Essential digital legal solutions for your website

The cookie banner must follow an opt-in model, meaning that no non-essential cookies may be activated by default. Users must take a clear and affirmative action to accept cookies. The options to accept, reject, and configure cookies must be presented in an equally visible and accessible manner. Consent must be informed, granular, and reversible.

Data subjects must submit their requests to the organisation responsible for processing their personal data through the available channels, such as an online form, email address, or equivalent communication method. The organisation has 30 calendar days to respond, which may be extended by an additional 30 days if necessary.

An important exception applies to requests for temporary blocking. In these cases, the organisation must respond within two business days and may not continue processing the affected data while the request remains unresolved.

If the organisation rejects the request, either wholly or partially, the individual may file a complaint with the Personal Data Protection Agency.

The APDP is the new independent public authority created by Law No. 21,719 to oversee compliance with data protection legislation. Its powers cover three main areas:

• Regulatory Powers: It may issue binding regulations, interpret legal provisions, and propose legislative reforms.
• Supervisory Powers: It may request documentation from data controllers, summon individuals with relevant information, and audit compliance programmes.
• Enforcement Powers: It may impose fines, resolve complaints submitted by data subjects, and order the temporary suspension of data processing activities for up to 30 days in the most serious cases.
• The Agency is also responsible for maintaining the National Register of Sanctions and Compliance.

Any security incident that poses a risk to the rights of data subjects must be reported to the Personal Data Protection Agency. Although the law does not establish a specific number of hours or days for notification, it requires organisations to report breaches “through the most expeditious means possible and without undue delay.” This means companies must act as quickly as reasonably possible. Concealing or failing to report a breach is classified as a very serious infringement and may result in fines of up to 20,000 UTM.

The main obligations include:

• Compliant Cookie Banner: Use an opt-in model, ensure that non-essential cookies are disabled by default, and provide clear information about their purposes.
• Active Consent: Remove pre-ticked boxes and provide free and accessible mechanisms for withdrawing consent.
• Accessible Privacy Policy: Publish clear information regarding who processes personal data, for what purposes, for how long, with whom the data is shared, and how users can exercise their rights.
• Data Subject Rights Channels: Establish communication channels through which individuals can exercise their rights of access, rectification, erasure, objection, portability, and blocking, and respond within 30 calendar days, extendable by a further 30 days.
• Privacy by Design: Collect only the personal data strictly necessary for the intended purpose and implement safeguards such as encryption or pseudonymisation before processing begins.

Under Law No. 21,719, consent must satisfy four requirements: it must be freely given (without pressure or conditions), informed (the user must understand what data is collected, why it is collected, how long it will be retained, and whether it will be shared with third parties), specific (for a clearly defined purpose), and unambiguous (expressed through a clear affirmative action). Pre-ticked boxes and passive consent mechanisms are prohibited. Furthermore, individuals have the right to withdraw their consent at any time and without providing any justification. Businesses must therefore offer withdrawal mechanisms that are as simple as the methods used to obtain consent.

Law No. 21,719 grants six key rights to data subjects:

• Access: The right to know whether an organisation processes their personal data, what information it holds, the purposes of processing, and with whom it has been shared.

• Rectification: The right to correct inaccurate, outdated, or incomplete personal data, such as an incorrect delivery address.

• Erasure: The right to request the deletion of personal data when it is no longer necessary for the original purpose or when consent has been withdrawn.

• Objection: The right to object to the use of personal data for direct marketing, personalised advertising, or profiling activities.

• Portability: The right to receive a copy of personal data in a structured electronic format and transfer it to another service provider.
• Block: The right to suspend the processing of personal data while a request for rectification, erasure, or objection is being resolved. During this period, the organisation may not continue using the affected data.

The law applies to any natural or legal person, whether public or private, that processes personal data in Chile. However, its scope extends beyond Chile’s borders. It also applies to foreign organisations when their activities are directed at offering goods or services to individuals located in Chile or when they monitor the behaviour of individuals within Chilean territory. This includes, for example, international digital platforms with Chilean users, foreign marketplaces selling to Chilean consumers, and applications that track user activity in Chile.

