Legal Requirements for Websites and Apps: Brazil

Brazil has three rulebooks that matter for a website or app, with different scope and enforcement routes. The LGPD governs personal data with GDPR-style duties and no size threshold. The Consumer Code (CDC) plus the e-commerce decree govern covered consumer sales — including a 7-day right to change your mind and a duty to display your CNPJ and full address. The Marco Civil governs user-generated content, and its liability rules changed significantly after the Supreme Court's 2025 ruling. Also assess the ECA Digital children's statute, in force since 17 March 2026, and the ABNT NBR 17225 digital accessibility standard. Prioritize according to the product: a store needs accurate seller disclosures and cancellation, while an app handling sensitive data needs a detailed privacy assessment. Neither consumer nor privacy enforcement can be dismissed based on an assumed sequence of complaints. This is the Brazil chapter of our pre-launch legal checklist. Run that prompt sequence first, then apply what's here.

Key takeaways

• The LGPD applies to anyone processing data of people in Brazil, or offering goods and services to Brazil — no size threshold, wherever you're based.
• Consent is one of ten Article 7 legal bases; sensitive data has separate rules. Pick a basis per purpose and write it down.
• Cookies: the ANPD expects equally sized accept/reject buttons, nothing pre-selected, granular choice, easy withdrawal, and documentation in Portuguese.
• International transfers need an applicable mechanism. EU adequacy under ANPD Resolution 32/2026 is one route; SCCs remain relevant for other transfers.
• Selling online: display CNPJ and full address, provide a contract summary before purchase, answer consumer demands within 5 days, and honour the 7-day right of regret through the same channel used to buy.
• ECA Digital (Lei 15.211/2025), in force since 17 March 2026: real age verification, parental controls, no ad profiling of minors, loot-box ban. Penalties reach 10% of Brazilian group revenue, capped at R$50 million per violation.
• Qualifying security incidents generally require communication to the ANPD and affected individuals within 3 business days; check the risk test and any applicable small-agent timing rules.

LGPD: what it asks of a small product

Ten legal bases, not one. Consent, contract performance, legal obligation, legitimate interest, credit protection, protection of life, health, research, judicial process and public policy. Consent is the most fragile — it must be free, informed, specific and revocable, and it can't be bundled into your terms of service. Contract performance covers processing necessary for that contract; legitimate interest needs a documented balancing assessment.

Nine data subject rights, including confirmation of processing, access, correction, anonymisation or deletion of unnecessary data, portability, information about who you've shared with, and revocation of consent. Confirmation and access have immediate simplified or 15-day complete-response provisions; do not apply that timing automatically to every right. Check the applicable request and exceptions.

An encarregado (DPO). Article 41 requires controllers to appoint one and publish their contact details. ANPD Resolution 2/2022 can relieve eligible small processing agents of the obligation to formally appoint one, subject to the regulation’s exclusions, but they still need a published communication channel for data subjects and the ANPD. Publish an email address either way; it costs nothing.

International transfers. ANPD Resolution 19/2024 set the framework and approved Standard Contractual Clauses that must be adopted without modification. Existing contracts had to be brought into line by 22 August 2025. The EU is recognised as adequate under ANPD Resolution 32/2026. Assess each destination and onward transfer: SCCs are one mechanism, not mandatory for every transfer. Map your transfers; the data inventory from the main checklist is the input.

Security incidents. Under ANPD Resolution 15/2024, assess the relevant-risk test and generally notify the ANPD and affected individuals within 3 business days; qualifying small agents may have different timing under Resolution 2/2022. Decide in advance who does this.

Records and impact reports. Keep a record of processing operations. A RIPD (data protection impact report) is expected for higher-risk processing, and the ANPD may request one at any time.

