LGPD Fast Track Configuration Guide for Cookie Consent

OneTrust Cookie Consent allows your organization to do a complete discovery of the cookies, local storage, and tags that are currently being offered on your website. This provides insight into the ways in which your organization is capturing a site visitor's personal information when they browse your site.

You team can use this information to build a site banner and preference centers that allow site visitors to directly control which categories of cookies can capture and process their information.

This guide will help you get with the initial setup of and implementation of Cookie Consent for the Brazilian General Data Protection Law (LGPD). You will be able to take advantage of pre-configured Cookie Banner and Geolocation Rules to deploy to meet your organization compliance goals for LGPD.

Setup

The first step in configuring your Cookie Consent module to is to scan your website to determine which cookies are being dropped and categorize them based on function. This will allow site visitors to consent to purposes based on the function of those cookies. If you have already performed your domain scans, skip to Step 2: Categorize Cookies.

Scans may take several hours to days depending on the size of the website.

Step 1: Scan a Website

  1. On the Cookie Consent menu, select Websites. The Websites screen appears. 

  2. Click the Add Website button on the top right of the screen. The Scan Website screen appears.

  3. Complete the fields. For more information, see Scanning a Website.





  4. Click the Scan and configure button. Your scan will begin and you will be prompted to configure the CMP for the scanned domain. The Assign Experience Kit screen appears.

    Note:

    You can select Scan only to scan the website without configuring an Experience Kit. This will require you to set up your banner and preference center separately.

  5. Click the Create custom experience kit button. The Select audience screen appears.

  6. Enter a name and select the LGPD Template (Brazil) framework for your Experience Kit.

  7. Click the Next button to complete your banner and preference center configuration and to create a geolocation rule group.

    For more information, see Scanning a Website.

    Tip:

    After your LGPD Experience Kit is configured, you can assign future scans for new domains to the kit without configuring a new custom kit.

After your scan has completed, click the domain to view the scan results. A summary of all the scan results for the domain is shown, but you can also choose to view the results of a specific scan. Selecting an individual scan will provide you with additional information on the individual tracking technologies.

For more information, see Viewing Scan Results.

Step 2: Categorize Cookies

On the Cookie Consent menu, select the Tracking technologies tab.



Many of your cookies will already be assigned a Purpose based on information in the Cookiepedia database. You may want to edit the details of the cookie and change the cookie category. You will need to manually assign a category to unknown cookies. You can also edit the Cookie Categories and description or create new Cookie Categories. For more information, see Managing and Categorizing Cookies and SDKs.

Step 3: Create an LGPD Template

Important:

If you have already completed your Experience Kit configuration, skip to step 7 of this section.

If you selected Scan only when configuring your website scan, you must set up your banner and preference center separately. When you have categorized the cookies on your site, you will need to select a template for the banner, preference center, and cookie list. This is done from the Templates screen. See below for setup instructions for a baseline LGPD template:

  1. On the Cookie Consent menu, select Templates. The Templates list screen appears.

  2. Click the Add New button. The Create New Template screen appears.

  3. Select the LGPD Template (Brazil) template.



  4. Click the Next button.

  5. Enter a name and select a managing organization.



  6. Click the Create Template button. The Template Details screen appears.

  7. On the Cookie Consent menu, select Templates. The Templates list screen appears.

  8. Hover over the row for your new LGPD template until the Context Menu icon appears.

  9. Click the Context Menu icon. The Context menu appears.

  10. Select Set as Universal Default. A confirmation modal appears.

  11. Click the Save button.

Step 4: Create a new geolocation rule

Once you have prepared the LGPD Template, you will define a geolocation gules group. The policy works in combination with your LGPD template to manage the banner and preference center content and behavior on your domains.

Adding additional rules will allow you to designate the region where the rule is to be used and assign a Template configured for the laws of that region. You can also edit the consent model and the behavior of the banner. In addition, you can enable consent logging to track when site visitors are giving consent.

To add a geolocation rule

Note:

If you have already configured an LGPD Experience Kit during scan configuration, select the geolocation rule you already created. You can review and reconfigure the existing rule configurations or add more rules to meet your needs, but you do not have to create any new rules or rule groups.

  1. On the Cookie Consent menu, select Geolocation Rules.

    The Geolocation rules screen appears.

  2. Click on the name of the rule group you want to define.

    The Geolocation rule group details screen appears.

  3. Go to the Geolocation rules tab. Click the Create New button to create a new rule group or select a rule group to edit.

    Create new rule group modal with fields for the rule group name, organization, and description.
  4. On the Geolocation Rule Group Details screen, click the Add Rule button. All editable fields display.

    Geolocation rule configuration screen.
  5. Complete the fields using the following configuration:

    Field

    Text

    Rule Name

    LGPD

    Select Region

    Brazil

    Template

    LGPD Template (created in section 1 or 3)

    Status

    Opt-in
  6. Click the Save button.
    Note:

    Optional: Enable the Use this consent model if site visitor's IP address is unknown setting to use this rule if the site visitor's IP address is unknown. Click Save on the confirmation modal.

  7. After you have reviewed and defined your geolocation rule group, you will want to assign the domains to control where the rule is used and ensure the behavior is consistent across your sites. Navigate to the Assigned Domains and Assigned Application tabs to assign the rule to the domain(s). For more information see Configuring Geolocation Rules.

Step 5: Implement the Cookie Consent Script

Finally, you will need to implement the Cookie Consent script on your website. This is done from the Website scripts screen. This final step will place the banner, preference center, and cookie list on your website. Any changes you make to the banner, preference center, or cookie list will be made automatically after publishing, unless you are hosting the script locally. There are separate scripts for the testing and production environments.



Select the domain to be published and click Publish. After entering the publish modal, you will be provided with both testing and production scripts.

You can publish a testing script to use on your testing website. Simply add the testing script to your testing environment in the <head> section of the website. There is no cache for testing scripts, so changes will appear immediately.

When you are ready publish the production script, you will need to copy this script and paste it into the <head> section of your website. It will take up to four hours for changes in the script to appear on your site.

For more information, see Publishing and Implementing Cookie Consent Scripts.

Cookie blocking and tag management

Not covered in this article are third-party integrations and cookie blocking. This includes preventing cookies from being created or used until a data subject has given consent. The methods and/or tools used to drop cookies may vary by organization. OneTrust recommends reviewing the available articles found in the Third-Party Integrations and Blocking Guidance section of our knowledge base for more information.