A vulnerabilidade do consumidor na era digital: comercialização de dados pessoais sem consentimento, à luz do artigo 7º, inciso I da Lei Geral de Proteção de Dados

Abstract

This study analyzes the application of the Brazilian General Data Protection Law (Law No. 13.709/2018 – LGPD) within the context of digital consumer relations, focusing on the validity of consent and the informational vulnerability of consumers in data processing practices. This research acknowledges that the increasing digitalization of commercial interactions has intensified the use of technologies aimed at collecting and analyzing personal information, demanding an integrated interpretation between the LGPD and the Consumer Defense Code. The study seeks to demonstrate that algorithmic manipulation and lack of transparency undermine the data subject’s autonomy, generating an invalid consent when obtained through deceptive or weak protection means. Using the hypothetical-deductive method, the research studies the normative foundations of data protection, the principles of good faith, purpose, and necessity, as well as the civil liability regime given to data controllers and processors. The analysis of practical cases, such as the incidents involving Raia Drogasil, Loggi, and 23andMe, reveals the materialization of risks coming from the irresponsible usage of personal data and highlights the importance of compliance with legal standards. The study concludes that the effectiveness of personal data protection depends not only on formal adherence to legal norms but also on adopting a culture of transparency, accountability, and respect for the consumer’s informational self-determination.