One of the biggest dilemmas for those who start studying and understanding the LGPD more deeply is the realization that, as challenging as the compliance process may be, it is only the beginning. Yes, a series of changes and adjustments should now become part of the company's routine. There are several marketing processes involving personal data that you must reconsider now because of the LGPD!

Therefore, compliance with the LGPD goes beyond setting up a cookie banner or updating the [privacy policy](https://goadopt.io/en/blog/what-is-a-privacy-policy/). Depending on the size of your company, numerous processes need to be reviewed and adjusted to the new realities established by the law.

The bureaucracy may seem extensive and never-ending for companies. However, we always need to put ourselves in the shoes of visitors, data subjects. Remember, both you and I are data subjects before being companies or professionals – we are citizens! The LGPD's priority is precisely to empower data subjects so that they, as individuals, have full rights and access to the necessary information regarding the use of their personal data.

That's why we're here!

Let's be the professionals who see the legislation as a new opportunity to raise the bar, to apply our knowledge with quality and respect to our clients and visitors!

The LGPD has brought new rules, new marketing processes, new positions...

So, how can we not anticipate the new standards and the new quality references that will ultimately be perceived by our clients?

One of the beautiful concepts, such as Privacy by Design (we've already discussed it here on the blog), can and should always be brought to the forefront!

That being said, I want to help you! Below, then:

## The 10 marketing processes you should rethink because of the LGPD!

## 1 - Sharing data lists with suppliers and third parties (freelancers, real estate agents, salespeople...)

If by this point it's not already obvious to you, I don't know how else to make clear the risk of this type of sharing. After all, the visitor has provided their personal and sensitive data to the company. They have no way of knowing that you have numerous other people hanging on to your mailing list.

So be very careful with this practice! Especially if there is no confidentiality or liability agreement between the parties involved!

It may be that your business model requires this distribution of data, so reinforce it - clearly, in your policy and terms! Remember, when in doubt, prioritize privacy!

## 2 - Receiving customer email lists to upload to Facebook for matching and look-alike audiences.

Does this list have consent for Facebook actions? What is the origin of the list? You may have noticed that since GDPR, Facebook has already been questioning advertisers when they upload email lists... I wonder why, right?

Whether you are a marketing department or a third-party agency to the client, always question these lists and avoid extending the channels of direct communication with the customer as much as possible, as it may violate consent and/or the legal basis that supports the use of the data.

## 3 - Buying cold lists to send emails, SMS, and SPAM. (If it was a crime before, now it's even more so)

Who hasn't thought about "obtaining" a contact list, cast the first stone! Or even, who has never been approached by companies that sell these cold leads!

Lucky are those who generate quality content and transparency to the point where visitors trust the company with their data...

It's no wonder that email marketing tools have numerous warnings to avoid spam. It harms everyone's reputation, and the internet has no patience for spam, agree?

## 4 - Exchanging email lists for sending articles and newsletters with partners and clients.

(A practice that may seem innocent but can violate the rights of data subjects)

It may seem innocent, but it's only an appearance! Just like the points above, data subjects have entrusted their data for that exclusive purpose. Any interaction that goes beyond that can directly violate the rights acquired through consent and/or legal basis.

## 5 - The agency as a whole has access to clients/visitors' email lists.

(Access levels for sensitive data - responsibility contract)

Here we enter the realm of management and processes!
Several marketing tools allow us to create hierarchies within their user accounts. This is precisely because each person has their level of activity and responsibilities.

It is a fact that many companies today work with decentralized or even horizontal management. But when things go wrong, who will be held responsible? Avoid problems by reviewing approval levels and access to data according to your team's responsibilities. After all, the actions of one employee affect the entire organization, and this should be considered as a contingency.

## 6 - Hiring freelancers and professionals with high turnover without a data responsibility contract with clients.

(The infamous "flash drive")

This point is quite similar to the previous one bu,t has an even greater detail. Third-party professionals have limited or even extended responsibilities based on their contracts and the criteria they are bound to. So, every time a third party has access to your company's database, what security do you have over that data?

What guarantee does the data subject have when the data is exposed? Yes, it's basic! But there have been many cases of Employee X or Agency Y who deleted everything before leaving or took everything with them. And then? Was there a contract?

## 7 - CTAs in campaigns and ads saying "leave your contact information below if you want to receive..."

This CTA (call-to-action) may seem "cheesy," but it is still widely used, and as they say, "if there's a rule, it's because there's a story behind it," meaning it works.

Be cautious with this kind of approach, especially if your audience is less tech-savvy and unaware of the risks of the internet.

Remember the case of people providing their data on a Facebook post to get a superhero credit card? Well, you don't want your company's reputation to be associated with an opening for scammers.

## 8 - Offline actions without a strong data collection guideline (legal basis) or associated consent.

The LGPD is not only applicable to the online environment.
So, which offline, in-person actions should also be adapted to comply with the guidelines? Do you use registration forms? What is the data collection process in physical environments?

Every company has its own reality, but I have seen companies using "offline" consent forms (actual printed forms) to be attached to visitor registrations! Or even collecting all registrations via tablets, where consent is also recorded in the CRM.

Our radar should be tracking both online and offline! If you bring everything online, for example, through QR codes, you can use the [AdOpt cookie banner](https://goadopt.io) as your consent tool and also implement tracking tags on the same landing page!

Perhaps this way, you can not only automate the opt-in process but also have authorized remarketing at the same time!

## 9 - Maintaining email just because.

The days when that Excel spread sheet full of emails from the 90s was considered a treasure for a company are gone.

Aside from being a vanity metric, it is also a significant cost within automation tools. Outdated and cold email lists pose a huge risk to the organization today. Avoid it, eliminate all of that, and make an effort to obtain updated consent from your active base as soon as possible!

Don't say I didn't warn you!

## 10 - Including personal data (such as personal cell phone numbers) in the Company's organizational chart without obtaining approval in the employment contract.

Some companies like marketing agencies, have their organizational chart, a source of joy for SDRs when making those old-fashioned cold calls and scheduling appointments for the Field Sales team! #WhoHasNeverDoneThat?

If you're not familiar with it, let me explain!

Many agencies, especially the larger ones in São Paulo/BR, still have the infamous "organizational chart" displayed at the reception.

Accessing this file brings great joy to the sales team because it not only reveals the decision-makers but also provides their contact information!

However, there is also a potential danger lurking here!

If your organizational chart contains not only employees' professional data but also the personal cell phone number of an employee who didn't want to use two phones, for example...

Is this sharing of personal data specified in the employment contract?

It may not be a problem now, but in times of crisis, labor law can utilize all available resources. Why wouldn't it consider this aspect as well?

In the end, our goal has never been to predict doom for companies or to be part of the LGPD's Apocalypse Cavalry. But since we've been in the market for some time, these kinds of issues always catch our attention when we start data mapping and having conversations with colleagues.

Do you remember any other processes that could be included in this list?

Comment below, maybe it will help colleagues in the journey of compliance!

## Continue learning about LGPD and marketing

These risks are easier to handle with a method. Start with [LGPD for marketing: a practical guideline](https://goadopt.io/en/blog/lgpd-for-marketing-a-practical-guideline/), see what the law means for [inbound marketing](https://goadopt.io/en/blog/lgpd-inbound-marketing-impact/), and check which [legal bases of the LGPD](https://goadopt.io/en/blog/legal-bases-of-lgpd/) support each of the processes above.

For agencies, see the [LGPD opportunity for digital marketing agencies](https://goadopt.io/en/blog/lgpd-opportunity-digital-marketing-agency/).


10 Marketing Processes You Should Rethink under the LGPD!

Every day, millions of users generate data on the web, which is used by companies around the globe to improve their offerings. Therefore, in 2018, a law was created to regulate the use of personal data by companies, and this directly impacts digital marketing. We're talking about LGPD.

## What is LGPD?
[LGPD](https://goadopt.io/en/blog/lgpd-general-data-protection-law/) stands for Lei Geral de Proteção de Dados (General Data Protection Law) in Brazil. It was sanctioned by interim President Michel Temer on August 14, 2018, after eight years of debates. The law came into effect in September 2020.

