Law No. 22.520 of 2023, ban on abusive requests for a consumer's personal data
Lei nº 22.520, de 28 de dezembro de 2023, com a redação da Lei nº 24.211, de 8 de abril de 2026
In force since .
A privacy notice rule binding public and private bodies.
- Obligation class
- Prohibition, Disclosure, Consent
- Audit expectation
- none
What it requires
- This is a Goiás state consumer law, and it binds a supplier of products or services, public or private, that asks a consumer for personal data.
- Do not ask a consumer for personal data abusively, meaning in a way that does not comply with federal law, above all the General Personal Data Protection Law (LGPD) (art. 1 and § 1).
- When you offer special conditions or advantages in return for the consumer's consent to the processing of personal data, tell the consumer the purpose of the processing, and observe good faith, transparency and the other principles of article 6 of the LGPD (art. 2, I).
- In that case, also tell the consumer whether the personal data you process will be shared, and with which public or private entities (art. 2, II).
- If the consumer refuses to provide the personal data, tell the consumer the consequences of the refusal, since the special conditions and advantages are not guaranteed (art. 2, sole paragraph).
These lines are LexLint's reading of the law's text.
What it makes you log
Logging duty
Article 1 bars an abusive request for personal data, article 2 requires the consumer to be told the purpose of the processing, whether the data will be shared and the consequences of a refusal, and article 3 sets the sanctions. None of these articles requires a log or a record.
- Kind
- None
- As of
What this law does
A supplier of products or services, which under the federal Consumer Defense Code may be a public or private person, may not ask a consumer for personal data abusively, which means demanding the data in a way that does not comply with federal law, above all the General Personal Data Protection Law (LGPD).
A supplier may offer special conditions and advantages in return for the consumer's consent to the processing of personal data, provided that the consumer is told the purpose of the processing and the supplier observes good faith, transparency and the other principles of article 6 of the LGPD, and that the consumer is told whether the personal data will be shared and with which public or private entities.
If the consumer refuses to provide the personal data, the supplier must tell the consumer the consequences of the refusal, and the special conditions and advantages are not guaranteed. A breach carries the sanctions of article 56 of the federal Consumer Defense Code and of article 52 of the LGPD, as far as they apply.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .