Brazil's LGPD for Small Websites: What Is Actually Required

Your website has a contact form, Google Analytics and maybe an advertising pixel. That is already enough: you are processing personal data. Brazil's general data protection law, the LGPD, Law 13.709/2018, applies to you exactly as it applies to a company with a thousand employees. What changes is the size of the structure you have to build around it.

This article is general guidance on how the law translates into technical decisions on a website. It does not replace a lawyer looking at your specific case, especially if you handle sensitive data, data about children, or large volumes. That said, most small business websites fall into a simple scenario, and it can be handled well without turning into a six-month project.

Who the law applies to (spoiler: probably you)

The LGPD covers any processing of personal data carried out by an individual or a legal entity, public or private, performed in Brazilian territory or offering goods and services to people in Brazil. There is no revenue floor. There is no exemption for sole traders. There is no exception for a one-page site.

If you know the GDPR, the territorial logic will feel familiar, and so will most of the vocabulary: controller, processor, data subject, legal basis, purpose limitation. The LGPD was drafted with the European regulation clearly in view, and someone who already runs a GDPR-compliant operation is most of the way there. The differences are in the details, and the details are where projects go wrong.

Processing, in the law's own definition, is nearly everything: collecting, receiving, storing, using, transmitting, archiving, deleting. If a visitor types a name and an email into your form, you collected. If Analytics writes an identifier into their browser, processing happened. If you export the lead list into a spreadsheet, that counts too.

What does exist is a lighter regime. ANPD, the Brazilian supervisory authority, created a specific set of rules for small-scale agents: micro and small enterprises, startups, non-profit private entities and individuals processing data for economic purposes. That regime waives, among other things, the mandatory appointment of a formal data protection officer and extends response deadlines. It waives none of what matters here: transparency, legal basis and security still apply in full.

Legal bases in plain language

The central question under the LGPD is not "am I allowed to ask for this data?". It is "on what grounds do I process this data?". The law lists ten hypotheses that authorise processing of ordinary personal data, where the GDPR lists six. A small website usually uses three or four of them.

• Consent. The person authorises, freely, informed, for a specific purpose. It is the most fragile basis, because it can be withdrawn at any time and you have to be able to prove it was given. Use it where it genuinely fits: marketing, non-essential cookies, newsletters.
• Performance of a contract or preliminary procedures. Someone requests a quote through your site. You need their name and contact details to reply. That is a preliminary contractual procedure, not consent.
• Compliance with a legal or regulatory obligation. Issuing invoices, keeping records the law requires you to keep.
• Legitimate interests. The most abused basis in the country. It requires the processing to be necessary for a legitimate purpose, the data subject to reasonably expect it, and their rights and freedoms not to override your interest. It also requires you to record the reasoning. It is not a wildcard for anything that does not fit elsewhere.

For sensitive data, racial origin, religious belief, political opinion, health, sex life, genetic or biometric data, the list is different, shorter and stricter. If your form asks anything that falls into that list, stop and reconsider whether you really need that field.

In practice the exercise is this: list every point on the site where data comes in, and write next to each one the purpose and the legal basis. Quote form, newsletter, Analytics, ad pixel, chat, login area. If you cannot write the legal basis for an item, that item is your problem.

What the privacy policy has to contain

The law requires the data subject to have easy access to clear information about the processing. A policy copied from another site almost never satisfies that, because it describes processing you do not do and omits the processing you do.

The functional minimum for an honest privacy policy:

1. Who the controller is, legal name, tax registration number and a contact channel that actually works.
2. Which data is collected, separating what the person types from what the browser hands over automatically.
3. The purpose of each collection, in plain language. "To improve your experience" is not a purpose.
4. The legal basis matching each purpose.
5. Who the data is shared with. If you use Google Analytics, Google Ads, Meta, an email marketing provider or a CRM, those are processors or third-party controllers and they need to be named.
6. International transfers, where they happen. Most US-based tools imply one.
7. How long data is retained and the criterion for deleting it.
8. The data subject rights and how to exercise them, with a specific channel.
9. The security measures actually in place, without drifting into fiction.
10. The date of the last update.

Our own privacy policy follows that structure and can serve as a reference for format, not for content, because the content has to describe what your site does.

Cookie banners: what is required and what is theatre

The LGPD has no article called "cookies". What it has is the combination of two principles: you need a legal basis to process the data, and consent, when it is the basis, must be free, informed and unambiguous. ANPD published a guidance document on cookies that starts from exactly there. The practical outcome is very close to what the ePrivacy Directive and the GDPR produced in Europe.

