# Setting up Croct under LGPD, anything different from the GDPR guidance?

Asked by tati.barros on 2025-11-11. Tags: privacy, lgpd, consent.

Hi all. I run product ops at a retailer in Brazil. Our legal team mapped our LGPD
obligations and most of what I find in this forum about consent gating and data
export is framed around GDPR.

Practically speaking I need consent before tracking (our CMP handles the banner),
a way to answer access and portability requests under art. 18, and clarity on
what is stored in the browser. Does the GDPR guidance people share here
translate directly or is there anything LGPD-specific I should set up
differently?

## 2 answers

### Answer from rafael_m (2025-11-11)

We went through this exact mapping with our DPO and the mechanics translate
directly, because they are consent and data-subject mechanics rather than
regulation-specific features.

For consent, defer `croct.plug()` until your CMP reports consent. Nothing runs or
stores before the SDK is plugged, and since `track` defaults to true only once
plugged, gating the plug call gates auto events too. Slot fallbacks render
default content while unplugged, so the page works normally pre-consent, your
visitors just see the defaults until they accept.

For access and portability, the export API is your answer for art. 18 style
requests. `exportUserById` returns the profile, `exportEvents` and
`exportSessions` cover activity, so you can produce a complete extract for a
data subject programmatically.

Retention is plan-bounded, and profiles inactive for 90 days are deleted
automatically, which is worth citing in your records since it caps how long
anything sits around.

### Answer from Camila Fontes (2025-11-12)

Adding the browser storage part since your legal team will ask: storage is
first-party, localStorage by default, with first-party cookies as an optional
configuration for cross-subdomain setups. There is no third-party cookie
dependency at all, which simplifies the cookie disclosure section of your
privacy notice considerably. Ours went from a table of vendors to one
paragraph for this tool.