Yes, a website needs consent before setting non-essential cookies on the devices of visitors in Angola, and two laws say so. The Electronic Communications and Information Society Services Law (Law 23/11) forbids storing information on a user's device without prior consent unless it is strictly necessary for a service the user asked for, Angola's version of the EU cookie rule. The Personal Data Protection Law (Law 22/11) then requires express consent for the personal data those cookies collect, and the data protection authority, the APD, enforces it.
Angola's privacy laws and how they apply to cookies
Angola enacted its Lei de Protecção de Dados Pessoais (Personal Data Protection Law) as Law No. 22/11 on 17 June 2011. The law regulates how organisations collect, process and store personal data of individuals in Angola, in electronic and non-electronic form. Three days later, Law No. 23/11 of 20 June 2011 set rules for electronic communications and information society services, including the storage of information on users' devices.
According to DLA Piper's data protection summary for Angola, Law 23/11 allows storing or accessing information on a user's device only with the user's prior consent, based on clear and full information about the type of data, the purposes, the duration and any sharing with third parties. Technical storage for the sole purpose of transmitting a communication, or strictly necessary to provide a service the user expressly requested, is exempt. That is the legal basis for setting a session cookie like PHPSESSID without a banner, and for asking first for _ga, _fbp and similar identifiers.
Law 22/11 was modelled on Portuguese and EU data protection principles, giving it a familiar structure for anyone who knows the cookie laws of other countries.
Key principles of Law 22/11
Law 22/11 establishes several core principles that govern all personal data processing, including data collected through cookies. These principles mirror many found in European frameworks.
| Principle | What it means for cookies |
|---|---|
| Transparency | Visitors must be told what cookies your site sets and why |
| Legality | You need a lawful basis (typically consent) before setting non-essential cookies |
| Proportionality | Only collect cookie data that is relevant to the stated purpose |
| Good faith | Do not use deceptive practices to obtain consent or obscure cookie behaviour |
| Respect for private life | Cookie data must not be used in ways that infringe on visitor privacy |
| Purpose limitation | Data from cookies must only be used for the purpose disclosed at collection |
These principles apply regardless of whether your organisation is based in Angola or abroad, provided you process data belonging to individuals located in the country.
Consent requirements under Angolan law
Law 22/11 requires express consent from the data subject before processing personal data, with exceptions the law sets out. Law 23/11 adds the device rule: prior consent before storing information on the device, except where it is strictly necessary.
For website owners, this means you should present a cookie banner that gives Angolan visitors a real choice before analytics, advertising or social media cookies are activated. Strictly necessary cookies, those required for basic site functions like PHPSESSID or session tokens, may be set without consent under Law 23/11's exception.
Consent must be freely given, specific and informed. Pre-ticked boxes or bundled consent, where accepting cookies is a condition of using the site, would not meet the law's requirements. Your consent mechanism should let visitors accept or reject different cookie categories independently, and withdraw their choice later.
Sensitive data and cookies
If any cookies on your site collect sensitive personal data, such as health-related information, religious beliefs or political opinions, you face stricter obligations. Processing sensitive data requires a specific legal provision authorising it, plus prior authorisation from the APD. Most standard website cookies will not fall into this category, but health-sector websites and political platforms should audit their cookie inventory carefully.
The APD: Angola's data protection authority
The Agência de Protecção de Dados (APD) is Angola's supervisory authority for data protection. Its statute dates from 2016, and its current board was appointed by presidential decree in September 2019. Electronic communications rules under Law 23/11 are also monitored by the communications regulator, INACOM. Knowing how data protection authorities operate helps you anticipate what the APD looks for.
A notable feature of Angolan law is that you must notify the APD, or get its prior authorisation, before processing personal data, depending on the data and the purpose. The APD can exempt some processing from notification.
Recent enforcement
The APD publishes its sanction decisions on its website, and several appeared in June, July and August 2026. In deliberation 006/2026 of 10 August 2026, it fined Lizíria, Lda, which runs the Hotel Diamante, an amount in kwanza equivalent to USD 115,000. The hotel had not notified the APD or obtained its prior authorisation before processing its customers' data, and had not adopted adequate technical and organisational security measures. The APD says the amount reflects an extraordinary reduction because the company cooperated and improved its procedures.
Earlier fines on other organisations have been reported in the press, but the decision above is one you can read in full on the APD's own site.
Fines and penalties
Law 22/11 sets fines as US dollar amounts, payable in kwanza, rather than as a share of turnover. Breaches that can trigger fines include failing to notify the APD or obtain its authorisation, processing personal data without valid consent, inadequate security measures and unauthorised international data transfers. The August 2026 decision shows that the APD may combine several of these in one fine.
Compared with the GDPR, whose fines can reach 4% of global annual turnover, Angola's amounts are lower in absolute terms. For a small or medium business in the Angolan market, a six-figure dollar fine is still significant.
