LGPD for Google Ads and GA4: What a Small Business Must Do on Its Website

LGPD compliance (Brazil’s General Data Protection Law) in Google Ads and GA4 means your site tells visitors about cookies, lets them choose, and only fires ad and measurement tags according to that choice. A banner alone is not enough, because what counts is what the tags do after the click. This guide shows what to do, in order, and where the decision passes to your lawyer.

Advertisers on Google tend to hear two opposite claims about LGPD in Google Ads. One says the law blocks tracking. The other says a cookie notice in the footer is enough. Neither describes the real work, which is small but has to be done in the right order.

This article covers the practical side for small businesses. The technical side of Google’s consent protocol has its own guide, the one on consent mode v2. Here the focus is on what the law requires of your site and how that reaches your tags.

What LGPD requires of your site for Google Ads and GA4

The LGPD (Law 13,709/2018) covers personal data, and Google Ads and GA4 tags store cookies and identifiers tied to a visitor. That is why your site, not Google, is responsible for giving notice and asking for the visitor’s choice.

Google says this in its own documentation. On the help page about consent mode, it states that to get insights while protecting privacy, you need to collect consent from your site’s users, and it recommends doing this with a consent management platform (CMP) or your content management system. The same page warns that consent mode does not provide the banner. It only passes the choice on to the tags.

In practice, three pieces need to work together.

1. The notice and the visitor’s choice, which is the cookie banner.
2. The record of this choice, which the consent platform stores.
3. The Google tags, which read the choice and change what they do.

If one of the three is missing, the site is out of compliance. The most common case is a nice-looking banner with tags firing before any click.

Which Google tags are involved

Two families of tags matter for a small business: measurement tags, like GA4, and ad tags, like Google Ads conversion and remarketing. Each one stores different cookies and responds to a different consent signal.

According to the help page we opened, with analytics_storage denied, GA4 does not read or write its own analytics cookies and starts sending cookieless signals, which are used for modeling. With ad_storage denied, Google does not write new advertising cookies and does not read the ones that already existed. The ads_data_redaction key, when turned on together with ad_storage denied, erases click identifiers from Google Ads conversion signals.

Google also mentions ad_user_data and ad_personalization, the two keys that version 2 added. That help page does not describe them, which is why their explanation is in the consent mode v2 guide.

Cookie banner and LGPD in Google Ads

A banner that does its job has four functions: say which cookies exist and what they are for, let people refuse as easily as they accept, allow them to change their mind later, and link to the privacy policy. Brazil’s National Data Protection Authority (ANPD) published the guidance document “Cookies e Proteção de Dados Pessoais” (Cookies and Personal Data Protection) on October 18, 2022. On the release page, the ANPD recommends that data controllers use a cookie policy and a cookie banner, speaks of transparency so users can easily see what is collected, and says data subjects can withdraw consent at any time.

You can check the ANPD’s own text on the guide’s release page. The page also says that following the guide does not exempt you from the law’s other obligations.

Applied to a small business website, the right banner usually has these points.

• Short text in plain language, no legalese.
• Accept button and reject button with the same visual weight.
• Choice by category, with at least measurement and advertising separated.
• Link to the privacy policy and the cookie policy.
• A persistent shortcut in the footer to reopen the choices.

What doesn’t work

A banner with only an “accept” button, a banner that disappears on its own after a few seconds, and a banner that only informs while tags have already fired do not let the visitor truly choose. The ANPD guide (Brazil’s data protection authority) speaks of freely given consent, and a choice that doesn’t exist is not free.

How to apply the LGPD to Google Ads and GA4 tags

The golden rule is that the tag reads the choice before storing anything. You do this in Google Tag Manager by setting a default consent state and updating that state when the visitor clicks.

Google’s help page lists the practices it recommends. They include setting the initial consent state, loading the page’s tags before the dialog opens, showing the options as early as possible, updating the state when the visitor chooses, offering the option to grant or deny each type of storage, and using regional defaults when local rules require it.

If you use Google Tag Manager, the steps follow this order.

1. Install a Google-compatible consent management platform and turn on the banner.
2. Set the default state to denied for ads and analytics, before any tag.
3. Set up the event that updates the state when the visitor accepts or declines.
4. In GTM, check that each ad tag requires the ad_storage key and each measurement tag requires analytics_storage.
5. Test with Google Tag Assistant, both declining and accepting, and check that cookies only appear after acceptance.
6. Repeat the test on mobile, which is where most visits come from.

