.

Thus, it is up to companies to ensure that communication is clear, objective, and respects the aspects of freedom and purpose already mentioned. Naturally, the market adjusts and creates standards and even specific terms for each of them.

For example, the terms "Essential" or "Necessary" are not determined by law. However, these terms help in quickly understanding their purpose, which is why the market has adopted them. The less confusion in this regard, the better. After all, subjectivity exists in all places and contexts. If we can avoid these points with a certain "standard," we minimize these variables.

## Where to apply and/or replicate this information?

As mentioned earlier, the categorization of tags is an organization that should reflect the operational purpose of using that data. Therefore, before a conceptual application, it should have a practical use that mirrors this classification.

However, it is worth noting that this classification is often explained or expanded upon in official company documents such as the Privacy Policy and Cookie Policy.

In addition, a crucial aspect directly related to tag categorization is the configuration of blocking third-party tags according to the visitor's choice. In other words, the cookie banner only allows a certain tag to be executed after the visitor's consent.

What does that mean?

Each visitor is free to choose whether or not to consent to that group of tags declared by the company. Therefore, their will is respected when cookies are only stored upon "free, informed, and unambiguous" consent (without ambiguity, clear, without equivocation).

**That's why AdOpt advises all users of the tool, without exception, to configure the blocking of third-party tags. Only with this configuration in place will the banner be complete and properly installed.**

Here's a tutorial for configuring the blocking of third-party tags on your website.

## Why do some websites don't block third-party tags?

It is not up to AdOpt to judge why a particular site, and even its clients, have chosen not to implement this configuration, even though it is constantly reinforced in our communication and classified as "essential."

Certainly, such a decision harms the image of both the company and even AdOpt. However, it is important to remember that prior to this setup, each tag has a unique function within each company, in its unique environment and context. Imposing a technological mechanism by AdOpt would go against the freedom of choice for its clients in the interpretation and application of the law that applies to everyone.

Keeping in mind the necessary proportions and equivalences, let's consider an example. It would be like holding vehicle manufacturers responsible for cars that have the capability to exceed the speed limit. The automaker can install alerts, reinforce communication in various ways. But they can never impose that a citizen does not drive according to their freedom of choice.

## Last point, as a golden rule!

**Always align the Actual Use of data with Processes, Documentation, and Communication.**

**Process: **The data collection declared for a specific purpose should indeed have the same destination and use of data within your company.

**Documentation**: Official documents should always be up to date and truly reflect the practices within the company.

**Communication**: The tag classified as Necessary or other classifications should indeed be necessary. The tag should not be classified as "essential" just because visitors cannot block it. This would be an attempt to bypass the freedom of individuals accessing your website.

The same market that creates classification standards for certain tags is also capable of judging the truthfulness of intentions and facts declared by your cookie banner on your website.

Always remember that people come before companies. The LGPD (General Data Protection Law) was created precisely to better balance the relationship between companies and citizens. After all, privacy is a universal right and should not only have value when it is lost.

---

Did you feel that something was missing or need further explanation?
Let us know at [hey@goadopt.io](hey@goadopt.io), and we'll be happy to discuss the topic further with you!


Best practices in tag categorization

Every day, millions of users generate data on the web, which is used by companies around the globe to improve their offerings. Therefore, in 2018, a law was created to regulate the use of personal data by companies, and this directly impacts digital marketing. We're talking about LGPD.

##What is LGPD?
LGPD stands for Lei Geral de Proteção de Dados (General Data Protection Law) in Brazil. It was sanctioned by interim President Michel Temer on August 14, 2018, after eight years of debates. The law came into effect in September 2020.

The focus of the law is not only to ensure transparency from companies that collect personal data but also to regulate the use of such data, aiming to uphold the right to privacy for all citizens.

According to the law, the user has the right to know the purpose and destination of the use of data such as:

- Name;
- Address;
- Location;
- IP address;
- Email;
- Phone number.

The data subject (you and me, as citizens, as named by the law) must have the option to consent or not to the use of their data, know the purpose for which it will be used, and have the right to request its removal if desired.

The use of cookies is also regulated by LGPD, so if you use services that utilize cookies on your website, be aware!

The law defines four principles that companies must follow, with the principles of purpose, adequacy, necessity, and transparency being the most important.

The principles of purpose and adequacy determine that data collection must have a specific purpose, meaning that the company cannot use the data as it pleases.

The principle of necessity relates to collecting the minimum necessary data for the company to achieve its objectives in digital marketing.

The principle of transparency ensures that users have access to the information collected and know where it is being sent.

