Setting up Croct under LGPD, anything different from the GDPR guidance?
Hi all. I run product ops at a retailer in Brazil. Our legal team mapped our LGPD obligations and most of what I find in this forum about consent gating and data export is framed around GDPR.
Practically speaking I need consent before tracking (our CMP handles the banner), a way to answer access and portability requests under art. 18, and clarity on what is stored in the browser. Does the GDPR guidance people share here translate directly or is there anything LGPD-specific I should set up differently?
2 answers
We went through this exact mapping with our DPO and the mechanics translate directly, because they are consent and data-subject mechanics rather than regulation-specific features.
For consent, defer croct.plug() until your CMP reports consent. Nothing runs or stores before the SDK is plugged, and since track defaults to true only once plugged, gating the plug call gates auto events too. Slot fallbacks render default content while unplugged, so the page works normally pre-consent, your visitors just see the defaults until they accept.
For access and portability, the export API is your answer for art. 18 style requests. exportUserById returns the profile, exportEvents and exportSessions cover activity, so you can produce a complete extract for a data subject programmatically.
Retention is plan-bounded, and profiles inactive for 90 days are deleted automatically, which is worth citing in your records since it caps how long anything sits around.
Adding the browser storage part since your legal team will ask: storage is first-party, localStorage by default, with first-party cookies as an optional configuration for cross-subdomain setups. There is no third-party cookie dependency at all, which simplifies the cookie disclosure section of your privacy notice considerably. Ours went from a table of vendors to one paragraph for this tool.