← ALL REGULATIONS
Japan APPI and cookies: notice first, consent for some transfers.
Japan has no general opt-in rule for cookies. The APPI requires consent when cookie data sent to a third party will be linked to a person there, and the Telecommunications Business Act requires many online services to tell users what their tags send to third parties.
APPI at a glanceNotice, consent in some cases
- Applies to
- Businesses handling personal information of people in Japan, including from abroad
- Cookie rules
- APPI rules on personally referable information (2022), and the Telecommunications Business Act’s rule on external transmission (2023)
- Enforced by
- Personal Information Protection Commission (PPC)
- Penalties
- Fines up to ¥100 million for companies that breach PPC orders
WHAT APPI REQUIRES
What Japanese law asks of a site that uses cookies.
THE RULEConsent before a recipient links cookie data to a personWhen cookie IDs or browsing data go to a third party that will link them to personal data, the provider must confirm that the person consented.
WITH KATLAIn GDPR mode, which Auto uses for Japanese timezones, advertising and analytics cookies wait for an opt-in, so the consent exists before any tag runs.
THE RULETell users what tags sendThe Telecommunications Business Act requires covered services to publish or notify what user information their tags send to third parties, to whom and why, unless they get consent or offer an opt-out.
WITH KATLAKatla scans the site, classifies every cookie it finds and generates the cookie policy from that list, in 13 languages. The scan lists the vendor behind every cookie, which is the starting point for that notice.
THE RULESpecify the purpose of useBusinesses must specify the purpose of using personal information, and publish it or tell the person.
WITH KATLAKatla’s generated policy describes each cookie and its purpose. APPI-specific wording is not generated, so check the policy against the Act.
THE RULENotices in JapaneseNotices have to be understandable to the people they are for.
WITH KATLAKatla’s banner is available in Japanese. Generated policies are not yet available in Japanese.
APPI questions, answered
A summary for website owners, not legal advice. Reviewed against the sources below.
- Do Japanese websites need cookie consent?
- Not as a general rule. Consent is needed when cookie data given to a third party will be linked to a person there, and the Telecommunications Business Act adds a notice duty for data that tags send to third parties.
- What is personally referable information?
- Information about a person that does not identify them on its own, such as a cookie ID or browsing history. Since 2022 the APPI requires consent when it is provided to a recipient who will link it to personal data.
- What are the penalties?
- Companies that breach an order from the Personal Information Protection Commission face fines of up to ¥100 million, and individuals can face imprisonment.
- Does the APPI apply to foreign companies?
- Yes, when they handle the personal information of people in Japan in connection with supplying goods or services to them.
See what your site sets before anyone asks.
The free plan scans your site, classifies every cookie and generates the policy, without a card. The cookie checker needs no account at all.