← ALL REGULATIONS
POPIA cookie consent for sites with visitors in South Africa.
POPIA does not name cookies, but cookies that collect personal information need a lawful basis, and for tracking and advertising that is usually consent. Direct marketing by electronic communication needs an opt-in.
POPIA at a glanceConsent, with exceptions
- Applies to
- Processing in South Africa, including by businesses outside it that use means in South Africa
- In force
- 1 July 2020, enforced since 1 July 2021
- Enforced by
- Information Regulator
- Penalties
- Administrative fines up to R10 million, and imprisonment for some offences
WHAT POPIA REQUIRES
What POPIA asks of a site that uses cookies.
THE RULEA lawful basis for cookies that collect personal informationProcessing must rest on consent or another justification in section 11, such as legitimate interests.
WITH KATLAIn GDPR mode, which Auto uses for South African timezones, cookies outside the functional category wait for an opt-in.
THE RULEOpt-in for electronic direct marketingSection 69 requires consent before direct marketing by electronic communication.
WITH KATLAKatla’s marketing category waits for an opt-in in GDPR mode. Consent for marketing emails and messages is outside what a cookie banner does.
THE RULEOpennessPeople must be told what is collected and why when it is collected (section 18).
WITH KATLAKatla scans the site, classifies every cookie it finds and generates the cookie policy from that list, in 13 languages.
THE RULEWithdrawal and objectionPeople can withdraw consent, or object to processing, at any time.
WITH KATLAA floating settings icon, or your own "Cookie settings" link calling katla.open(), reopens the choice on any page.
POPIA questions, answered
A summary for website owners, not legal advice. Reviewed against the sources below.
- Does POPIA require a cookie banner?
- Not by name, but cookies that collect personal information need a lawful basis, and for analytics and advertising consent is the usual one.
- What are the penalties?
- Administrative fines of up to R10 million, and imprisonment of up to 10 years for the most serious offences.
- Who enforces POPIA?
- The Information Regulator, which can investigate complaints and issue enforcement notices and fines.
- When did POPIA take effect?
- Most of the Act commenced on 1 July 2020, with a one-year grace period that ended on 1 July 2021.
See what your site sets before anyone asks.
The free plan scans your site, classifies every cookie and generates the policy, without a card. The cookie checker needs no account at all.