GDPR, LGPD and LFPDPPP, explained
If your site has visitors from Europe, Brazil and Mexico — common for any business in the Americas — you're inside three privacy frameworks at once. They rhyme, but they are not the same law, and the differences decide what your cookie banner must do.
GDPR — European Union & UK
The strictest of the three. For non-essential cookies (analytics, ads, social pixels) GDPR requires prior opt-in consent: nothing loads until the visitor actively agrees, rejecting must be as easy as accepting, and consent must be recorded so you can prove it later. Fines scale to €20 million or 4% of global revenue, whichever is higher — and enforcement against ordinary businesses, not just big tech, has been routine for years.
LGPD — Brazil
Brazil's Lei Geral de Proteção de Dados follows GDPR's shape: consent must be free, informed and unambiguous, and data subjects get similar rights (access, deletion, portability). Sanctions from the ANPD reach 2% of revenue in Brazil, capped at R$50 million per infraction. In practice: if your banner is GDPR-grade and shows up for Brazilian visitors in Portuguese, you're working in the right direction.
LFPDPPP — Mexico
Mexico rewrote its federal data protection law in March 2025, and it still works differently from GDPR: its centerpiece is the aviso de privacidad (privacy notice) that tells people what data you collect and why. Enforcement moved from the dissolved INAI to the Secretaría Anticorrupción y Buen Gobierno, and fines can reach 320,000 UMA (about MX$37.5 million in 2026). Cookie consent matters here as part of giving real notice and choice about tracking — and Mexican enforcement has been getting steadily more active.
The practical problem: one site, three rulebooks
Showing every visitor the strictest banner is legal everywhere but costs you consent rate where the law is lighter. Showing everyone the lightest banner is non-compliant where it's stricter. The clean solution is geo-routing:
- EU/UK visitor → strict opt-in banner, trackers blocked until consent.
- Brazilian visitor → LGPD banner, Portuguese, opt-in for non-essential.
- Mexican visitor → LFPDPPP notice and consent in Spanish.
- Everyone else → your choice of default, without EU-grade friction.
That's the core design of Cookie Rocket Pro: it detects each visitor's country and applies the right framework automatically — banner text in English, Spanish or Portuguese, trackers blocked pre-consent where required, and every consent logged so you have receipts if anyone ever asks.