Cookies and consent

The ANPD's cookie guidance is close to European practice, and explicit about the interface:

• Reject, accept and manage options must be equally sized and equally prominent
• Non-essential cookies off by default, never pre-selected
• Granular choice by purpose, in plain language a non-specialist can read
• Consent must be revocable simply and at no cost
• Assess the purpose and legal basis for each cookie. Consent is an appropriate default for optional tracking; legitimate interest has its own necessity and balancing requirements. ANPD guidance is not a rule that every non-essential cookie must use the same basis
• The cookie policy must be linked, specific about purposes and retention, and available in Portuguese

Selling to Brazilian consumers

Brazilian consumer law is protective, and the e-commerce decree (Decreto 7.962/2013) is unusually specific about what your website must show.

Display prominently: your company name and CNPJ (or CPF for an individual), physical address, email and contact details; the characteristics of the product or service including any health or safety risks; all additional costs such as shipping and insurance itemised separately; and the full conditions of the offer including payment methods, deadlines and any restrictions.

Before the purchase completes: show a summary of the contract with the essential terms, provide tools to correct errors before finalising, confirm receipt of the order immediately, and make the contract available in a form the consumer can save.

Customer service: maintain an effective electronic service channel, confirm receipt of consumer demands, and respond within 5 days. Businesses in sectors regulated at federal level are additionally subject to the SAC decree (Decreto 11.034/2022), with rules on telephone availability, no unrequested advertising during service, and cancellation requests being processed immediately.

Right of regret (direito de arrependimento): 7 days from receipt or from contracting, for anything bought outside a physical shop, with no reason required and no penalty. The critical implementation detail: the consumer must be able to exercise it through the same tool used to make the purchase — if they bought in two clicks in your app, they cannot be sent to a phone queue. Accessory contracts are cancelled at no cost, you must immediately tell the payment provider to cancel or reverse the charge, and you must send confirmation that you received the request.

Language and currency. Consumer-facing information — terms, prices, policies, support — in Portuguese. Prices in Brazilian reais with all charges included.

User-generated content after the STF ruling

Brazil’s 2025 Supreme Court ruling changed intermediary liability under Article 19. Its treatment varies by content and service; one universal notice-and-removal rule is not an accurate summary. A reporting form alone does not resolve liability.

Map whether you host ordinary user posts, private communications, paid promotion or other content. Implement a notice log, escalation and review process, and obtain a Brazilian assessment of the applicable liability and representation requirements. See the Supreme Court’s institutional news and judgments.

Children: ECA Digital

Lei 15.211/2025 has been in force since 17 March 2026 and reaches any information technology product or service directed at children and adolescents or likely to be accessed by them — including foreign companies serving Brazil. "Likely access" is judged by appeal to minors, ease of access and risk, not by what your terms say.

Core obligations: reliable age verification (self-declaration alone is not enough), linking social-network accounts of children and adolescents under 16 to a legal guardian as required by the law, parental control tools over screen time, recommendations and sensitive features like geolocation, age-appropriate design, moderation preventing access to illegal or inappropriate content, a ban on profiling minors for targeted advertising and on certain technologies for that purpose, and a loot-box ban in games accessible to children. Services with a million or more child users publish semi-annual moderation reports.

Penalties reach 10% of the economic group's Brazilian revenue, capped at R$50 million per violation, plus suspension or prohibition of activities. Decree 12.880 of 18 March 2026 provides implementing rules; ANPD’s detailed guidance continues to develop.

Accessibility

The Brazilian Inclusion Law (Lei 13.146/2015) has required accessible websites since 2016; the standard picture became much clearer with ABNT NBR 17225:2025, the first Brazilian technical standard for digital accessibility, which aligns with WCAG principles. Federal government sites also follow eMAG. Non-compliance is actionable as discrimination and through consumer and civil-rights channels, including class actions brought by the Ministério Público.

Practically: WCAG work is reusable, but check the applicable Brazilian requirements and the relevant ABNT standard rather than assuming technical equivalence establishes compliance.

