GRCLibrary.ai

Register

Cookie and Tracker Register

This register inventories cookies, similar storage technologies, and tracking technologies operated on the organization's websites, mobile applications, embedded surfaces, and partner-integrated channels. It supports the consent management framework, the privacy notice, and the ePrivacy and equivalent obligations across the EU, UK, and other jurisdictions with prior-consent or opt-in requirements for non-essential tracking. For Brazil, Article 7 IX of the Marco Civil da Internet (Lei 12.965/2014) gives internet users a right ("ao usuário são assegurados") of express consent regarding the collection, use, storage and processing of personal data ("consentimento expresso sobre coleta, uso, armazenamento e tratamento de dados pessoais"), and that consent must be set apart from the other contract clauses ("que deverá ocorrer de forma destacada das demais cláusulas contratuais"); neither that law nor the LGPD mentions cookies, and LGPD Article 7 provides that the processing of personal data may only be carried out in the cases ("hipóteses") it lists, one of which is upon the provision of consent by the data subject, and Article 8 sets requirements for that consent and provides that it may be revoked at any time by express manifestation of the data subject ("mediante manifestação expressa do titular"). Separately, the ANPD's guidance on cookies (the "guia orientativo" listed under Framework alignment) states that, although there is no hierarchy or preference among the legal bases ("hipóteses legais") provided for in the LGPD, recourse to consent will be more appropriate when the collection of information is carried out by cookies that are not necessary ("cookies não necessários"), and that the use of cookies for audience measurement (analytical or measurement cookies) may be grounded in the legal basis of legitimate interest in certain contexts, subject in any case to the requirements provided for in the LGPD. In particular, the guide states that it is reasonable to suppose that the risks to the privacy of data subjects will be lower when the processing is limited to the specific purpose of identifying patterns and trends, based on aggregated data and without combination with other tracking mechanisms or without the formation of user profiles.

Type
Register
Version
1.0.8
Date
2026-10-31
Owner
Data Protection Officer
Approving authority
Governance Library Maintainer
Classification
Public
Confidentiality
Public
Category
Privacy
Review frequency
Quarterly and upon material change to website, mobile application, or marketing technology stack
Licence
CC BY-SA 4.0

Read the full text on GitHub (opens in a new tab)

Outline

  • Purpose
  • Scope
  • Category taxonomy
  • Register schema
  • Operating expectations
  • Metrics
  • Framework alignment
  • Limitations

Frameworks it maps to

Related documents