Law 21.719 was published on December 13, 2024, and will come into effect on December 1, 2026

Law No. 21,719 replaces Chile’s previous data protection framework to align it with modern international standards. Among its most significant innovations are the creation of the Personal Data Protection Agency (APDP), an independent supervisory authority with enforcement powers; the recognition of new data subject rights, such as data portability and temporary data blocking; and the requirement for explicit and active consent for data processing, eliminating practices such as pre-ticked boxes. The law also introduces a tiered sanctions regime, with fines of up to 20,000 UTM for the most serious infringements.

It may apply. The determining factor is not where the business is established, but whether it targets consumers residing in the European Union. For example, an online store based in the United States, the United Kingdom, or Latin America may still be required to comply with EU consumer protection rules if it markets products or services to EU consumers.

No. Exercising the right of withdrawal must be completely free of charge for consumers. Any costs associated with implementing, maintaining, or managing the withdrawal mechanism must be borne entirely by the business.

Certain exceptions are established by law. These include customised or personalised products, perishable goods, sealed products that cannot be returned for health or hygiene reasons once unsealed, and certain digital content where performance has begun with the consumer's prior express consent. In such cases, businesses must clearly inform consumers in advance that the right of withdrawal does not apply or will be lost under specific circumstances.

As a general rule, consumers have 14 days from receipt of the product or from the conclusion of the service contract. If the company fails to properly inform consumers about this right, the withdrawal period may be extended by up to 12 months.

No. Consumers may exercise their right of withdrawal without providing any justification and without incurring any penalty. The right of withdrawal is unconditional. While businesses may optionally ask for feedback for statistical or customer experience purposes, providing a reason can never be a condition for processing the withdrawal request.

The withdrawal mechanism must be clearly visible and easy to find on the website. Placing it exclusively within the Terms and Conditions, the Returns Policy, or lengthy FAQ sections could be considered an obstacle to the exercise of the consumer's rights. It is recommended to place it in intuitive locations, such as the customer account area, order history section, or website footer.

Yes. From 19 June 2026, it will no longer be sufficient for consumers to exercise their right of withdrawal through a generic contact form, email address, or other general communication channel. Whenever a right of withdrawal applies, businesses must provide a specific, direct, and easily accessible online mechanism that allows consumers to exercise this right. The purpose is to ensure that users do not have to search for alternative procedures or complete unnecessary steps to cancel a contract.

No, the widget has been designed to be very user friendly and allow the compliance of the website in accordance with art. 50 of the AI Act. You will see a floating widget that will accompany the user while navigating through the website. You can edit the look and feel.

Yes. Lawwwing’s AI Sentinel is compatible with any website or CMS, including WordPress, Shopify, WooCommerce, PrestaShop, Squarespace, Webflow, and any custom-coded website. Installation takes less than 2 minutes using a snippet or plugin.

If you already have Lawwwing installed, you simply need to activate it from the dashboard. No additional installation is required.

Lawwwing’s AI Sentinel can be purchased as a standalone solution, added to a Starter, Growth, or Professional plan, and is already included in the Comfort Pack at no additional cost. If you’re already a Comfort customer, you simply need to activate it from your dashboard. It’s also available as a standalone service for businesses that don’t need the rest of Lawwwing’s tools.

AI Sentinel is built to handle both large and small catalogs. We’ve designed flexible, modular plans so you can choose exactly what your website needs. It scans all images progressively and in the background, without slowing down your site. It also automatically detects when new content is uploaded and analyzes it instantly.

If you’re unsure which plan is right for you, contact us via chat or at hola@lawwwing.com — we’ll be happy to help you find the plan that best fits your website’s needs.

Lawwwing’s AI Sentinel uses proprietary detection models trained on millions of images. It analyzes visual patterns and characteristics that are invisible to the human eye and that distinguish real images from AI-generated ones, achieving over 98,5% accuracy.

