Law 21.719 has no article about cookies, but its consent rules apply to anything that identifies a person, and that includes analytics and advertising cookies.
Which cookies need permission
Strictly necessary cookies, such as the shopping cart or the session, can run without asking. Analytics, remarketing and advertising cookies need consent before they fire.
For that consent to count it has to be free, informed, specific and unambiguous. In practice, several common setups stop working:
- A notice that only says "this site uses cookies" with an accept button.
- Pre-ticked checkboxes.
- Loading Google Analytics or the Meta pixel before the person chooses.
- A reject button that is hidden or harder to use than accept.
How to keep measuring
The usual worry is losing campaign data. Google Consent Mode v2 helps: tags wait for the user's choice and, when someone declines, Google models part of the conversions without storing cookies. You lose some precision, but you can still see how your campaigns perform.
Forms
Every form that asks for a name, email or phone number should have:
- A short line saying what the data will be used for.
- A link to the privacy policy.
- An unticked checkbox when the data will be used for more than replying, such as newsletters.
- A record of when and how each person agreed.
That record is what you will need if someone asks or the Agency audits. In WordPress it can be stored with each submission without adding outside services.