The focus of the law is not only to ensure transparency from companies that collect personal data but also to regulate the use of such data, aiming to uphold the right to privacy for all citizens.

According to the law, the user has the right to know the purpose and destination of the use of data such as:

- Name;
- Address;
- Location;
- IP address;
- Email;
- Phone number.

The data subject (you and me, as citizens, as named by the law) must have the option to [consent](https://goadopt.io/en/blog/consent-website-lgpd/) or not to the use of their data, know the purpose for which it will be used, and have the right to request its removal if desired.

The use of cookies is also regulated by LGPD, so if you use services that utilize cookies on your website, be aware!

The law defines four principles that companies must follow, with the principles of purpose, adequacy, necessity, and transparency being the most important.

The principles of purpose and adequacy determine that data collection must have a specific purpose, meaning that the company cannot use the data as it pleases.

The principle of necessity relates to collecting the minimum necessary data for the company to achieve its objectives in digital marketing.

The principle of transparency ensures that users have access to the information collected and know where it is being sent.

## The impact of LGPD on digital marketing
Firstly, the institutionalization of LGPD does not mean that companies need to stop working with data.

Instead, it is time to analyze your Instagram Ads strategies, for example, and work to improve them not only in light of the new law but in relation to the business as a whole.

The focus from now on is to value transparency with all citizens.

Emphasizing that their [consent](https://goadopt.io/en/blog/consent-website-lgpd/) is fundamental for all interactions will bring more security to both parties and ensure that business is conducted with more confidence.

Content marketing should gain strength. This is because companies need to treat customers as individuals and not just sources of data and metrics.

Investing in the production of relevant and personalized content is an excellent way to show that your brand truly cares about individuals, while also prioritizing obtaining data with consent.

Learn more about how to initiate the adaptation of your strategies to this new reality in the following section.

## Adjustments in digital marketing for LGPD

As you can see, LGPD creates new parameters for action for digital marketing companies. Adapting to it is as important for your strategies as knowing how to advertise on Google Ads.

There are a series of actions you can take without harming your business. Here are some of them:

## Obtain leads with legal support

Your leads need to be obtained based on the principles of LGPD. It is extremely important that the entire team is aware of them to ensure that the work performed does not violate the regulations.

Any action that involves third-party data (collection, access, use, storage, reproduction) must be based on user consent or another [legal base of LGPD](https://goadopt.io/en/blog/legal-bases-of-lgpd/), well-grounded, and based on the real needs of the data for the company's operations.

[In case of non-compliance with the law, the company may have to bear fines of up to 50 million Brazilian reais or 2% of their annual revenue or the equivalent.](https://goadopt.io/en/blog/fines-in-LGPD/)

## Don't hinder user navigation
Valuing customer consent also involves allowing them to:

1. Leave your website whenever they want.
2. Navigate while fully or partially consenting to data collection and the use of [cookies](https://goadopt.io/en/blog/lgpd-cookies-all-you-need-to-know/), for example.
- Some websites limit navigation to consent, thus not allowing visitors to access restricted areas without consenting. However, this is a specific decision of that company and not a mandatory requirement. Consent should be free and not subjective or coerced.
3. Revoke consent at any time.
4. Access the data that your company may have about them.
5. Request the deletion of such data.

LGPD aims to improve the user experience on the web, and this should also be one of the focuses of every company.

Prioritizing spontaneous communication is the best way to ensure more conversions.

Filling the user's page with invasive advertisements and unpleasant pop-ups will only make them never engage with your brand again.

To delve deeper into the topics of navigation and user experience according to [LGPD](https://goadopt.io/en/blog/lgpd-general-data-protection-law/), research more about the concepts of privacy by design.

## Organize your segmentations
The creation of segmentations based on personal data, such as how Facebook Ads works, needs to follow certain parameters.

The point is to avoid practices considered discriminatory or invasive. This includes being intrusive in profile creation, manipulating customer expectations and desires, and taking advantage of people's vulnerability. And, as mentioned earlier, not using sensitive and irregular personal data for segmentation creation (e.g., uploading cold email lists).

So, always be respectful and professional when identifying profiles. Do not cross the line of common sense.

It is necessary to combat the idea that LGPD came to hinder Brazilian digital marketing. In fact, its purpose is to regulate the activity to ensure that consumer rights are being respected.

Therefore, companies benefit from the increased trust that users place in them.

And this will only be possible when marketing professionals themselves have this vision in every decision within their processes and routines.

If you want to continue on this subject, we have an article on [10 marketing processes that should be reconsidered with LGPD.](https://goadopt.io/en/blog/10-risky-processes-in-your-marketing/)


LGPD for marketing | A practical guideline.

João Bruno Soares

Since September 2020, companies' online actions regarding the data of their suppliers, customers, and employees require greater care. This was the milestone since the General Data Protection Law ([LGPD](https://goadopt.io/en/blog/lgpd-general-data-protection-law/)) came into effect. Therefore, LGPD also has an impact on inbound marketing.

And for those who have not yet adapted, time is up! Since August 2021, [LGPD](https://goadopt.io/en/blog/lgpd-general-data-protection-law/) the a grace period for compliance ended, and now the consequences are in effect!

In other words, currently, those who do not operate in accordance with LGPD's provisions risk facing penalties ranging from warnings to the suspension of their website, databases, and hefty fines. To prevent this from happening to your website, keep reading and learn how to adapt it, along with inbound marketing, to [LGPD](https://goadopt.io/en/blog/lgpd-general-data-protection-law/).

## LGPD requires a review of the marketing you promote - Understand why

The [General Data Protection Law](https://goadopt.io/en/blog/lgpd-general-data-protection-law/) was approved back in 2018, although it only came into force last year. This norm imposes a series of obligations that apply to websites, companies, and organizations in general. It actually affects all types of institutions that have access to and use personal data, such as names, addresses, CPF, phone numbers, etc.

Its goal is to ensure transparency and fairness in how a page with its visitors, for example, uses their data! After all, concerning online data, consider that websites capture information about the users who visit them and also those who use their services.

This data capture occurs in various ways. For example, forms, newsletter registrations, downloading of rich content, whether for informative or commercial purposes. Oh, and cookies as well. Also, through digital marketing tools like Google Analytics.

Thus, LGPD requires that marketing actions aimed at collecting data be reviewed. After all, according to the law, users must now be informed about the types of data the website collects, how it uses them, the purposes for which it applies, the usage period, and - no less important - provide a channel for citizens to request the removal of their data whenever possible.

And all of this, of course, must be done with the user's consent and permission, for those who use [Consent as a Legal Basis](https://goadopt.io/en/blog/legal-bases-of-lgpd/), and/or well-founded in other legal bases in your industry, and/or complementary. Thus, such compliance and direction must also be expressed so that the page safeguards its rights to use this data, in accordance with the law.

> It's worth noting - The use of personal data has not been prohibited but regulated. Therefore, its use requires adaptation and compliance with certain requirements set forth in the law.

## And where does inbound marketing fit into this?

LGPD brought requirements regarding transparency and the possibility of using data by everyone, including websites. Therefore, data capture is now under greater control, so that everyone can have an idea of how their data is used and the limits of that use.

That's why it directly affects inbound marketing, i.e., attraction marketing. It encompasses all the actions your company takes to attract the attention of potential customers who, when they become interested in your content, services, or products, sign up or make a purchase. In other words, it's for lead generation.

For example, when you have a landing page for a product or service. Or when you offer exclusive content, such as videos or e-books, in exchange for registration. Similarly, in contact forms.

All of this involves the use of consumer data, right? Therefore, it also requires clarity regarding the use of this information and the precautions taken to maintain the individual's security and privacy.

So, note that everything related to data capture must be explained to the visitor or customer. And this should be done through a [Privacy Policy](https://goadopt.io/en/blog/ideal-privacy-policy/) that provides all the information on how the data is processed and stored. And if your service is offered in the digital environment, clarity in the Terms of Use is also essential.