The Artificial Intelligence Regulation (AI Act) establishes that any image generated or significantly manipulated by AI and published online must be clearly labeled when it could be misleading or confused with reality. For websites and ecommerce businesses, the labeling obligation comes into force on August 2, 2026 for new content, and on December 2, 2026 for existing published content.

What are you waiting for?

Your website must include clear legal texts, a valid cookie banner, forms with first-layer information that allow for explicit consent, mechanisms for users to exercise their rights, and appropriate security measures.

You will find all the information in this blog

Lawwwing automatically adapts your website to the regulation by generating customized legal texts, Privacy Policy and Cookie Policy, a cookie banner in accordance with the GDPR and ePrivacy, consent collection clauses in the first layer, and the rights management or DSAR form. All from a single, easy-to-use tool.

If your website does not comply with the GDPR, you can face very high financial penalties (up to 20 million euros or 4% of your global turnover). In addition, you run the risk of losing the trust of your users, which can directly affect your conversions and online reputation.

In the EEA, there are several regulations that govern the protection of personal data, product purchases, online services, AI use, etc. These regulations are constantly evolving and may vary slightly between countries, which makes keeping up with them very complex for any digital business.

Moreover, the penalties for non-compliance can be very high (up to 4% of annual revenue), but it also damages your reputation, SEO, and user trust. Lawwwing helps you avoid these risks easily.

Yes. Although European regulations are common, each country adapts them to its national legislation. Lawwwing generates personalized legal texts based on the country you operate in and the type of activity your business performs.

Yes. If your website receives traffic from EU countries or sells products or services to European users, you must comply with regulations such as the GDPR, the ePrivacy Directive, or consumer protection laws, even if your business is based outside the EU.

Yes. A website that complies with legal regulations builds more trust and reduces bounce rates. Also, by using a cookie banner and clear legal texts that comply with the new accessibility regulation (EAA), you're also optimizing your site for SEO. Lawwwing ensures your website is legally compliant without affecting the user experience.

Yes. If you sell, provide services to EU citizens or receive traffic from the EU, the GDPR applies even if your company is in another country. Lawwwing helps you meet all requirements, wherever you are.

Yes. Even if you do not sell directly, if you use cookies, tracking tools, contact forms or tools such as Google Analytics, this regulation applies. Lawwwing helps you to comply, whatever your type of website.

You may face financial penalties and lose the trust of your users. A poorly configured banner or emails sent without consent can be grounds for a complaint from your customers or users. Lawwwing helps you to prevent it easily.

With Lawwwing you can automatically scan your website to detect cookies, forms or legal texts that do not comply. This way you avoid risks and know where you need to act.

You can scan your website here and see what level of risk you are facing.

You could face fines of up to $7,500 per violation. You also risk losing user trust or receiving complaints if you don’t respect their privacy rights.

Yes. We adapt your legal texts and configurations to correctly reflect the use of third-party platforms (Stripe, Google Analytics, Meta Pixel, etc.), as required by law.

Yes. We include a cookie banner and consent mechanisms adapted to the requirements of the Mexican data protection law and compatible with international standards.

We include all the necessary legal texts (Privacy Policy, Legal Notice, Cookie Policy, Terms and Conditions of Sale, Terms of Use, etc.), cookie configuration according to GDPR and ePrivacy, legal forms with consent clauses, and support for legal updates.

Yes. Our service is designed for ecommerce of all sizes. Even if you sell only a few products or are just starting out, you still need to comply with regulations like the GDPR, TRLGDCU, and LSSI. Lawwwing adapts to your activity and helps ensure your site is legally compliant from the very beginning.

It includes a Privacy Notice, Terms and Conditions (with return policies, supplier identification, warranty clauses, and more), and an optimized Cookie Banner.
Everything is aligned with the LFPDPPP, the LFPC, and the NMX-COE-001.

