GDPR, LGPD and LFPDPPP, explained

If your site has visitors from Europe, Brazil and Mexico — common for any business in the Americas — you're inside three privacy frameworks at once. They rhyme, but they are not the same law, and the differences decide what your cookie banner must do.

GDPR — European Union & UK

The strictest of the three. For non-essential cookies (analytics, ads, social pixels) GDPR requires prior opt-in consent: nothing loads until the visitor actively agrees, rejecting must be as easy as accepting, and consent must be recorded so you can prove it later. Fines scale to €20 million or 4% of global revenue, whichever is higher — and enforcement against ordinary businesses, not just big tech, has been routine for years.

LGPD — Brazil

Brazil's Lei Geral de Proteção de Dados follows GDPR's shape: consent must be free, informed and unambiguous, and data subjects get similar rights (access, deletion, portability). Sanctions from the ANPD reach 2% of revenue in Brazil, capped at R$50 million per infraction. In practice: if your banner is GDPR-grade and shows up for Brazilian visitors in Portuguese, you're working in the right direction.

LFPDPPP — Mexico

Mexico's federal data protection law predates GDPR and works differently: its centerpiece is the aviso de privacidad (privacy notice) that tells people what data you collect and why, with INAI as the enforcing authority and fines that can reach millions of pesos. Cookie consent matters here as part of giving real notice and choice about tracking — and Mexican enforcement has been getting steadily more active.

The practical problem: one site, three rulebooks

Showing every visitor the strictest banner is legal everywhere but costs you consent rate where the law is lighter. Showing everyone the lightest banner is non-compliant where it's stricter. The clean solution is geo-routing:

• EU/UK visitor → strict opt-in banner, trackers blocked until consent.
• Brazilian visitor → LGPD banner, Portuguese, opt-in for non-essential.
• Mexican visitor → LFPDPPP notice and consent in Spanish.
• Everyone else → your choice of default, without EU-grade friction.

That's the core design of Cookie Rocket Pro: it detects each visitor's country and applies the right framework automatically — banner text in English, Spanish or Portuguese, trackers blocked pre-consent where required, and every consent logged so you have receipts if anyone ever asks.