What that means in concrete decisions:

• Strictly necessary cookies do not need consent. Session, security, load balancing, language preference. They rest on other legal bases.
• Analytics, advertising and personalisation cookies do. And they need it before firing, not afterwards.
• Refusing has to be as easy as accepting. A banner with a large green "Accept all" and a tiny grey "preferences" link is exactly the pattern a supervisory authority reads as defective consent.
• No implied consent. "By continuing to browse you agree" is not consent. Scrolling is not consent. A pre-ticked box is not consent.
• People must be able to change their mind. There has to be a visible path to review or withdraw the choice later.

The theatre version is the banner that shows up, announces that the site uses cookies, and blocks nothing, the tags already fired before the visitor clicked anything. That is worse than having no banner: it creates a record that you knew about the obligation and chose not to meet it.

On the ALB Seven site the implemented pattern is the opposite: every category of non-essential storage starts denied. No analytics or advertising tag loads until the visitor makes an explicit decision in the banner. If they accept, the signals are updated and the tags start running. If they refuse or ignore it, the signals stay denied. It is a first-party banner, with no third-party consent platform, because the behaviour has to be predictable and auditable.

Google Consent Mode v2

Blocking tags one by one by hand is brittle. Google Consent Mode solves it more cleanly: instead of preventing the script from loading, you declare the consent state to Google, and Google's tools adjust their own behaviour.

Version 2 works with four main signals:

• analytics_storage, storage for measurement.
• ad_storage, storage for advertising.
• ad_user_data, sending user data to Google for advertising purposes.
• ad_personalization, using that data for personalised ads.

A correct implementation has two parts. First, a default state set globally and before any Google tag loads, with every signal at denied. Second, an update triggered by the banner when the visitor decides. If the default is set after the tag, or only for one region, you have a window in which data leaks outside what was consented to.

With the signals denied, Google still receives cookieless pings and models conversions statistically. You lose granularity, not the whole measurement. That is a reasonable price, and it is worth remembering that reading your reports changes when part of the traffic is modelled, something worth understanding before drawing conclusions from the numbers, as we cover in the metrics that matter in Google Analytics 4.

Data subject rights and how to serve them

The law grants the data subject, among others, the right to confirm that processing exists, to access the data, to correct incomplete or outdated data, to request anonymisation or deletion of unnecessary data, to obtain information about sharing, to withdraw consent and to request portability. Anyone used to the GDPR will recognise the list almost line for line.

Operationally, three things solve nearly all of it:

1. A declared, monitored channel. A specific email address, published in the policy, that someone actually reads.
2. Knowing where the data lives. If a lead asks for deletion and you do not know whether they are in the site database, an inbox, a spreadsheet and a CRM, you cannot serve the request. Map it before you need it.
3. A deadline. The law provides for an immediate response in simplified form and, for the complete declaration, a deadline of up to fifteen days from the request. Small-scale agents get extended deadlines, but having a process that answers within fifteen days removes the argument entirely.

Keep a record of what was requested, when, and what you did about it. That is what demonstrates good faith if the conversation escalates.

Contact forms: the compliance minimum

The form is the most common collection point and the easiest one to get right. Five decisions:

1. Ask only for what you need. Every extra field is data you now have to protect, justify and delete. If you never use the tax ID, do not ask for the tax ID. This is not only compliance: shorter forms convert better, as we discuss in contact form or WhatsApp.
2. State the purpose in the form itself. One line under the button, linking to the policy. You do not need a consent checkbox when the basis is contract performance, you need clear information.
3. Separate marketing from everything else. If you want to send a newsletter later, that is a different purpose and it needs its own opt-in, unticked by default.
4. Transmit and store securely. HTTPS mandatory, restricted database access, no personal data written to plain-text logs. Worth reviewing the technical baseline in HTTPS, HSTS and security headers.
5. Set a disposal period. A lead from 2019 who never replied does not need to stay in your database. Write the criterion into the policy and follow it.

What happens if you ignore it

The law itself defines the administrative sanctions ANPD can apply. They range from a warning with a deadline to correct, up to a fine of up to two per cent of the company's, group's or conglomerate's revenue in Brazil in its last financial year, excluding taxes, capped at fifty million reais per infraction. There is also a daily fine, publicising the infraction, blocking and deleting the data involved, partial suspension of the database or of the processing activity for up to six months, and partial or total prohibition of activities related to processing.

For most small businesses, though, the immediate risk is rarely the fine. It is more concrete than that: a corporate client demanding compliance evidence during procurement, a competitor filing a complaint, a security incident that has to be reported to the authority and to the affected people, or simply a visitor asking for deletion and getting no answer.

The good news is that the effort is asymmetric. An afternoon mapping where data comes in, a day writing a policy that describes reality, and a correct banner plus Consent Mode implementation cover most of the ground for a small site. What costs a lot is discovering you need all of it on the day somebody asks.

If you want your site built with this pattern from the start, consent denied by default, Consent Mode v2 configured before the tags, and a policy that describes what the site actually does, talk to ALB Seven.