Portuguese 
English 
Spanish 
5 min of reading 
0 comments 
ANPD Investigates Pharmacies for Misuse of CPF and Health Data; Discount Routine Becomes Serious Case in LGPD and Changes Pharmacy Retail Rules.
In 2024, the National Data Protection Authority (ANPD) turned its attention to one of the most common habits of Brazilian consumers: providing their CPF at the pharmacy counter to receive discounts. This gesture, repeated millions of times a day at the registers of large chains, began to be treated with rigor after the ANPD itself published a Specific Technical Note on Pharmacy Retail, outlining risks, legal requirements, and potential violations involving the collection of health information.
The investigation opened a new chapter in the relationship between consumers, pharmacies, and loyalty programs, revealing sensitive data treatment practices that had previously gone unnoticed.
Starting in 2023 and throughout 2024, the ANPD is conducting sanctioning processes and inspections in the sector, especially after finding that pharmacy chains were requesting not only the CPF but also purchase history, medications purchased, registration data, consumption preferences, and in some cases, additional information to “customize offers”.
The critical point: medications are directly associated with health data, a category considered sensitive by the LGPD.
Health Data and LGPD: Why Pharmacies Became a Risk Case – CPF That You Provide at the Pharmacy
The General Data Protection Law (LGPD) defines sensitive data as any information related to the health of the data subject. This includes diagnoses, treatments, exams, and even the purchase of medications that, in themselves, reveal clinical conditions.
-
Meta’s new smart glasses are not just for seeing; they use artificial intelligence, analyze your food, summarize messages, and can even change the way you work in professions like engineering.
-
According to an analysis by NASA, only one human-made structure is visible from space, and it is not the Great Wall of China or the Pyramids of Egypt.
-
After 377 years of history, the Brazilian Army will have its first female general: Colonel Claudia Cacho has been promoted to brigadier general by Lula and will receive the sword and command baton this Wednesday in Brasília.
-
A Mercado Livre customer opened their package and found 32 resumes of people looking for jobs crumpled as protective paper inside the box, exposing names, addresses, documents, and phone numbers of dozens of candidates.
When a customer provides their CPF to access discounts, the pharmacy begins to link the identification number to a detailed history that allows inferring diseases, recurrent use of controlled medications, chronic treatments, and family health patterns.
The ANPD’s Technical Note highlighted that the pharmacy retail sector has been using this data for profiling, targeted advertising, loyalty programs, and even sharing with third parties, including laboratories and business partners.
This practice, when carried out without explicit consent, violates the legal bases of the LGPD.
The Authority also emphasized that consumers must be clear about:
- why the data is being collected;
- who will have access to it;
- how long it will be stored;
- whether it will be shared;
- and how they can exercise their rights to exclusion or opposition.
The scenario revealed that most Brazilians had no idea of the extent of this data flow. Many believed that the CPF was requested only to release the discount, when in fact it integrated a high-value data treatment system for the sector.
Loyalty Programs and the ANPD’s New Scrutiny
The loyalty programs of pharmacies are one of the pillars of revenue in retail. They generate massive databases that fuel statistical processes, pricing, sales monitoring, and marketing campaign targeting. However, a significant part of these programs is now undergoing legal review.
The ANPD pointed out that the consent collected at the counter—often quick and without adequate explanation—does not meet the LGPD requirements. For sensitive data, consent must be:
- free,
- informed,
- specific,
- highlighted,
- and unequivocal.
In other words: the pharmacy needs to explain, before collecting, the exact reason why the CPF is being requested and how the data will be treated. The mere act of providing the number cannot be interpreted as automatic authorization for advertising or data sharing.
The ANPD’s investigation also identified the need for clear retention policies. Databases that accumulate years of purchases pose a leak risk.
The Authority itself warned that, in the event of an incident involving health data, penalties may be more severe due to the sensitive nature of this information.
Inspection and Sanctioning Processes in Retail
Although the ANPD keeps the detailed content of ongoing processes confidential, the Technical Note on pharmacy retail and public communications made in 2024 confirm that national chains underwent rigorous analysis. The procedure includes:
- request for internal documents,
- evaluation of privacy policies,
- verification of data flow,
- security criteria,
- and sharing practices.
The inspection also extends to software vendors that operate loyalty program systems. These companies, often outsourced, store massive databases containing records of medication purchases linked to the customer’s CPF.
The ANPD’s understanding is that if the data is linked to medications, it does not matter if the pharmacy uses it only to provide discounts: it is sensitive data and requires enhanced protection.
Impact on the Sector and Changes Required by ANPD
Based on the ANPD’s recommendations, pharmacies needed to adjust internal procedures, reorganize privacy notices, and create new consent mechanisms. One of the central points of the review pertains to the very act of requesting the CPF: the consumer must be informed before providing the number, not afterwards.
The pharmaceutical sector also faces the challenge of revising contracts with partner companies. Laboratories that offered discount programs linked to health data now need to comply with new rules that demand transparency and traceability.
For experts, this case has the potential to become one of the milestones of the practical application of LGPD in everyday life. For the first time, millions of Brazilians have begun to realize that providing CPF in seemingly harmless environments involves a much broader data ecosystem.
The Consumer and New Rights
With ANPD’s action, the consumer gained more clarity about their rights. When asked for the CPF at the pharmacy, they can:
- ask what the purpose is;
- demand an explanation of the treatment;
- refuse to provide it without losing the right to make a purchase;
- revoke consent later;
- request the deletion of their data.
The law also establishes that pharmacies cannot impose embarrassment on customers who choose not to participate in loyalty programs. Similarly, they cannot condition mandatory discounts—those defined by law, such as on generic medications—to the provision of personal data.
As a result of the ANPD’s investigations and guidance, the everyday act of providing CPF at the counter has taken on new meaning: it is not just a way to obtain a discount, but an entry point into a sensitive and highly valuable database.
A New Chapter in Everyday Privacy
Oversight of pharmacy retail has become an emblematic case to demonstrate how data protection in Brazil has ceased to be an abstract discussion.
Now, it is present at the moment a citizen buys medications for headaches, antidepressants, controlled substances, or simple vitamins.
Each purchase reveals intimate aspects of their health, routines, and vulnerabilities and the LGPD requires that this content be treated not automatically or indiscriminately.
By placing the sector under scrutiny, the ANPD has raised the standard of protection and forced companies to recognize that personal data is not just numbers: it is sensitive information that requires responsibility and security.
-
-
3 pessoas reagiram a isso.