Important notice for those who provide their CPF number when refueling at gas stations

In recent years, it has become common practice for gas stations and large chains to ask for customers’ CPF at the end of purchases, promising discounts and exclusive benefits in return. This strategy, adopted by chains such as Ipiranga, Petrobras and Shell, attracts consumers looking for savings, but raises significant concerns regarding privacy and legal compliance.

Since the General Data Protection Regulation (LGPD) came into force in September 2020, the GDPR considers sensitive personal data, requiring prior, clear and specific consent for its collection and use. Failure to comply with these legal guidelines may result in serious penalties for organizations.

Privacy and Legality

Privacy questions arise primarily because of the potential for misuse or leakage of this sensitive information. Although the LGPD provides exceptions for the use of data without explicit consent in certain legal circumstances, such as regulatory obligations, these exceptions do not apply to commercial purposes without the direct permission of the data subject.

Given this scenario, gas stations must not only obtain sufficient consent from customers, but also implement strong data security measures, such as encryption and employee training, to protect the information collected.

The National Data Protection Authority (ANPD) recently announced increased oversight of the excessive collection of personal information. In São Paulo, Law 17,301/2020 already explicitly prohibits claiming CPF from clients without clearly informing them of the purpose and opening the registration for the granting of benefits.

Understand your rights

It is important for consumers to know their rights and know how to exercise them. Each network has a specific process for deleting personal data, which is generally available on their privacy portals. Consumers have the right to request deletion or correction of their data if they feel it has been used inappropriately.

Given the high fines imposed by the LGPD, which can reach R$50 million, protecting your personal information becomes not only a legal issue, but also a commercial and ethical responsibility.