Yes. If you sell through platforms, you still need to comply with Mexican regulations.
Lawwwing generates legal texts adapted to your sales model, whether you have your own website or use third-party channels.

Yes. We set up a legally valid banner that blocks non-essential cookies until the user gives their consent. In addition, we include a preferences panel so the user can modify their choices at any time from the footer or the preference center.

Yes. If your website receives visits from users in Brazil or sells there, you must comply with laws such as the LGPD, the CDC, and the Marco Civil, regardless of where your company is registered.

Yes, but most generic policies do not meet Brazil’s specific legal requirements.
Lawwwing ensures everything is updated and aligned with local legislation.

You may face legal penalties, financial fines, service blocks, or loss of user trust. Authorities like the ANPD or Procon can even intervene preventively.

Probably yes. The CPA requires very specific information, and many generic policies are not compliant.
Lawwwing ensures your privacy notice is clear, up to date, and legally valid in Colorado.

Yes. If you offer products or services to users in Colorado, Lawwwing adapts your website to comply with the law, no matter where your business is registered.

Yes. We include mechanisms that allow users to opt out of data sales or personalized advertising, and we’re preparing for universal opt-out, which will become mandatory as of July 2024.

We create and update your privacy notice, audit cookies, activate opt-out mechanisms, and configure consent for sensitive data, as required by law.

Yes. Lawwwing adapts your legal texts to comply with the national regulations applicable throughout Mexico, regardless of the state or city where you operate.

Lawwwing is a plug-and-play solution. It does not require any implementation work by the customer or third parties, but if you have any doubts about the installation, please contact us through the usual channels.

In order for the legal texts to be displayed on your website, the subscription must be active. Follow the instructions in the installation guide to implement Lawwwing on your website, from the platform of your choice.

Lawwwing helps you identify the cookies your website uses and provides you with the necessary legal texts to comply with the regulations. All cookies will be automatically scanned and classified once you register a website, and you will be able to view them from your Lawwwing profile.

The Starter and Growth plans include Spanish and English, while the Professional plan includes 4 languages, these languages can be configured directly in the "Configuration" section of the Lawwwing control panel.

Lawwwing can be installed on any website, either by directly copying our widget to your website or by using one of our plugins for web creation platforms. If you have any doubt, please contact us.

Of course! Make the user experience on your website unbeatable. With Lawwwing:

• We detect the font you use on your website and adapt the texts.
• You will be able to choose the background colors for the Cookies Banner, as well as for the buttons.
• You can choose the place and the way in which you want the Legal Notice, Privacy Policy, and Purchase Terms and Conditions to be displayed, either in the footer that we automatically install for you or through hyperlinks.

Yes! Currently our platform is in English and Spanish. If you need another language, contact us and we will provide you with a solution that fits your needs.

No, at Lawwwing we want you to stay with us, so when your subscription ends you can always unsubscribe without penalty.

To ensure that your website always complies with the regulations and changing criteria of the courts, tribunals, or data protection authorities, our team of specialized lawyers keeps all the texts up to date and updates them automatically because they are hosted on our server, so you can relax about the legal issues of your website.

To ensure that your website always complies with the regulations and changing criteria of the courts, tribunals, or data protection authorities, our team of specialized lawyers keeps all the texts up to date and updates them automatically because they are hosted on our server, so you can relax about the legal issues of your website.

• Access the "Plugins" tab in your WordPress Administration Panel.
• Click on add a new plugin and search for "Lawwwing"
• Install our plugin by clicking on Install.
• Once installed and activated, go to the WordPress Administration Panel in the new Lawwwing tab.
• You will need to fill out the form with 2 values that you can obtain in your user panel on our website https://lawwwing.com

Yes, you can install only the Cookie Banner, but to comply with privacy and cookie regulations, you need to make the Privacy Policy and Cookie Policy available to users of your website, and with Lawwwing you can get everything together. Why limit yourself to installing the Cookie Banner if you can ensure that your website complies with regulations?