##The impact of LGPD on digital marketing
Firstly, the institutionalization of LGPD does not mean that companies need to stop working with data.

Instead, it is time to analyze your Instagram Ads strategies, for example, and work to improve them not only in light of the new law but in relation to the business as a whole.

The focus from now on is to value transparency with all citizens.

Emphasizing that their consent is fundamental for all interactions will bring more security to both parties and ensure that business is conducted with more confidence.

Content marketing should gain strength. This is because companies need to treat customers as individuals and not just sources of data and metrics.

Investing in the production of relevant and personalized content is an excellent way to show that your brand truly cares about individuals, while also prioritizing obtaining data with consent.

Learn more about how to initiate the adaptation of your strategies to this new reality in the following section.

##Adjustments in digital marketing for LGPD

As you can see, LGPD creates new parameters for action for digital marketing companies. Adapting to it is as important for your strategies as knowing how to advertise on Google Ads.

There are a series of actions you can take without harming your business. Here are some of them:

##Obtain leads with legal support

Your leads need to be obtained based on the principles of LGPD. It is extremely important that the entire team is aware of them to ensure that the work performed does not violate the regulations.

Any action that involves third-party data (collection, access, use, storage, reproduction) must be based on user consent or another legal basis of LGPD, well-grounded, and based on the real needs of the data for the company's operations.

In case of non-compliance with the law, the company may have to bear fines of up to 50 million Brazilian reais or 2% of their annual revenue or the equivalent.

##Don't hinder user navigation
Valuing customer consent also involves allowing them to:

1. Leave your website whenever they want.
2. Navigate while fully or partially consenting to data collection and the use of cookies, for example.
1 Some websites limit navigation to consent, thus not allowing visitors to access restricted areas without consenting. However, this is a specific decision of that company and not a mandatory requirement. Consent should be free and not subjective or coerced.
3. Revoke consent at any time.
4. Access the data that your company may have about them.
5. Request the deletion of such data.

LGPD aims to improve the user experience on the web, and this should also be one of the focuses of every company.

Prioritizing spontaneous communication is the best way to ensure more conversions.

Filling the user's page with invasive advertisements and unpleasant pop-ups will only make them never engage with your brand again.

To delve deeper into the topics of navigation and user experience according to LGPD, research more about the concepts of privacy by design.

##Organize your segmentations
The creation of segmentations based on personal data, such as how Facebook Ads works, needs to follow certain parameters.

The point is to avoid practices considered discriminatory or invasive. This includes being intrusive in profile creation, manipulating customer expectations and desires, and taking advantage of people's vulnerability. And, as mentioned earlier, not using sensitive and irregular personal data for segmentation creation (e.g., uploading cold email lists).

Therefore, always be respectful and professional when identifying profiles. Do not cross the line of common sense.

It is necessary to combat the idea that LGPD came to hinder Brazilian digital marketing. In fact, its purpose is to regulate the activity to ensure that consumer rights are being respected.

Therefore, companies benefit from the increased trust that users place in them.

And this will only be possible when marketing professionals themselves have this vision in every decision within their processes and routines.

If you want to continue on this subject, we have an article on 10 marketing processes that should be reconsidered with LGPD.

LGPD for marketing | A practical guideline.

Now that we have the data flow within your company, we need to highlight 2 aspects of LGPD that will help you determine the extent of your responsibility in relation to the many points listed in the company. I'm talking about the difference between Data Controller and Data Processor.

##How to determine the differences between the parties?
A simple example would be the roles between a company and its marketing agency. In this case, the company would be the data controller and the agency the data processor because their functions are distinct in the chain of services and responsibilities.

##Always put yourself in the Data Subject's position.
For example, when the Data Subject goes to an e-commerce website to purchase a product, from their perspective, who are they entrusting their personal data to in order to make that purchase?

Can they know if the agency receives the lead and then enters it into the email marketing tool? No. Therefore, the e-commerce website becomes the data controller and the agency becomes the data processor. Each has their own role under the law, but all are co-responsible, in their respective functions, for the proper handling of the data of the Data Subjects.

Therefore, in your data mapping that we mentioned a few lines back, what is your role: data controller or data processor? Or, depending on your business model, both depending on the stage?

It is important for you to highlight this because, just as your responsibilities differ based on the role you perform, the way you handle a request for data deletion or data download is different. You may have the data on hand and the capability to deliver it to the Data Subjects.

However, it may also happen that you can only refer this power to the data controller, after all, you are just a link in the chain and do not have direct access to the data, but to some encryption that only provides you with anonymized visualization.