## What to do to adapt inbound marketing to the General Data Protection Law

As mentioned earlier, the deadline for adapting pages and their actions regarding user data, according to LGPD, has already ended. Therefore, now all those that are not in compliance with the law are in a risk zone. This risk may not necessarily be completely eliminated, but it can be controlled and well managed.

But how do you adapt your inbound marketing actions according to LGPD to avoid fines and warnings, as well as suspensions? That's what you'll find in the items below, so be sure to check them out and, most importantly, implement these solutions.

### Ensure that only strictly necessary data is collected

First and foremost, your marketing must ensure that it is only collecting data that is truly necessary for the actions to be performed. For example, in a sale, you will need to know card data, CPF, full name, and address.

On the other hand, there is no sense in requesting specific data such as race, sexual orientation, religious or political preferences. All of this is irrelevant for the action you intend to take, so collecting and using data like these is not justified.

When the goal is privacy, less is more - literally.

### Lead capture and specific authorizations for each purpose

Similarly, understand that each specific lead will have specific authorizations. But what does that mean? Consider that a visitor to a page subscribes to receive informative content you produce. In this case, authorization relates solely to this type of sending.

Therefore, in this case, you cannot use the registration data to send advertisements for products and services you have or offers you provide. After all, this goes beyond the reason the consumer gave their data.

So, consider that every time there is a subscription for an action, there will be a specific authorization for that purpose. The consumer must give authorization for each act in which their data is disclosed.

In this way, consider that a subscription for informational purposes has an authorization that demonstrates the specific purposes of use; another one for registering for offers; and another one for registering for a purchase.

Unfortunately, many companies register email addresses delivered for other purposes in their newsletters. This should not be done!

Here we have another article to help you with the adaptation of these [digital marketing processes](https://goadopt.io/en/blog/10-risky-processes-in-your-marketing/) that go beyond inbound marketing; it's worth taking a look if you are new to this.

### Have a clear privacy policy regarding data use

Furthermore, it is essential that your company has a clear and concise privacy policy!

Many companies choose to include it along with the [cookie banner links](https://goadopt.io/en/blog/how-to-choose-a-cookie-banner-for-your-website/), but that's a matter of preference and taste. Avoid legalese, don't create mazes for your readers, and focus primarily on the accuracy of the information. After all, a policy, when accepted, has implications for both parties, so fulfill what is stipulated there.

Here we have some articles to help you review and understand privacy policies. After all, [what is a privacy policy](https://goadopt.io/en/blog/what-is-a-privacy-policy/) and is there [an ideal policy for your company](https://goadopt.io/en/blog/ideal-privacy-policy/)?

### Some metrics will be directly impacted.

One of the main metrics that is impacted by LGPD, specifically by the use of a properly configured Cookie Banner, is Analytics metrics. This happens because the cookie banner, or CMP, must allow the firing of each service's cookies only after the user's consent is given in that specific banner.

> [Understand how a LGPD cookie notice works](https://goadopt.io/en/blog/operation-of-cookie-banner/)

As the vast majority of visitors reject or simply ignore them, not all visitors to your site give consent to Analytics. Therefore, the numbers will drop significantly. It is estimated that only 1 in every 5 visitors gives consent.

So, don't despair because this is expected, and there are other solutions for analytics that do not use cookies and/or trackers that are blocked in the banner, respecting privacy. One of them is Cloudflare, which, in addition to its performance services, can also provide analytics estimates.

Of course, it will not be of the same quality and traceability as Google Analytics, but you can create a multiplier based on the difference found to analyze the discounted numbers more accurately.

### Marketing automation must be in compliance

Once the importance of using personal data only for the purpose for which it was actually collected/accessed has been emphasized, it is necessary to highlight that your marketing automation tools must reflect these purposes. Therefore, review your automations and be sure to include them in your Privacy Policy since many of them not only process and store data but also trigger cookies.

Knowing that many companies use their automation tools as CRMs, in fact, with a repository of company data as a whole, avoid storing unnecessary or outdated data. Always seek to clean up useless or "cold" data, which means data that has no consent or has been in the system for a long time.

Remember, having a database with millions of contacts is of no use if it is not engaged and if it has been accessed in a way that is currently illegal. Attention! This number can be a vanity metric, and if its use is not supported by a legal basis, it is wrong.

Therefore, your effort should be to always keep the database active and appropriate. One way to speed this up is to link the consents generated by your site's cookie banner to the registration of personal data of your visitors in your CRM.

Many of our clients already do this, which helps even in responding to customer requests.

With the help of a programmer, access the [AdOpt Call-Backs](https://goadopt.io/en/support/callbacks-api/callbacks/adopt-callbacks-endpoints/) and link the data generated by AdOpt to your site's form submissions. So, every time someone fills out the form, AdOpt will also provide the AdOptID for a hidden and custom field in your form, feeding the CRM with that information associated with the provided data.

Then, with campaigns to encourage visits to linked pages, you can use the AdOpt tool as an additional layer of security, through the generated consent, now attached to that lead.

These were just some points for those looking to start the [adaptation of their marketing to LGPD](https://goadopt.io/en/blog/lgpd-for-marketing-a-practical-guideline/). So, if you have any questions or even suggestions for more points that we can list here to help in this process, send them to us!



The impact of privacy regulations, like LGPD, GPDR... on Inbound Marketing

Have you ever noticed that every time you sign up for a service to access information or register on a website for purchases, you need to give consent? If you're wondering why you have to give consent on every website you visit, you'll find the answer here.

Even though this consent is often "automatic" and happens without you thinking about it (which it shouldn't), it is very important. After all, it is a [legal requirement](https://goadopt.io/en/blog/legal-bases-of-lgpd/) that applies to the website and pertains to the security of your data.

Since data is becoming increasingly important and data breaches can cause significant harm, understanding what you're consenting to and what it means is indispensable. So don't miss the opportunity to learn more about this topic!

## With LGPD, Silence Doesn't Imply Consent

To understand how consent has become so important regarding data collection and use in the online environment, we need to go back to August 2020. That was the month when the [General Data Protection Law (LGPD)](https://goadopt.io/en/blog/lgpd-general-data-protection-law/) came into effect.

It was introduced as a response to the need to protect data shared on websites and collected by web pages, as well as to regulate their processing. Notably, in recent years, massive data breaches of personal information, such as the Facebook breach, have alarmed users.

Therefore, privacy laws like [GDPR, LGPD, CCPA](https://goadopt.io/en/blog/gdpr-lgpd-and-ccpa-what-are-these-laws-similarities-and-differences/) have consolidated the notion of consent for data usage. In other words, all websites that use cookies and collect data from their users for any purpose (such as marketing) not only need to inform but also ensure agreement.

This happens when you access a website and need to grant permissions for cookies, for example. Even though cookies are just one form of information collection, they are a good example of consent.

The same thing happens when you access a page where you need to enter personal data. For example, when subscribing to a newsletter and landing pages. Similarly, when registering for a purchase. In these cases, there's always a box that says "I agree to the [terms of use](https://goadopt.io/en/blog/terms-of-use-lgpd/) and [privacy policies](https://goadopt.io/en/blog/what-is-a-privacy-policy/), " right?

Know that in all these cases, consent is given for the use of your data. It relates to the company's security and information treatment policies, as well as which data is used, when, how, and for how long.

Of course, there are other [legal bases](https://goadopt.io/en/blog/legal-bases-of-lgpd/) that also ensure the correct use of citizens' data. However, for many, consent ends up being the quickest and most accessible option in their business flow.

[**### Discover how to adapt your digital marketing to LGPD.**](https://goadopt.io/en/blog/lgpd-for-marketing-a-practical-guideline/)

## What is the importance of the consent policy for the website and the visitor?

The consent that you might be tired of giving - but shouldn't, as it concerns your security - is important for both websites and you, as well as other visitors and users.

Well then, let's start with the visitors because the preference is theirs! For them, consent is important because it's only through it that the companies behind the websites can use their data. They can use it only within the limits stipulated, both in terms of time and application.

