With the EU’s GDPR and California’s CCPA now in effect, let’s explore the latest privacy law: Brazil’s LGPD.
This article will clarify what the LGPD is, outline compliance steps for publishers, and explain how the LGPD compares to the GDPR.
Please note: We are not a law firm and therefore do not offer legal advice. This article is informational. Please speak to a lawyer before determining how the LGPD affects your business.
The LGPD, or Lei Geral de Proteção de Dados (General Data Protection Law), is a comprehensive data privacy law that guarantees individual rights to Brazil’s more than 150M internet users.
The LGPD was passed in August 2018 and was finalized by President Jair Bolsonaro last July. Enforcement of the law was delayed this spring. The LGPD will now be effective August 1, 2021 and enforced by a new national authority, the Autoridade Nacional de Proteção de Dados (ANPD), similar to the European Data Protection Board (EDPB).
Like the GDPR, the LGPD views personal data as any data that can identify someone. PII (personally identifiable information) includes: name, IP address, lat/long coordinates, cookie IDs, RFID numbers, user agents, mobile IDs, and biometric/genetic/financial/behavioral/demographic data.
Without consent from a Brazilian user, you cannot:
If a user has opted in, however, you may continue to do cookie matching, interest targeting, frequency capping, programmatic ads, and so on.
The LGPD was inspired by the GDPR, so these privacy laws share a number of commonalities, including:
NOTE: Neither law clearly defines “large-scale”; work with your legal counsel to evaluate the range and volume of PII you process, and the number of individuals and geographical areas it includes.
Despite their similarities, the LGPD does have differences:
Regardless of your company size, you’ll need to comply if your ad platform:
Effectively, unless your site/app is unavailable in Brazil, you will need to enact some changes to be LGPD-compliant.
OFFSET
The good news: if you’re GDPR-compliant, you’ve done much of the heavy lifting required for LGPD compliance.
/OFFSET
Like the GDPR, the LGPD qualifies consent as a freely-given indication of a users’ agreement for general data processing - and requires that information on personal data collection and use be clear, adequate, and easily accessible.
Consent must be provided by the data subject in writing or by other means, such as a consent banner on your website. The right to revoke consent must also be clearly disclosed.
As you prepare for the LGPD (by August 1, 2021), we suggest the following:
With the passage of the LGPD, Brazil - the largest country in South America and Latin America - joins more than 100 countries with personal data protection laws. Given heightened consumer concern and awareness, we expect more privacy laws to come - and we’ll be sure to help publishers prepare for them.
As you prepare your platform for LGPD compliance, here are a few additional sources that may prove helpful:
