“The Controversial Application of the LGPD to AI Platforms.”
An article by Partner Flávia Pietri was published on Portal Conjur and republished on Debate Jurídico.
The General Data Protection Law (LGPD), enacted in 2018, establishes strict guidelines for the processing of personal data in Brazil. With the advancement of artificial intelligence (AI) technologies, the application of the LGPD to these tools has sparked intense debates within legal and academic circles.
Recently, a survey published by the Getulio Vargas Foundation (FGV) highlighted the complexities and challenges arising at the intersection of data protection and the development of AI-based solutions, pointing out that none of the systems used in Brazil are fully compliant with this legislation.
The study analyzed the seven main platforms used in Brazil: ChatGPT, Gemini, Claude, Copilot, Grok, DeepSeek, and Meta AI.
One of the researchers, Professor Luca Belli, assessed that “the scenario of AI tools for privacy ranges from low to alarming,” with non-compliance on basic LGPD requirements.
A major point of controversy is the definition of what constitutes “personal data” in the context of AI. Companies using machine learning algorithms often process large volumes of data, which may include personal information but also anonymized or aggregated data. FGV points out that the interpretation of the LGPD should be adapted to consider the specificities of AI, avoiding an overly rigid application that could hinder technological innovation.
Another controversial issue concerns the extraterritorial application of the LGPD, as it applies to any personal data processing operation carried out by individuals or companies located in Brazil, regardless of where the data is processed. Moreover, it also applies to entities outside Brazil that process data of individuals located within Brazilian territory.
This aspect has been hotly debated, as some argue it is unfeasible to require an online service provider to comply with the legislation of every country from which users may access it. Indeed, the topic is controversial.
However, it is important to consider that this level of legal compliance is already required for subsidiaries in different countries when analyzing compliance rules for international companies and groups. It is also worth emphasizing that, precisely because of this necessity, e-commerce channels strategically plan in which countries their domains can be accessed, so they can predict which legislations they will be subject to.
Another relevant aspect is the legal basis for data processing, considering that AI platforms do not have the capability to filter incoming data for which they have authorization to use. Using consent as the legal basis would make this impossible, given the difficulty of obtaining clear and informed consent.
The FGV study suggests that AI companies should develop transparent mechanisms allowing users to understand how their data is being used, promoting a culture of responsibility and trust, as well as accountability regarding the use of third-party data on the platforms.
The Importance of Ongoing Dialogue
As seen, the complexity of the issue lies in the responsibility of these platforms regarding data provided by their users, who may be using data they do not own. Moreover, they often lack any authorization or consent for its use or any other legal basis provided by the LGPD. This is foreseen in the draft bill (PL) of the New Civil Code. A bill specifically addressing the responsibility of these platforms, including social networks, was recently shelved.
FGV also highlights the need for ongoing dialogue between regulators, technology companies, and data protection experts. The creation of specific and effective guidelines for the application of the LGPD in AI contexts could help balance the protection of data subjects’ rights with the promotion of innovation. Collaboration among these stakeholders is essential to ensure legislation keeps pace with the rapid evolution of technologies.
Finally, the controversy around the application of the LGPD to AI platforms reflects a larger challenge: how to regulate a constantly changing field without stifling innovation. As the debate progresses, it is crucial that companies stay informed about the legal implications of their data processing practices and that lawmakers consider AI’s particularities when drafting rules aimed at protecting citizens’ rights. Finding a balance between protection and innovation will be key to the future of technology in Brazil.
Flávia Pietri is a partner in the Corporate Advisory Law area and a specialist in Digital Law and Data Protection at Nascimento e Mourão Advogados.
Portal Conjur, April 15, 2025, 9:23 PM.
https://www.conjur.com.br/2025-abr-15/a-polemica-aplicacao-da-lgpd-as-plataformas-de-ia/
https://www.debatejuridico.com.br/opiniao/a-polemica-aplicacao-da-lgpd-as-plataformas-de-ia/