So, if you have the habit of giving consent to websites without carefully reading the terms beforehand, it's time to change that approach! The use of your data is important and relates to your security (including financial security!).

Therefore, it's important to be aware of what you're allowing and what the company's policies are for protection purposes.

In this sense, it's necessary to pay attention to two different text documents: the Terms of Use, regarding the rules of service utilization responsibility and limits of duties and rights; also, the Privacy Policy, which concerns the treatment of information and security details.

On the other hand, the consent you give to websites is also important for them, obviously. After all, this is the only way they can really use the data (within the informed and consented limits) in accordance with LGPD.

Learn more about [how the cookie banner work](https://goadopt.io/en/blog/operation-of-cookie-banner/)!

Moreover, LGPD imposes significant [penalties](https://goadopt.io/en/blog/fines-in-LGPD/) on those who violate it. In this regard, it can impose warnings as well as fines that can be quite high! It can also lead to restrictions on data collection and the banning of the page.

## What types of pages need to obtain visitor consent?

The vast majority of websites that collect data in some way and use cookies need to obtain consent from their users. There are various types of data collection, ranging from cookies to voluntary information acquisition through page registrations.

In this sense, all pages that use tools for analyzing results and metrics, such as Google Analytics, already have a duty to obtain consent from their visitors for this.

Similarly, landing pages, contact pages with user information disclosure, and other data registration forms will always need policies of agreement regarding data collection and usage.

Especially when, according to the company's business model, other [legal bases](https://goadopt.io/en/blog/legal-bases-of-lgpd/) are weaker in terms of data usage rationale. Thus, consent ends up being an excellent option.

## Cookie Banner

Firstly, one of the methods for obtaining consent is through the Cookie Banner, right on the page.

In this case, the page's opening must clearly inform the use of cookies and allow the visitor to configure their preferences and give their permission. Only after consent, the cookies can be triggered.

[### **How to configure third-party cookie blocking in AdOpt?**](https://goadopt.io/en/support/essential-steps/tag-blocking/manual-blocking-of-third-party-tags/)

For this purpose, your website can rely on AdOpt. With our tool, your cookie usage policies are always clear to the user. In addition, alongside the banner, you can configure the blocking of third-party cookies, multi-languages and legislations, text customization, positioning, colors, and images.

[_Have you heard of the ROPA document in LGPD?
It's essential and can help you a lot in your compliance!_](https://goadopt.io/en/blog/ropa-for-lgpd/)

## Terms of Use and Privacy Policy Notices

The other method of applying consent policies on a website is precisely on pages dedicated to contact forms, landing pages, and site registration. Using those "I have read and accept" checkboxes.

In this case, it is essential that the user has access to the documents that reveal them and that they must allow the use of such information before continuing their online action.

Therefore, always make sure that these notifications halt the process. This way, only data that truly has the visitor's consent is collected.

If you are an [AdOpt](http://goadopt.io/) customer, our technology allows this online form consent collection to be integrated into the platform as a whole. This means that your CRM has another field fueled by visitor consent.

Want to know how? Just chat with us or schedule a presentation conversation [here](https://meetings.hubspot.com/murilo-andrade/adopt-meeting1-murilo).


Why Give Consent on Every Website I Visit?

Have you ever thought that your marketing agency could find a great business opportunity in [LGPD](https://goadopt.io/en/blog/lgpd-general-data-protection-law/), GDPR, CCPA...?

Well, unlike what many think, it brings changes that can accelerate the demand for the services of these companies.

After all, the new privacy regulations like the GDPR, CCPA, and the LGPD ([General Data Protection Law (LGPD)](https://goadopt.io/en/blog/lgpd-general-data-protection-law/)) - as it shouldn't be news to anyone - has brought significant changes to how companies handle third-party data. This applies to data processed on the internet or not.

And marketing is one of the areas directly affected by the new rules because its digital operations depend on third-party data, which is precisely the focus of the LGPD, for example.

So, how about learning more about how to leverage this new law to create opportunities in the field of marketing?

To do that, keep reading and see everything about the subject below!
(I'll keep using the LGPDas an example, but, the same logic applies to any privacy regulation.)

## LGPD Doesn't Mean the End of Digital Marketing, Quite the Opposite

Like other novelties, the [emergence of LGPD](https://goadopt.io/en/blog/lgpd-general-data-protection-law/) has also brought many rumors, created legends, and generated a lot of apprehension! After all, it changes how data was previously treated and introduces new obligations.

[LGPD](https://goadopt.io/en/blog/lgpd-meaning/) aims especially at transparency regarding data usage, as well as using data in accordance with the consent of the data subject and within the limits of this authorization.

For this reason, many believed that it would bring an end to the golden age of digital marketing. After all, it requires user information, which, in turn, requires their consent.

Considering the various accesses and actions that occur on web pages, as well as the numerous impressions and reach that marketing aims for, this seemed impossible.

However, it's not.

It's possible to organize digital marketing in accordance with the General Data Protection Law in a way that it continues to generate leads and attract customers and interested parties. Below, I've included an article to help you on this journey:

[### TIP: 10 marketing processes you should reconsider due to LGPD.](https://goadopt.io/en/blog/10-risky-processes-in-your-marketing/)

## Significant Changes for Marketing Have Emerged with LGPD

Marketing hasn't died, but that doesn't mean it doesn't require updates in its tools and how it operates.

For example, consent will always be present in the collection of any data that the user provides, either directly or indirectly. It is only with consent that a company can use the information for any purpose, including marketing.

Certainly, other [legal bases of LGPD](https://goadopt.io/en/blog/legal-bases-of-lgpd/) serve as the foundation for data permission and usage. But, in any case, consent ends up being a part of all of them since at some point in the data flow, the individual consented to providing that product/service.

Similarly, the use of this data must always be clear, whether the user voluntarily provides their information (such as in form submissions) or if it's collected automatically through cookies and other tools.

In this sense, it's important to keep in mind that marketing only succeeds when it has data to guide its actions, including now the confirmation that proves the data was collected regularly.
Therefore, this data can only be collected and used after the user is notified of it and grants their consent, or through another legal basis.

To obtain consent, numerous tools are available, as we'll see next.

[### Learn more about adapting digital marketing to the General Data Protection Law.](https://goadopt.io/en/blog/lgpd-for-marketing-a-practical-guideline/)

## Outsourcing Marketing Becomes an Interesting Option, Provided Agencies Know How to Handle It

So, you might be wondering: Ok, LGPD brought changes regarding marketing. But where do agencies fit into this?

Many companies choose to conduct marketing activities themselves or even outsource a large portion of them. In any case, the service needs to be done and now fully compliant with LGPD. That is, whether they are internal actions or third-party actions conducted by specialists, all must adjust.

This leads to a series of new demands, routines, and daily processes that someone will have to be responsible for.

### Can some of the new demands created by LGPD become part of the agency's service portfolio?

We already know that simply ignoring them can lead to [fines and sanctions under LGPD](https://goadopt.io/en/blog/fines-in-LGPD/) which can require significant amounts of money and even lead to the suspension of the website or database.

Furthermore, there's another very important aspect for marketing agencies regarding LGPD. After all, as of LGPD, captured data will only be what's consented, which provides a rich ground for campaigns.

In other words, the law requires data to be collected with the user's authorization, which they provide voluntarily.

This means that marketing now has data that genuinely directs it toward those who are already interested in the company's services or products and are engaged!

Therefore, LGPD is an opportunity for marketing agencies in that they can present themselves as experts in adapting product promotion and customer acquisition strategies to comply with the law!

## Develop a Marketing Policy Based on LGPD
Agencies have various ways to adapt marketing strategies. For example, here are some of the tools that need to be reviewed:

- Marketing emails;
- Sponsored ads;
- Forms;
- Landing pages, and more.

Note that all these tools collect user data, whether through the use of cookies or by requesting contact information (among others) to access information, promotions, and products.

Therefore, all of them should follow the development of a policy that makes it clear to the user that this data will be used, as well as the limits of data usage.