Basic or advanced

Google describes two modes. In basic mode, tags stay blocked until the visitor accepts, and visitors who decline generate no data at all. In that case GA4 can’t model behavior or conversions for those who declined, and Google Ads uses a general model. In advanced mode, tags load before the consent dialog and send cookieless signals when cookies are declined, which makes modeling possible.

Choosing between the two is a risk decision, and it’s yours to make together with your lawyer. Basic is more conservative. Advanced preserves more measurement.

What changes in your Google Ads account

With consent mode on, some conversions from visitors who decline are no longer counted directly, and Google estimates them instead. Your account keeps measuring what visitors have authorized. The rest depends on modeling, which only exists in advanced mode and with enough volume.

Three precautions are worth taking if you have campaigns running and are about to turn on consent mode.

• Check the conversions column before and after turning on the banner, over the same number of days. A partial drop is expected.
• Don’t change your bid target on the same day consent goes live. Changing two things at once makes it impossible to know what caused the shift.
• Turn on enhanced conversions only after consent is working and your privacy policy mentions them.

If the sale closes on WhatsApp or by phone, the measurement that holds up is the one that flows from your CRM back to Google. That’s what our CRM conversion tracking service does.

Website compliance checklist

This checklist covers what a small business website needs so the conversation with your lawyer goes quickly. Check off each item.

• A privacy policy is published, with the list of cookies and third-party tools.
• The banner appears on the first visit, on both mobile and desktop.
• Declining is as easy as accepting.
• No ad or measurement cookies appear before the visitor makes a choice, when the mode is basic.
• The visitor’s choice reaches your tags, with the default state and the update configured in GTM.
• The visitor can reopen and change their choice.
• Lead forms say what the data will be used for and link to the policy.
• Someone inside the company is responsible for answering data subject requests.
• Every new tool, such as a chat widget or a pixel, goes through the same test before it goes live.

For measurement itself, GA4 set up from scratch is the starting point. Without the right foundation, consent only patches a problem that was already there.

What Ciclicko does and where it stops

On our side, we review the site, set up consent in GTM and test the tags. The legal part stays with your lawyer. We don’t write privacy policies with legal validity and we don’t interpret the law for your case.

When we review a Google Ads account, we check whether consent reaches the tags, whether the main conversion is still counted and whether the banner is blocking something that should run. When a banner exists but the tags ignore the choice, the problem shows up in a Tag Assistant test within minutes.

Frequently asked questions

Does LGPD (Brazil’s General Data Protection Law) apply to my company’s Google Ads and GA4 setup? It does when your tags process visitors’ personal data. Cookies and identifiers tied to a browser count as that processing, so the site needs to inform visitors and collect their choice. How it applies to your case is a question for your lawyer.

Do I need a cookie banner to use GA4? Google states that you must collect site users’ consent in order to gather information while protecting their privacy, and it suggests using a consent management platform. In Brazil, the ANPD (the national data protection authority) also recommends a cookie policy and banner in its guide.

Does Google Ads work if a visitor declines cookies? The campaign keeps running, but that person’s conversion may not be measured directly. In advanced consent mode, Google estimates some of them through modeling.

Does consent mode replace the cookie banner? No. Google’s help page says it does not provide a banner and works alongside your consent management platform.

What is the difference between basic and advanced mode? In basic mode, tags only load after the visitor accepts. In advanced mode, they load first and send cookieless signals when the visitor declines, which allows modeling in GA4.

Has the ANPD published anything about cookies? Yes, the guidance “Cookies e Proteção de Dados Pessoais” (Cookies and Personal Data Protection), released on October 18, 2022 by Brazil’s data protection authority. It does not replace the obligations set by the law.

Want to check LGPD compliance in your site’s Google Ads setup?

We run the consent test, accepting and declining, and show you what fires in each case, along with the impact on the account’s conversions. See how Google Ads conversion tracking with a CRM works and request a review of your site.

This text is technical guidance, not legal advice. Confirm with your lawyer the legal basis, the policy text, and the consent model that apply to your business.