What's still coming

An AI bill (PL 2338/2023) has been moving through Congress on a risk-based model similar to the EU AI Act; it is not yet in force. ECA Digital implementing Decree 12.880/2026 exists; check ANPD’s latest technical guidance. Keep AI features documented and check operative requirements before enabling affected functions.

The Brazil-specific prompt

Run this after the ten prompts in the main checklist:

Add Brazil compliance mechanics to this app. All user-facing text must be in Brazilian Portuguese. Implement each item and report exactly what changed:

1. A footer block on every page showing company name, CNPJ, full physical address and contact email, using placeholders [[RAZAO SOCIAL]], [[CNPJ]], [[ENDERECO]], [[EMAIL]] for anything I must supply.
2. A cookie banner where accept, reject and manage options are the same size and equally prominent, nothing non-essential is pre-selected, choices are granular by purpose, and consent can be withdrawn at any time from a permanent footer link. No non-essential script may load before a choice is made.
3. A privacy policy in Portuguese that states, for each processing purpose, which LGPD legal basis applies — and inserts [[BASE LEGAL]] where you are not certain rather than guessing. Include the nine data subject rights, retention periods, and a published contact channel for the encarregado.
4. Self-service data rights: access, correction, portability, deletion and revocation of consent, each reachable in at most two clicks, with a log of requests and response dates.
5. List every third-party service in this app that stores or receives personal data outside Brazil, so I can put international transfer clauses in place. Report the list; do not attempt to draft the clauses.
6. If the app sells anything: show total price in BRL with all charges itemised before checkout, display a contract summary the user must review before confirming, send an immediate order confirmation the user can save, and add a cancellation flow that lets the user exercise the 7-day right of regret through the same interface used to purchase, in at most two clicks, with an automatic acknowledgement email.
7. A support channel that records incoming consumer demands with a timestamp and confirms receipt automatically.
8. If minors could plausibly use this app: an age check that is not a simple yes/no self-declaration, restricted defaults for accounts under 18, and no profiling or personalised advertising for those accounts.
9. An accessibility pass against WCAG 2.1 Level AA — report findings by severity before fixing anything.

For each item report PASS or explain what blocked it. Do not invent law citations in user-facing text.
Copy prompt

Pre-launch checklist — Brazil

• CNPJ, company name, address and contact visible on the site
• Privacy policy in Portuguese with a legal basis per purpose, and a published encarregado channel
• Cookie banner with equal buttons, nothing pre-ticked, granular and revocable
• Data rights self-service working end to end
• International transfers mapped and supported by adequacy, SCCs or another applicable mechanism
• Incident response plan naming who notifies the ANPD within 3 business days
• Selling: contract summary before purchase, immediate confirmation, 5-day response commitment, 7-day right of regret through the same channel
• User content: reporting and review process; assess applicable representation duties
• Minors: real age verification and restricted defaults if ECA Digital could apply
• Accessibility audited against WCAG 2.1 AA

What the build checks establish

The prompts are implementation requests, not a legal certification. Two-click controls and consent-first defaults are practical design choices, not universal statutory requirements. Confirm jurisdiction, exceptions, retention and provider contracts separately. Verify controls with test accounts and actual browser/network behaviour; a builder’s PASS based only on code inspection is incomplete evidence.

Official sources and review scope

Updated September 14, 2026. The linked sources support the scope and corrections discussed here; this is an editorial review, not an exhaustive legal opinion or a certification of your product. Check the operative rule when acting.

• ANPD transfer mechanisms and EU adequacy
• ANPD ECA Digital implementation
• ECA Digital law
• Small-agent rules
• STF intermediary-liability clarification

• Brazil e-commerce decree
• ANPD cookie guidance

Match your consumer and privacy controls to the product you actually operate. Start with the pre-launch checklist, run the Brazil prompt above, and compare with the United States, the European Union, the United Kingdom, Canada, Australia and Israel if you sell there too. You can build this.