##More Examples of Data Controller and Data Processor - LGPD
Other common examples where there are different roles but clear co-responsibility for the data and its use include:

**Company <> Third-party Accounting Firm. Real Estate Company <> Third-party Brokers. Investment Fund <> Independent Agents. E-commerce Website <>Logistics companies and delivery services. Law firms <> Customer and employee qualification data.**

In conclusion, it is clear the importance of an accurate listing of all data controllers and data processors within your company's data mapping. With this information in hand, it is advisable to link all parties involved in the process according to your privacy policy and terms of use.

In the future, we can discuss the obligations prescribed by the law.

However, you can also consult directly with your lawyer, especially if you have any legislation that supersedes the LGPD.

In our next article, we delve into the responsibilities of the Data Protection Officer or Data Controller. 
See you there.

The Differences Between Data Controller and Data Processor - LGPD

Is there an ideal and _foolproof_ Privacy Policy?

This is one of the most difficult questions to answer nowadays. Especially considering all the jurisprudence already established in Europe with the GDPR, the extensive history of cases, and the numerous tips we see in the market. Not to mention the judicial decisions that are already emerging in Brazil with the LGPD.

I'll answer you promptly: No. And I'll help you understand why.

I believe it is possible to develop a line of reasoning that can assist each one of us entrepreneurs, DPOs, lawyers, third-party consultants, etc. Ultimately, everyone can have a clear understanding of how the game works to avoid being caught off guard.

Below is the logic behind a privacy policy and some principles to help you understand the game. Perhaps even assist you in adapting your company and addressing any doubts that may arise along the way.

What makes a privacy policy better or worse?

To be as straightforward as possible: Does it accurately reflect the reality of data usage and flow within the company?

Here is the key to understanding any privacy policy: It must truthfully reflect the motivations and data flow in the company's routines.

Therefore, before we evaluate the quality of a privacy policy, it is essential to understand why it exists and its purpose. Is it becoming clearer?

In a simple and direct manner, I would highlight that a company's privacy policy is:

A public declaration of the objectives, interests, and responsibilities that companies have regarding the use and application of data, especially personal data, for the execution of their business model.

In other words, the guidelines provided in the privacy policy give us a real understanding of how that business operates regarding data usage and the actual commercial and/or legal purposes for which the data is used.

What do I need to know and map out to create my Privacy Policy?

In essence, it is not possible to structure a privacy policy without understanding the foundations of the business. Don't worry, I'm not complicating things for the sake of it, but rather showing you that without this knowledge, even a lawyer charging thousands of dollars per hour won't be able to assist you.

By the way, a good piece of information for you is that the privacy policy does not necessarily need to be written by a lawyer or in "legalese." According to the LGPD, before anything else, it must be clear, educational, and easily readable for the data subject. So, whether it's you, your lawyer, or anyone who understands the processes, purposes, or legislation of your market, it's all good. Prioritize readability, clarity, and the ability for any visitor or customer accessing your platforms to understand and interpret the information.

However, it is worth noting that we recommend at least seeking advice from a lawyer. There are certain criteria and potential complexities in the market that they can assist you with more adeptly. For example, the healthcare industry has specific legislation that already treats patient data differently, and therefore, it may sometimes supersede LGPD requirements.

We are in Brazil, my friend, so, as usual, everything depends on the specific circumstances.

Anyway, let's go through the essential points you need to know to create any privacy policy. Points such as:

1. ### Corporate structure;

2. ### Market sector;

3.### Relevant laws governing the activities of players in the market;

4.### Product and/or service portfolio;

5.### Revenue streams and distribution channels;

6.### Basic understanding of the company's organizational structure;
(Headquarters and branches, size, number of departments involved, decision-making hierarchy, etc.)

7.### Supply chain;

8.### Sales and after-sales service;

9.### Communication channels;
...

Without this initial detailed understanding, the privacy policy will be incomplete and consequently flawed.

For example, what good does it do if I state that I use data on Facebook, collect addresses, emails, and CPF (Brazilian individual taxpayer registry number) for signing up for my plan and for email marketing, with data disposal in case of opt-out, if there is a legislation in my market that requires me to store this data beyond the data subject's requests?

I believe it is clear now how much information we need to consider. However, this should not discourage you! In fact, it is precisely the knowledge of these processes, or in other words, the understanding of the entire operation, that will give you greater confidence to determine whether the privacy policy is "good" or not. Again, it must reflect the reality and day-to-day operations of the company.