A good [LGPD tool](http://goadopt.io/) is the [cookie banner](https://goadopt.io/en/blog/how-to-choose-a-cookie-banner-for-your-website/) that asks for a "check" before data is sent and consent is granted, among other things.

[Learn more about how a cookie banner works!](https://goadopt.io/en/blog/operation-of-cookie-banner/)

## Other LGPD Adaptations Beyond Digital Marketing

Furthermore, it's important to consider the website itself, where advertising pages can drive user traffic.

In this case, it's interesting for the website to be equipped with a tool that presents all the company's policies regarding data usage in one place.

That is, the Terms of Use, Privacy Policy, and also the Cookie Policy. In this case, all of them provide information about data usage and related information.

[Learn everything about the Privacy Policy, how it works, and its requirements!](https://goadopt.io/en/blog/what-is-a-privacy-policy/)

For this, count on AdOpt! Our tool works by granting a tab as a pop-up that opens on your website every time someone accesses it.

There, it's possible to access the website rules, data usage policies (in their various forms), and consent collection.

[Learn more about the Cookie banner, its advantages, and how to use it.](https://goadopt.io/en/blog/operation-of-cookie-banner/)

To go further, see also [Meta Pixel Consent: How to Run the Pixel Under GDPR and CCPA](https://goadopt.io/en/blog/meta-pixel-consent-gdpr-and-ccpa/).


LGPD: An Opportunity for Digital Marketing Agencies!

How does your website handle privacy regulations like [LGPD](https://goadopt.io/en/blog/lgpd-general-data-protection-law/), CCPA, GDPR...?

What strategies does it use to comply with the any of them?
Have you thought about using a [cookie banner](https://goadopt.io/en/blog/why-are-cookie-banners-everywhere/) but don't know if your site has [cookies](https://goadopt.io/en/blog/lgpd-cookies-all-you-need-to-know/) or if it's enough? If you can't answer these questions, be cautious! Your page may be exposed to fines and other sanctions.

Below, check out 5 signs that indicate your strategies either don't exist or aren't working as they should. So keep reading to ensure the necessary compliance of your site with the principles of the law that regulates data consent.

## 5 Signs You Need a Cookie Consent Strategy Right Now

Check out the top 5 signs that your website isn't in compliance with privacy regulations and then see how to start your adjustment!

## 1 - You Have No Control Over the Data You Collect and Use
This is an undeniable sign that you need to reconsider how you view LGPD, GDPR, CCPA, etc. After all, it regulates the use of third-party data.

It requires respect for user privacy and their consent. Therefore, data usage should always be informed. Not only that, but also the purposes to which it is directed, the way it is stored, and the period of use.

So, consider that if you don't know what data you collect, how will you inform the visitor? Furthermore, how will you ensure that the use of this information complies with the limits imposed by the data subject?

These are important questions that indicate that something is not right on your website regarding privacy and its requirements.

LPs created without control, rich content available for download without accepting terms and policies, mailing lists being shared and passed from campaign to campaign... Be cautious!

I've separated this article for you, in case this is your situation:

[Understand the meaning of LGPD for your company.](https://goadopt.io/en/blog/lgpd-meaning/)

## 2 - There's No Information About the Use of Cookies

Cookies are another type of data that, in principle, should be informed by websites to their visitors. After all, they also capture information about these data subjects and, therefore, fall within the concept of data usage that any privacy regulation addresses.

The use of cookies is almost natural for most websites, especially if they come from e-commerce platforms, for example.

_### To check if your site triggers cookies, access it from a computer and - in Google Chrome, click on the padlock just to the left of the address. It should show exactly which ones and how many there are._

However, many pages fail to see cookies for what they really are: data files and personal information. Therefore, the absence of this communication to your site's visitors is dangerous as it can be a violation of the law.

In fact, not just that, but the collection of them without prior consent is also a violation. You know that "We use Cookies" pop-up? Well, it's not there for no reason.

It's a way to comply with GDPR, CCPA,LGPD... as it informs the use of this type of file while capturing authorization to use them.

- In this article, I help you understand more about [consent as a Legal Basis.](https://goadopt.io/en/blog/legal-bases-of-lgpd/)
- In this one, [how to choose an appropriate CMP - Consent Management Platform for your website.](https://goadopt.io/en/blog/how-to-choose-cmp-consent-management-platform/)

## 3 - Generic Privacy Policy and Terms of Use

Your site probably has documents such as Privacy Policy and Terms of Use. They inform, respectively, the use of visitor data (and capture authorization for it) and the prevailing rules, rights, and duties.

Therefore, they are very important, especially in the times of privacy regulations!
They stand out for their informative content to promote transparency with the data subject.

It is up to the data subject, then, to accept or not the conditions therein. In this sense, it is worth noting that the site may suspend access to some services, for example, due to a lack of acceptance of the rules and conditions. And that is natural since some of them are only possible with the authorization to use certain data.

Either way, these are important documents. But they shouldn't just be there. They should be specific to what the site offers and how it operates. So if you made your terms and policies based on Ctrl C + Ctrl V, pay attention!

It's time to review these documents and rewrite them to make them compatible with the reality of the site. Also, to fill gaps and clarify data usage. Below, I've separated a few more articles for you:

- [What is a Privacy Policy?](https://goadopt.io/en/blog/what-is-a-privacy-policy/)
- [What's the Ideal Privacy Policy for Your Company?](https://goadopt.io/en/blog/ideal-privacy-policy/)
- [What are Terms of Use in LGPD?](https://goadopt.io/en/blog/terms-of-use-lgpd/)

## 4 - Data Loss or Data Breach

When it comes to data loss, it's time to sound the alarm. Data breaches are a clear sign that your privacy compliance strategy needs urgent correction or revision.

After all, it should be developed to maintain the confidentiality of data and their use in accordance with the data subject's consent or the [legal basis](https://goadopt.io/en/blog/legal-bases-of-lgpd/) chosen. Also, to ensure the protection of this information.

Data breaches are compromising! They can tarnish the company's reputation and often that of its customers and suppliers as well. Furthermore, the company can be held responsible for them and, as a result, face significant sanctions, including hefty fines.

[**Understand the difference between Data Controller and Data Processor here.**](https://goadopt.io/en/blog/differences-data-controller-data-processor/)

And it's not just data loss itself. The lack of a clear plan of action in the event of information leaks is also an indication that you urgently need to work on your LGPD strategies. Below are some more articles to help you with this review:

- [Data Mapping or Inventory in LGPD, the DPO's life jacket.](https://goadopt.io/en/blog/data-mapping-or-data-inventory/)
- [How to Adapt Your Marketing to LGPD](https://goadopt.io/en/blog/lgpd-for-marketing-a-practical-guideline/)
- [10 Risky Processes in Your Marketing](https://goadopt.io/en/blog/10-risky-processes-in-your-marketing/)

## 5 - Absence of Designation of a Data Protection Officer

Finally, the last sign that your website needs an LGPD, GDPR, CCPA strategy is the absence of the designation of a Data Protection Officer or DPO (Data Protection Officer) for the processing of data on your site.

This figure is a requirement of LGPD, GDPR, CCPA and, according to the laws, is responsible for controlling and managing data processing. They carry out tasks determined by the Data Controller.

They are also the ones who handle complaints from personal data subjects, provide explanations, and communicate with them. Similarly, they control the entry and exit of consents, so they take the necessary actions to ensure compliance with authorizations. In this article, I explain more about [the responsibilities of a Data Protection Officer or DPO in LGPD.](https://goadopt.io/en/blog/responsibilities-of-a-data-protection-officer/)

## So, how about adapting your site to LGPD, GDPR, CCPA?

If you have recognized that your site falls into any of the signs above, it's a sign that you should take action to align it with the law. Otherwise, you may face [fines](https://goadopt.io/en/blog/fines-in-LGPD/) and other penalties that could even lead to the suspension of your page's activities.

Not to mention the impact on your brand's image in the eyes of the public, as someone who could care more about data privacy.