How Angola's law compares with the GDPR
Both frameworks share common roots: Law 22/11 drew on Portuguese and EU data protection traditions. But there are meaningful differences that affect how you approach cookies.
| Requirement | Angola | EU |
|---|---|---|
| Consent for cookies | Prior consent under Law 23/11, express consent under Law 22/11 | Consent under Art. 5(3) ePrivacy Directive |
| DPO appointment | Not required | Required in certain circumstances |
| Breach notification | None under Law 22/11. Providers of public electronic communications services must notify the APD and INACOM under Law 23/11 | 72-hour notification to the supervisory authority |
| Authority notification | Notify the APD or get its authorisation before processing | No prior notification needed |
| International transfers | APD approval for countries without adequate protection | Adequacy decisions, SCCs or BCRs |
| Fines | Fixed amounts in US dollars, payable in kwanza | Up to EUR 20 million or 4% of turnover |
| Right to erasure | Yes | Yes (Art. 17 GDPR) |
| Right of access | Yes | Yes (Art. 15 GDPR) |
The prior-notification model is the biggest practical difference. Under the GDPR it was dropped in favour of accountability and record-keeping. If you process Angolan visitors' cookie data, you may need to file a notification with the APD, and the August 2026 fine shows the APD treats a missing one as a breach.
International data transfers
Transferring personal data collected in Angola to servers outside the country needs care. If the receiving country does not offer an adequate level of protection, the transfer requires prior approval from the APD.
This matters for cookies because analytics platforms, advertising networks and third-party scripts routinely send data to servers in the United States, Ireland or elsewhere. If your site uses _ga (Google Analytics) or _fbp (Meta Pixel), the data generated from Angolan visitors may be transferred abroad, which can bring it under the APD's transfer rules.
Checklist for website owners
If your website receives visitors from Angola, these steps line your site up with Law 22/11 and Law 23/11.
- Audit your cookies. Run a cookie scan to identify every cookie your site sets, including those from third-party scripts.
- Classify cookies by purpose. Group them into strictly necessary, analytics, marketing and functional.
- Ask before non-essential cookies. Display a banner that requests consent before non-essential cookies are set, and make sure it blocks the scripts until consent is given.
- Write a clear cookie policy. List each cookie by name, purpose, duration and whether it involves international transfers. A cookie policy template helps.
- Check the APD notification. If you are established in Angola or target Angolan users, find out whether you must notify the APD or get its authorisation.
- Review international transfers. Identify which cookies send data outside Angola and assess whether APD approval is required.
- Keep consent records. Keep a log of when and how consent was obtained, since the APD may request it.
Cookie consent across Lusophone and African markets
Angola is one of several African countries with active data protection laws. If your website targets several African markets, look at the rules in neighbouring and culturally linked countries too, and at the privacy laws around the world that apply to your visitors. Mozambique's data protection rules share some of Angola's Portuguese legal heritage. Nigeria's NDPR framework takes a different approach but also requires consent for cookie-based tracking.
South Africa's POPIA is one of the most developed data protection frameworks on the continent and a useful benchmark. Geo-detection lets you apply the consent rules you set for each country based on the visitor's location.
The draft revision of Law 22/11
The APD put a draft revision of Law 22/11 out for public consultation from 17 March to 17 April 2025. As of October 2026, the APD's website still lists the draft, and no revised law has been published there. Website owners should keep an eye on it, as a revised law may add breach notification, cookie-specific rules or new penalty levels.
Questions about Angola's privacy law and cookies
Does Angola have a specific cookie law?
Not a cookie-only law, but Law 23/11 on electronic communications and information society services requires prior consent before storing information on a user's device, unless it is strictly necessary for a service the user asked for. Law 22/11 then governs the personal data those cookies collect.
Do I need a cookie banner for Angolan visitors?
Yes. Law 23/11 requires prior consent before non-essential cookies are stored, and Law 22/11 requires express consent for the personal data they collect, so a banner that blocks non-essential cookies until the visitor chooses is the practical way to meet both.
What fines can the APD impose?
Law 22/11 sets fines as US dollar amounts payable in kwanza. In August 2026 the APD fined a hotel operator the equivalent of USD 115,000, already reduced for cooperation, for failing to notify the APD and for inadequate security measures.
Is Angola's data protection law similar to the GDPR?
Law 22/11 shares principles with the GDPR, including consent and data subject rights. Key differences are no DPO requirement, no general breach notification duty, and a prior-notification or authorisation model with the APD before processing begins.
Can I transfer cookie data from Angola to servers abroad?
Transfers to countries without adequate data protection require prior APD approval. Since most analytics and advertising cookies send data to foreign servers, assess whether your cookie-related transfers meet this requirement.
Does Law 22/11 apply to websites based outside Angola?
The law applies to processing the personal data of individuals in Angola, regardless of where the controller is established. If your website collects cookie data from Angolan visitors, Law 22/11 is relevant to you.
Set the consent rules for visitors from Angola
Most sites set more cookies than their owners expect. Kukie.io scans your site, blocks non-essential scripts until a visitor accepts, applies the consent model you choose for each country and records every choice.