One of the tools/processes that can help you confidently structure the privacy policy is Data Mapping. If you don't have one yet or haven't considered implementing it, I'll summarize it for you in the link below.

Data Mapping: The Life Jacket for LGPD

What is the ideal privacy policy for your company?

The Brazilian Data Protection Law (_LGPD - Lei Geral de Proteção de Dados_) emerged a long time ago and has since drawn attention from numerous professionals. However, it is not uncommon to find websites and companies that ignore it, as they seek time to adapt. In this regard, how long can we ignore LGPD?

**Well, it is no longer possible to ignore it.** This has been a reality since its approval. Furthermore, it has been enforced since 2021.

With that in mind, it has been several years since this law was introduced, which leaves no excuse for ignoring it. Moreover, ignorance of the law can bring significant consequences, like [fines](https://goadopt.io/blog/en/fines-in-lgpd/).

Therefore, the clock is ticking against those who have chosen to postpone the necessary adaptations imposed by LGPD. It is time to change your stance. How and why to do so will be explained below.

##But what exactly does LGPD require?

[LGPD](https://goadopt.io/blog/en/lgpd-general-data-protection-law/) is often mentioned, yet little is said about its actual requirements. However, it has become essential for online users and website owners to understand what it entails.

Only then can the true importance of this law be comprehended. But don't worry, we won't use legal jargon to explain it to you.

The [LGPD](https://goadopt.io/blog/en/lgpd-general-data-protection-law/) is a nationwide regulation that came into effect in 2020. Many expected it to be implemented later, as there were speculations about its postponement, as seen before.

However, that did not happen. In other words, LGPD has been a reality since 2020 and requires attention. Many believe that it only applies to companies and their websites. However, it governs how all legal entities, including companies, governments, NGOs, associations, churches, and various other organizations, handle the data of the country's citizens.

It is worth noting that [LGPD](https://goadopt.io/blog/en/lgpd-general-data-protection-law/) and all other privacy regulations do not only focus on digital data but encompass all types of data. Therefore, how a company handles an email provided on a website or on a clipboard matters! Similarly, this extends the care to not only the website's servers but also to files, cabinets, and notebooks that "store" such data.

In summary, all processes in your company that involve personal data in their workflows must be reevaluated and adapted.

Assuming that you already understand that every time you visit a website or take an online action, both your browser will record signals and the website will receive information about you. Let's reinforce that this cannot happen indiscriminately, right? That is precisely what the General Data Protection Law addresses. It ensures limitations on the use of personal data, whether on websites or any other environments.

(If you haven't grasped that we are talking about Internet Cookies, read about them here before proceeding.)

With this, the law aims to protect users' privacy and intimacy. It also ensures that they have a better understanding of how their data is used and the security measures taken by the company that has access to that information.

But it doesn't stop there. LGPD also introduces data classification concepts and specific safeguards regarding data breaches and handling.

Ultimately, this law aims to promote transparency between websites and users. It imposes measures that can ensure their security. Therefore, in summary, it establishes four crucial points regarding data protection:

- Appropriate handling and use of personal data.
- Request for authorization and/or revocation regarding data collection.
- Penalties for companies that fail to comply with the aforementioned measures.
- Freedom for all citizens to access their own data.

##Tic Tac: There's no more time to ignore LGPD, see the consequences of doing so
It should be clear to you by now that LGPD has brought forth a series of important issues that completely impact the way companies operate.

Now, bringing it into the digital environment we are currently in, it becomes even more crucial for companies to demonstrate transparency to their visitors and strictly adhere to authorizations and policies.

Although the law granted a transition period for companies until August 2021, that deadline has already passed. In other words, the application of penalties and fines under the General Data Protection Law is now possible for websites that fail to comply with its guidelines.

Therefore, if your website still doesn't have clear privacy policies, in the case of cookie usage, or a [cookie banner](https://goadopt.io/blog/en/cookie-banner/) that respects personalized authorizations, it is at risk.

The penalties under LGPD are quite severe and include warnings (less severe) and [fines](https://goadopt.io/blog/en/fines-in-lgpd/). For non-compliance, the [fine](https://goadopt.io/blog/en/fines-in-lgpd/) can be up to 2% of the company's annual revenue (with a maximum calculation base of R$ 50 million). Additionally, there are possibilities of sanctions that can block a company's database until they regularize their operations.

In this sense, continuing to ignore the law that regulates data security and protection is shooting yourself in the foot for your company.

By doing so, you put your website and your company at risk. Even in the best-case scenario of receiving only a warning, persisting in the error will affect your finances and the image of your website, as well as access to data that is crucial for your activities.