So, it's more than time to review your privacy strategies in the face of LGPD, GDPR, CCPA... For this, count on [AdOpt](https://goadopt.io/), which helps you not only organize them but also control the entry and use of data, as well as consents about them.


5 Signs Your Website Needs an Cookie Consent Strategy

Compliance doesn't have to be a nightmare, whether you are a marketing professional or a **[Data protection officer](https://goadopt.io/en/blog/responsibilities-of-a-data-protection-officer/)**, making simple mistakes can easily ruin your brand's reputation.

Facing million-dollar **[fines](https://goadopt.io/en/blog/company-fined-the-end/)** and losing user trust are the biggest risks today. Everything starts with how you manage **[cookies](https://goadopt.io/en/blog/lgpd-cookies-all-you-need-to-know/)** at the front door of your website.

We are here to simplify this for you. Let's dive into the five biggest market mistakes and how a solid **[Cookie notice/banner](https://goadopt.io/en/blog/operation-of-cookie-banner/)** solves this on autopilot.

## How to Avoid GDPR and CCPA Legal Issues

The global privacy landscape is changing extremely fast. Because of that, knowing if your **[website needs cookie consent](https://goadopt.io/en/blog/website-needs-cookie-consent-gdpr-lgpd-ccpa/)** is no longer a choice, it's a mandatory rule.

Tech giants have paid millions in **[fines](https://goadopt.io/en/blog/gdpr-lgpd-and-ccpa-what-are-these-laws-similarities-and-differences/)** just for ignoring basic transparency and data tracking guidelines.

The good news is that you don't need to pause your operations. Our technology protects everything, from your blog to your **[e-commerce](https://goadopt.io/en/blog/impact-ecommerce-lgpd/)**, without any headaches.

Common Issue: Unclear Cookie Banner Text
Many businesses rely on cookie consent notices filled with confusing or vague language. Here are some common pitfalls:

![common-privacy-dark-patterns.png](/uploads/common_privacy_dark_patterns_1a54e06b8c.png)

### 1. Confusing Consent Text

Using technical jargon or generic text only pushes visitors away. Global laws like the **[LGPD](https://goadopt.io/en/blog/lgpd-general-data-protection-law/)** demand total clarity and transparency in your communication.

Pre-made phrases like "we use technologies to improve your experience" mean absolutely nothing. You need to clearly explain the true role of **[cookies](https://goadopt.io/en/blog/lgpd-cookies-all-you-need-to-know/)** on your page.

The solution is a colloquial and direct language. A great **[Cookie banner](https://goadopt.io/en/blog/why-are-cookie-banners-everywhere/)** must detail the collection purposes without sounding like a boring contract.

### 2. Hiding the Reject Option

Hiding the reject button in difficult menus is a dark pattern that generates heavy **[fines](https://goadopt.io/en/blog/company-fined-the-end/)** in Europe and the Americas.

Your visitor must have the exact same ease to accept or reject tracking. This balance is the core of why a **[website needs cookie consent](https://goadopt.io/en/blog/website-needs-cookie-consent-gdpr-lgpd-ccpa/)**.

Avoid buttons with muted colors or tiny fonts. Let your **[Data protection officer](https://goadopt.io/en/blog/responsibilities-of-a-data-protection-officer/)** validate the interface to ensure no deceptive patterns exist.

![table-2.png](/uploads/table_2_2f71ca54e2.png)

### 3. Firing Cookies Before Permission

This is the fatal error that destroys many traffic managers' strategies. Loading tracking scripts before the "accept" click is a clear violation of the **[LGPD](https://goadopt.io/en/blog/lgpd-general-data-protection-law/)** and GDPR.

The golden rule is: block everything that isn't strictly essential. You do not want marketing tools and **[cookies](https://goadopt.io/en/blog/lgpd-cookies-all-you-need-to-know/)** running without the user's green light.

To be sure your site is running clean, instruct your tech team to **[delete cookies](https://goadopt.io/en/blog/delete-cookies-cache-chrome/)** and simulate accesses as a first-time visitor.

### 4. Poor Consent Record Management

A beautiful banner is useless if you don't store the logs correctly. Remember that a proper **[website needs cookie consent](https://goadopt.io/en/blog/website-needs-cookie-consent-gdpr-lgpd-ccpa/)** involves keeping safe proof of actions.

During an audit, your company and the **[Data protection officer](https://goadopt.io/en/blog/responsibilities-of-a-data-protection-officer/)** will need to present data such as date, time, and exact user preferences.

Losing this information leaves your operation completely vulnerable. A lack of documentation is a direct shortcut to **[fines](https://goadopt.io/en/blog/fines-in-LGPD/)** that can shut down your business.

### 5. Pre-checked Boxes and Assumed Consent

The era of assuming a user agreed just by scrolling the page is over. Modern frameworks like the **[LGPD](https://goadopt.io/en/blog/lgpd-general-data-protection-law/)** strictly prohibit implied consent.

Pre-checked boxes or forced cookie walls are not allowed. The power of choice regarding **[cookies](https://goadopt.io/en/blog/lgpd-cookies-all-you-need-to-know/)** must be actively in the hands of the visitor.

Respecting this autonomy builds a much stronger brand perception. At the end of the day, it increases trust in your **[e-commerce](https://goadopt.io/en/blog/impact-ecommerce-lgpd/)** and brings qualified leads.

## How AdOpt Solves This For You

Adapting your marketing processes doesn't have to be ugly or exhausting. Our CMP technology resolves your **[Cookie notice/banner](https://goadopt.io/en/blog/why-are-cookie-banners-everywhere/)** installation in a few clicks.

With our platform, script blocking happens automatically, protecting your campaigns and mitigating 100% of the risk of **[fines](https://goadopt.io/en/blog/fines-in-LGPD/)** from improper tracking.

We keep the entire consent history encrypted and organized. It's the security your **[Data protection officer](https://goadopt.io/en/blog/responsibilities-of-a-data-protection-officer/)** needs, with the design your brand deserves.

## Frequently Asked Questions (FAQ) About Cookie Consent

### 1. Why should I care about cookie consent?
Ignoring permission tracking is a critical **compliance** error that directly hurts your business. If you receive international traffic, knowing exactly why your **[website needs cookie consent](https://goadopt.io/en/blog/website-needs-cookie-consent-gdpr-lgpd-ccpa/)** is the first step to avoiding penalties and protecting your brand.

### 2. Can I leave the accept box pre-checked?
Absolutely not, as modern privacy rules require affirmative action. Strict frameworks, like the **[LGPD](https://goadopt.io/en/blog/lgpd-general-data-protection-law/)** and GDPR, prohibit implied consent, ensuring the visitor has total control over their data.

### 3. What happens if I hide the reject button?
Making it hard to refuse trackers is a deceptive practice highly penalized by regulatory authorities. Besides destroying user trust, this flaw attracts heavy financial **[fines](https://goadopt.io/en/blog/fines-in-LGPD/)** that can cripple your company's budget.

### 4. Should cookies be blocked before the user accepts?
Exactly, because no advertising or marketing script should be fired in the browser without prior authorization. Our AdOpt platform blocks these tags before the visitor interacts with the **[Cookie banner](https://goadopt.io/en/blog/why-are-cookie-banners-everywhere/)**, doing all the heavy lifting for you.

### 5. Who is responsible for managing these consents?
While the tech team handles the installation, the responsibility for keeping records secure falls on managers and the **[Data protection officer](https://goadopt.io/en/blog/responsibilities-of-a-data-protection-officer/)**. These professionals use our automated reports to prove legality during an audit.

## Take the Next Step Towards Compliance

Don't let bureaucratic mistakes harm your **[LGPD e-commerce](https://goadopt.io/en/blog/impact-ecommerce-lgpd/)** performance or your agency's metrics.

Compliance technology doesn't have to be an expensive and complex hurdle, and we are ready to show you how fast and smooth it can be.

Book a free demo with our team of experts right now through **[our HubSpot](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria?uuid=e1bc9e87-710e-4f13-894e-4ade5ce7af10)** and discover how to automate your consent management.


