LGPD for US Companies: When Brazil's Law Reaches You

Yes. Article 3 is activity-based, not establishment-based, the same design as GDPR Article 3. If your processing relates to offering goods or services to people located in Brazil, or the data was collected in Brazil (a visitor browsing from Sao Paulo counts as collection in Brazil), the law applies to that processing. What presence changes is enforcement mechanics, not coverage: the ANPD can still order blocking of processing, impose fines collectable against Brazilian revenue or partners, and Brazilian users can sue in Brazilian courts.

The analysis mirrors GDPR targeting doctrine: Portuguese-language content aimed at Brazil, pricing or payment in reais (including Pix or boleto support), shipping to Brazilian addresses, Brazil-specific marketing, app-store availability in Brazil with localized listings, and Brazilian customer support all indicate offering. A US-only store that happens to receive Brazilian visitors is weaker territory for coverage, though the 'collected in Brazil' prong can still capture analytics and tracking data from those visitors, which is why tracker governance matters even for non-targeting sites.

Seven items: (1) a scope memo documenting which flows are covered; (2) a Portuguese privacy-notice layer stating purposes and LGPD bases; (3) a designated, published encarregado, outsourced DPO services satisfy this; (4) DSR handling on the immediate/15-day clocks; (5) Brazilian SCCs on flows leaving Brazil, including to yourself; (6) breach-response alignment to the ANPD's 3-working-day rule; (7) consent mechanics for trackers and marketing matching the LGPD's specific-consent standard. Most of it configures existing GDPR machinery rather than requiring new systems.

Four channels. The ANPD can sanction directly and, more practically, order Brazilian processing blocked or data deleted, orders that app stores, payment processors, and local partners end up implementing, the Meta AI-training suspension (2024) is the template. Brazilian public prosecutors and Procons bring civil actions with damages. Data subjects hold private rights under Articles 42-45 with joint liability. And commercial pressure: Brazilian enterprise customers increasingly demand LGPD paper (SCCs, DPO, RIPD) in procurement, making non-compliance a sales blocker before it is a legal one.

Non-essential trackers need a lawful basis, and the ANPD's cookie guidance points to consent for advertising and analytics cookies, with legitimate interest defensible only for narrow measurement done with safeguards and a documented balancing test. The practical standard converges on GDPR-style prior consent: no ad-tech identifiers before an affirmative act by Brazilian visitors. Since the banner and tag behavior are externally observable, they are the likeliest first evidence in any complaint, geo-scoped consent for Brazil (or a global consent default) closes it.