##How to adapt to LGPD and avoid problems with the law?
Ignoring LGPD is no longer an option since the deadline for compliance with the law has passed.

As we are currently in the digital environment, let's focus on how to help you in this process. After all, many companies nowadays have a significant portion of their processes and operations in the digital realm. Such as e-commerce, digital agencies, product launches, info product creators, startups, and more.

All the examples mentioned above rely on the use of personal data for marketing automation, landing pages, various tracking pixels with remarketing cookies, media campaigns, and so on.

In short, it is impossible to continue ignoring this law. But how can you put it into practice? Don't worry, we have prepared a basic step-by-step guide with some essential principles.

>Remember, LGPD is not just a checkbox on your website; it involves a change in processes and a culture focused on privacy. So, below are some tips. If you take them seriously, you will find some valuable further guidance at the end. (Some people are charging a lot for the information we provide here for free - you're welcome!)

>#Important _LGPD is not just a checkbox on your website; it involves a change in processes and a culture focused on privacy!_

##Plan your Compliance, "Know Your Mess."

First and foremost, it's impossible to talk about LGPD compliance without a plan. What does that mean? Understand that you'll never feel confident in what you're doing if you don't know where the data is, where it comes from, where it goes, who processes and uses it. Therefore, you need a [Data Mapping, here's an article ](https://goadopt.io/blog/en/data-mapping-or-data-inventory-lgpd/)that will help you understand what it is and how to create one.

You know when you're at the grocery store and you see a product out of place? It's kind of bizarre, right? It gives us an uncomfortable feeling, as they would say in the South of Brazil. So, seriously, dedicate some time to this, and you'll see that all the other steps will be simplified. You don't want to find a toothbrush in your sock drawer when the Regulatory Agency comes knocking at your door.

##Work on a privacy policy.

First and foremost, it's impossible to put LGPD respect into practice without developing a privacy policy. It provides comprehensive information on how the company collects data, how it uses it, with whom it shares it, its usage deadlines, and other details.

Likewise, it clarifies how data is stored and what precautions are taken to ensure security against leaks, for example. So, remember to use clear and accessible language and address all relevant points in detail.

What's the basis for writing a good policy? Guess what! Your Data Mapping from the previous point. So, don't skip the previous step, trust us!

Here's an article to help you with the [privacy policy](https://goadopt.io/blog/en/is-there-an-ideal-privacy-policy/).

##Use a cookie banner and configuration tool.

Remember that we're talking about digital companies, right? These companies have a very peculiar characteristic: the entry points for data are usually all digital. Therefore, it's much easier for us to control what goes through them! And even better, with the use of technology!

That's why your [Cookie Banner or CMP - Consent Management Platform](https://goadopt.io/blog/en/what-is-a-cmp/), when properly implemented, becomes practically a "Pareto of Compliance," those 20% of effort that solve 80% of the problems.

In other words, make sure your website has an appropriate cookie banner that helps you organize data from the moment of entry. The cookie banner won't be your silver bullet, but it will be an excellent start to keep things in order over time.

[Here's an article for you to better understand how an LGPD cookie banner works.](https://goadopt.io/blog/en/operation-of-cookie-banner/)

For that, rely on Adopt. Our team consists of experienced professionals in the market who provide all the assistance you need. Here, we help you [choose a cookie banner for your website.](https://goadopt.io/blog/en/how-to-choose-cmp-consent-management-platform/)

##Be cautious with information security.

Another important point for adapting your company and website to the Data Protection Law is to increase the focus on information security. Companies have always been responsible for leaked data, but now even more so! Therefore, let's work hard to prevent any leaks or resulting damages that can have serious consequences for companies and the individuals whose data is exposed.

Therefore, highlight the risks of leaks and security in your data mapping. Once again, dedicate time to these security criteria and processes. You won't regret having them mapped and controlled because, in times of chaos, the best feeling is knowing that you are prepared and know what to do!

##Be cautious with marketing actions.

Finally, also apply your care in applying LGPD to your marketing actions. After all, it's necessary to strictly adhere to using communications and campaigns only to those who have authorized their receipt, as well as other flows that are triggered through the use of personal data.

Here's another interesting article for you: [10 Marketing Processes You Need to Reconsider under LGPD](https://goadopt.io/blog/en/10-risky-processes-in-your-marketing/).

As mentioned before, these are just a few steps. If you want to delve deeper into compliance topics, the next article for you is [here](https://goadopt.io/blog/en/lgpd-meaning/).