5 Common Cookie Consent Mistakes Hurting Your Compliance

Google Analytics 4 cookie consent comes down to one setting: `analytics_storage`. When a visitor accepts, it is `granted` and GA4 works as usual. When they decline, it is `denied`, and what GA4 does next depends on how your site is set up. Some setups send nothing at all, others send limited signals without cookies, and your reports change accordingly.

Getting this right protects you and keeps your data useful. This guide explains what GA4 does in each case, what changes in your numbers, and how to check your own setup, as part of a wider approach to [consent management across countries](https://goadopt.io/en/blog/consent-management-across-countries/).

## What GA4 does when consent is denied

GA4 learns the visitor's choice through Google's consent signals. The one that controls analytics is `analytics_storage`. Google describes it as enabling storage, such as cookies, related to analytics, for example visit duration. If it is `denied`, GA4 should not write or read analytics cookies for that visitor.

What happens to the measurement itself depends on the mode you use, and our [Google Consent Mode guide](https://goadopt.io/en/blog/google-consent-mode-beginner-to-advanced-guide/) covers both in depth. In short:

- **Basic mode:** Google tags stay blocked until the visitor consents, so nothing is sent before a choice.
- **Advanced mode:** Google tags load before the banner and send cookieless pings when consent is declined. Google Analytics can use those pings for modeling.

Neither mode makes a "no" disappear. The question is whether you lose that visitor completely or get a modeled estimate.

### The other three consent signals

Google defines four consent types in total: `ad_storage`, `analytics_storage`, `ad_user_data` and `ad_personalization`. The last three matter if you link GA4 to Google's advertising products. Google's GA4 help says `ad_user_data` and `ad_personalization` need to be granted for visitors in the European Economic Area to be included in audiences used by linked ad products. If you only measure, `analytics_storage` is the one to watch.

## What changes in your GA4 reports

With consent in place, your reports lose some precision, because declined visitors no longer appear as individual users. This is normal and a sign the setup works. Three things change:

- Some visitors vanish from the user counts, especially in markets where many people decline.
- Metrics that depend on cookies, such as returning users, are based on the visitors who accepted.
- In advanced mode, Google can model part of the gap, if the property qualifies.

### Behavioral modeling has conditions

Google's documentation says behavioral modeling is switched on automatically once a property is eligible. The requirements, listed in [Google's modeling help](https://support.google.com/analytics/answer/11161109), include consent mode on all pages, at least 1,000 events per day with `analytics_storage` denied for at least 7 days, and at least 1,000 daily users sending events with consent granted for at least 7 of the previous 28 days. Smaller sites may never qualify, so do not count on modeling to fill the gap.

Google also notes that when a consent solution that uses the TCF reports a decline, GA4 properties are not able to model data. Check the page above for the current wording before you plan around modeling.

[See how AdOpt connects consent to GA4](https://goadopt.io/en/) to keep this part consistent across your tags.

## IP addresses, retention and consent are different questions

It is easy to mix three topics that Google treats separately.

### IP addresses

Google says GA4 does not log or store individual IP addresses from users in the EU, Switzerland and the United Kingdom, and uses the address only to derive coarse location. That is a statement about how GA4 handles IPs, set out in [Google's GA4 IP help page](https://support.google.com/analytics/answer/12017362). It does not tell you whether you need consent. That depends on the law that applies to your visitors, and our guide to [GDPR and cookies](https://goadopt.io/en/blog/gdpr-cookies-explained/) covers the European rules.

### Data retention

Google's [data retention help page](https://support.google.com/analytics/answer/7667196) says retention applies to user-level and event-level data tied to cookies, user identifiers and advertising identifiers. Standard GA4 properties can choose 2 months or 14 months, and the longer options are for GA4 360. Retention controls how long data is kept, not what is collected, so it is a tuning option and not a replacement for consent.

### Google signals and advertising features

Google says Google signals features do not accumulate data for traffic where `ad_storage` is denied. If you use remarketing or audience features, this is another reason to make sure the advertising signals are set correctly.

## How to set up GA4 with consent

The setup is the same in outline for any CMP and any tag manager. Follow these steps:

1. Choose basic or advanced mode, and note why.
2. Set a default consent state before any Google tag runs. In Google Tag Manager, use the Consent Initialization trigger so consent settings are honored before other triggers fire.
3. Let your CMP update consent after the visitor chooses.
4. Use region-specific defaults only where your legal review calls for them. Google's `default` command accepts a `region` parameter and the most specific region wins.
5. Turn on the consent overview in Tag Manager to see which tags have built-in consent checks.
6. Remove any GA4 snippet that sits outside Tag Manager. It will ignore the CMP.

The [consent overview in Google Tag Manager](https://support.google.com/tagmanager/answer/10718549) shows these settings across your container.

[See how AdOpt works with Google Tag Manager](https://goadopt.io/en/plans/) before you configure the defaults.

## How to read your reports after switching consent on

The first weeks after you connect consent to GA4 can look alarming. Users and sessions usually drop, and that is the setup working, not your traffic falling. Keep the comparison fair:

1. Write down the date you switched consent on.
2. Compare periods of the same length and the same days of the week, before and after.
3. Look at each market separately. Markets where more visitors decline will drop more.
4. If your CMP shows acceptance rates, put them next to the GA4 numbers, so you can tell a traffic change from a consent change.
5. Do not try to win the numbers back by loading GA4 before the choice. That removes the protection you set up.

### Questions to ask your CMP

Whichever CMP you use, you want clear answers to these:

- Does it set the default consent state before any Google tag runs?
- Does it send an update right after the visitor chooses, and on later pages?
- Can it set different defaults for different regions?
- Does it block tags it does not control, such as scripts pasted into templates?

Our guide on [how to choose a CMP](https://goadopt.io/en/blog/how-to-choose-cmp-consent-management-platform/) goes further into these points.

## How to check your GA4 consent setup

Test from a clean browser window rather than reading the configuration. Run these checks:

1. Open the site and reject everything in the banner.
2. In the browser's developer tools, open the network tab and look for requests to Google Analytics.
3. In basic mode, nothing should be sent. In advanced mode, you may see cookieless pings and no analytics cookies.
4. Check the stored cookies: there should be no analytics cookies after a rejection.
5. Repeat after accepting. Measurement should start only from that moment.
6. Save a screenshot and the date as evidence.

If requests carry on as usual after a rejection, the tag is not reading consent. The most common cause is a GA4 snippet pasted into the site code. Our guide to [tag categorization](https://goadopt.io/en/blog/best-practices-tag-categorization/) helps you find tags that sit outside your tag manager.

## Keep learning about marketing tools and consent

- [How to choose a CMP](https://goadopt.io/en/blog/how-to-choose-cmp-consent-management-platform/)
- [Global Privacy Control, explained](https://goadopt.io/en/blog/global-privacy-control-gpc-explained/)

## Frequently asked questions

### Do I need consent to use Google Analytics 4?

The answer comes from the law that applies to your visitors, not from GA4 itself. Google's statement that GA4 does not store EU users' IP addresses does not settle it. Check which rules cover your audience, including the European rules in our GDPR and cookies guide, and use consent signals so GA4 follows the visitor's choice.

### What happens in GA4 if a visitor declines cookies?

It depends on the mode. In basic mode, Google tags stay blocked until consent, so nothing is sent. In advanced mode, tags send cookieless pings that Google Analytics can use for modeling, if your property meets the requirements. Either way, the visitor does not appear as an identified user.

### Does GA4 model data for visitors who decline?

It can, in advanced mode, but only when the property meets Google's requirements, which include thresholds of daily events and users over several days. Google also says properties cannot model data when the consent solution uses the TCF and the visitor declines. Small sites should plan as if no modeling will happen.

### Is Google Consent Mode the same as a CMP?

No. Consent Mode only passes the visitor's choice to Google tags. A CMP shows the banner, collects the choice, blocks other scripts and keeps the record. You need both: the CMP gathers a valid choice, and Consent Mode makes your Google tags follow it.


Google Analytics 4 Cookie Consent: What Changes in Your Data and How to Set It Up

Meta pixel consent means the pixel only sends events to Meta when the visitor's choice allows it. In practice you pause the pixel until the visitor agrees, resume it on a yes, and keep it paused on a no. Meta gives you a switch for this, and a [consent management platform](https://goadopt.io/en/blog/consent-management-across-countries/) is what flips it at the right moment.

The rules differ by market. In Europe the pixel needs a yes first. In California and some other US states the issue is opt-out: sending data to Meta for advertising counts as sharing, so visitors must be able to stop it. This guide covers both, with the code and a test you can run today.

## Why the Meta pixel needs consent control

The pixel is a script that sends information about what visitors do on your site to Meta, so you can measure and target ads. That makes it a third-party tracker, which is the kind of tool consent rules were written for. If it loads before the visitor decides, the consent exists in the banner and not in the network traffic.

### Europe: the burden is on you

Meta's Business Tools Terms say that, where consent is required to store or access cookies or other information on a user's device, as in the European Union, you must ensure in a verifiable way that the visitor gives all necessary consents before you use Meta Business Tools. The terms are in [Meta's Business Tools Terms](https://www.facebook.com/legal/terms/businesstools).

European case law points the same way. In Fashion ID (C-40/17, decided on 29 July 2019) the Court of Justice found that a website operator that embeds a social plugin, which makes the visitor's browser send data to the provider, can be a controller for the collection and transmission it decides on.

Consent and the duty to inform fall on the operator for those steps. The ruling applied the old Data Protection Directive, not the GDPR, but the logic is still useful: embedding a third-party tool is your choice, so the consent question is yours. The judgment is on [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62017CJ0040). Our guide to [GDPR and cookies](https://goadopt.io/en/blog/gdpr-cookies-explained/) covers the broader rules.

### California and other US states: sharing and opt-out

California describes "sharing" as sharing personal information for cross-context behavioral advertising, and gives people the right to opt out of it. Businesses must offer a clearly visible link, usually titled "Do Not Sell or Share My Personal Information", as the [California Attorney General's CCPA page](https://oag.ca.gov/privacy/ccpa) explains.

A pixel that sends events to Meta for ad targeting is a typical example. A browser signal such as GPC counts as a valid opt-out request there, which we cover in our guide to [Global Privacy Control](https://goadopt.io/en/blog/global-privacy-control-gpc-explained/). See also our guide to [California's CCPA](https://goadopt.io/en/blog/california-ccpa-and-cookies-all-you-need-to-know/).

[See how AdOpt blocks tags until consent](https://goadopt.io/en/) if you run pixels in more than one market.

## How to control the Meta pixel

Meta's pixel has a consent switch built in. According to [Meta's documentation on the pixel and GDPR](https://developers.facebook.com/docs/meta-pixel/implementation/gdpr), you use `fbq('consent', 'revoke')` to pause pixel fires and `fbq('consent', 'grant')` to send them once the visitor agrees.

### The code

Meta's example revokes consent before the pixel is initialized, so nothing fires until the visitor decides:

```js
fbq('consent', 'revoke');   // before init
fbq('init', 'YOUR_PIXEL_ID');
fbq('track', 'PageView');

// After the visitor accepts in the banner:
fbq('consent', 'grant');
```

Your CMP normally makes the `grant` call for you after the visitor accepts. If a visitor rejects or closes the banner, the pixel stays revoked.

### With Google Tag Manager

Many sites load the pixel through Google Tag Manager. That works well when the tag is set to fire only with the right consent, so it is held back until the visitor agrees. Check every Meta tag in the container, since one forgotten tag is enough to send data. Our guide to [tag categorization](https://goadopt.io/en/blog/best-practices-tag-categorization/) explains how to sort tags by purpose.

### Pixels pasted into the site

A pixel pasted straight into a theme or loaded by a plugin ignores your CMP. It is the most common reason a "no" in the banner does not stop Meta requests. Move it into the tag manager, or let your CMP block it, and test again.

## Limited Data Use for US visitors

For US state laws, Meta offers an option called Limited Data Use (LDU). In the pixel it looks like this:

```js
fbq('dataProcessingOptions', ['LDU'], 1, 1000);
```

The first number is the country: `0` lets Meta work it out from the visitor's location and `1` means the United States. The second is the state: `0` for the same automatic detection, or a code such as `1000` for California and `1001` for Colorado. The same options exist for the Conversions API. The details are in [Meta's data processing options page](https://developers.facebook.com/docs/marketing-apis/data-processing-options).

Meta describes LDU as giving you more control over how your data is used in its systems, and warns it can reduce campaign performance and limit retargeting and measurement. LDU is a tool for Meta's side. Your opt-out link and the handling of browser signals remain your job.

## Server-side events

If you also send events from your server through the Conversions API, treat them the same way as pixel events. Meta's pixel documentation on consent does not cover the Conversions API, so a safe approach is to send server events only for visitors whose choice allows it. Otherwise the pixel could respect a "no" while the server keeps sending the same events.

## What you lose when visitors decline

When a visitor says no, the pixel sends nothing, so those visits do not appear in Meta's reporting. That is the point. Expect fewer tracked events, especially in markets where many people decline, and plan your reporting around the visitors who agreed.

The temptation is to win the numbers back by loading the pixel anyway, or by moving the same events to the server without checking the choice. Both undo the protection you set up, and both are easy to spot in a network test. If Meta's reporting looks thin, review your banner design and your campaign setup first. Our guide to [choosing a cookie banner](https://goadopt.io/en/blog/how-to-choose-a-cookie-banner-for-your-website/) covers how the design affects the choice people make.

## A checklist before you add any ad pixel

The same questions apply to Meta and to any other ad tool:

- Who owns this tag, and who approved it?
- Which consent type or category does it belong to?
- Does it load through the tag manager, where the CMP can control it?
- Does it have a server-side twin that needs the same rule?
- How will we test it, and how often?

Answering these before the tag goes live is cheaper than finding out from a complaint.

## How to test your Meta pixel setup

You can test without special tools. Follow these steps:

1. Open your site in a private window.
2. Reject everything in the banner.
3. Open the developer tools and check the network tab for requests to Meta, such as `facebook.com` or `facebook.net`.
4. After a rejection there should be no events sent to Meta.
5. Repeat after accepting. Events should start only from that moment.
6. For US visitors, switch on GPC and check that ad events stop where required.
7. Save a screenshot and the date as evidence.

If requests still go out after a rejection, look first for a pixel pasted in the code or a second tag in the tag manager. [Check how consent reaches your pixel with AdOpt](https://goadopt.io/en/plans/) as a fast way to see it in action.

## Keep learning about consent and ad tools

- [Google Analytics 4 cookie consent](https://goadopt.io/en/blog/google-analytics-4-cookie-consent/)
- [How a cookie banner works](https://goadopt.io/en/blog/operation-of-cookie-banner/)

## Frequently asked questions

### Do I need consent to use the Meta pixel?

In jurisdictions that require consent to store or access information on a visitor's device, such as the European Union, Meta's terms say you must ensure consent is given before using its tools. In California, sending data to Meta for ad targeting counts as sharing, so visitors need an easy way to opt out. Check the rules for your audience.

### What does fbq consent revoke do?

It pauses the pixel, so no events are sent to Meta. Calling `fbq('consent', 'grant')` resumes sending. Meta's example revokes consent before the pixel is initialized, so nothing fires until the visitor decides. Your CMP can make these calls for you, based on the choice made in the banner.

### What is Limited Data Use?

It is a Meta option for US visitors that you switch on with `dataProcessingOptions` in the pixel or the equivalent fields in the Conversions API. You tell Meta the country and state. Meta warns it can reduce campaign performance. It does not replace your opt-out link or the handling of browser signals.

### Can I load the pixel through Google Tag Manager?

Yes, and it is often the cleanest way. Set the Meta tag to fire only when the visitor's choice allows it, and make sure no second copy of the pixel is pasted into the site code. Test with a rejection and check that no requests reach Meta.


All posts