Argentina's data protection law, Law 25.326 of 2000 (often called the PDPA), requires free, express and informed consent before personal data is processed, so analytics and advertising cookies that identify a visitor need opt-in consent. The Agencia de Acceso a la Información Pública (AAIP) enforces it. Argentina has held EU adequacy status since 2003, reconfirmed in January 2024, and as of October 2026 a bill to replace Law 25.326 is before Congress but has not passed.
Argentina's data protection framework and cookies
Argentina enacted its Personal Data Protection Act (PDPA), officially Law 25.326, in 2000, making it one of the earliest Latin American countries to regulate personal data processing. The law is enforced by the Agencia de Acceso a la Información Pública (AAIP), which also handles freedom of information requests.
The PDPA does not mention cookies by name. It predates the modern tracking ecosystem by several years. But its definitions of personal data and consent apply directly to any cookie that collects, stores, or transmits information linked to an identifiable person. If your site sets _ga, _fbp, or similar tracking cookies for visitors in Argentina, the PDPA's consent rules apply to you.
Argentina holds EU adequacy status: the European Commission confirmed in January 2024 that Argentine data protection standards remain adequate under the GDPR. That status means personal data flows freely between the EU and Argentina without additional safeguards, but it also raises the bar for what Argentine regulators and courts expect from data controllers.
What Law 25.326 requires for cookie consent
Article 5 of the PDPA states that processing personal data is unlawful without the data subject's free, express and informed consent, given in writing or by an equivalent means. Consent must be given freely, for a specific purpose, and based on clear information about what data is being collected and why.
For cookies, this translates to a straightforward rule: non-essential cookies that process personal data require opt-in consent before they are set. Strictly necessary cookies, those required for basic site functionality like PHPSESSID, do not require consent, since they do not serve a data collection purpose beyond the service the visitor requested.
The AAIP has not published cookie-specific guidelines in the way that CNIL in France or AEPD in Spain have. Enforcement remains principles-based rather than prescriptive. That said, the general consensus among Argentine privacy practitioners is that an opt-in model for analytics and marketing cookies is the safest approach.
Cookie categories under Argentine law
The PDPA does not define cookie categories. In practice, most organisations operating in Argentina apply a classification system similar to the one used under the GDPR and the ePrivacy Directive.
| Category | Examples | Consent required? |
|---|---|---|
| Strictly necessary | PHPSESSID, session tokens | No |
| Functional or preferences | Language selectors, UI settings | Recommended |
| Analytics | _ga, _ga_*, _hjSessionUser_* | Yes |
| Marketing or advertising | _fbp, _gcl_au, retargeting pixels | Yes |
Functional cookies sit in a grey area. If they store personal data or track behaviour across sessions, treat them as requiring consent. When in doubt, categorise conservatively.
The AAIP: enforcement powers and penalties
The AAIP classifies infringements as minor, serious or very serious under Resolution 126/2024, published on 24 May 2024, which replaced the earlier scale of Resolution 240/2022.
Fines range from ARS 1,000 to ARS 100,000 per infringement, and the AAIP can also issue warnings and suspend, close or cancel databases, depending on the seriousness. In practice, the monetary penalties are modest: Argentine peso devaluation has eroded their real value significantly.
Enforcement has historically leaned toward warnings rather than large fines. Most AAIP sanctions have been corrective in nature. As of October 2026, a new bill is before Congress: on 16 July 2026, a deputy filed bill 3397-D-2026 in the Chamber of Deputies to replace Law 25.326 with a new regime. An earlier government reform bill lapsed. Check the current bill's penalties before quoting figures.
Even under the current regime, a database suspension or closure is a serious operational risk. It affects far more than cookies.
EU adequacy: what it means for your website
Argentina received its original EU adequacy decision in 2003 and was reconfirmed in January 2024 alongside 10 other countries. This status carries practical implications for website operators.
If your business is established in the EU and processes data of Argentine users, you already apply GDPR standards. Those cover most PDPA requirements, with one notable exception: registering your databases with the AAIP. The reverse also applies: Argentine companies handling EU personal data can receive it without needing Standard Contractual Clauses.
The European Commission has recommended that Argentina enshrine certain protections currently found only in case law and sub-legislative guidance into formal legislation. The reform bills under consideration in Congress aim to address this.
How the PDPA differs from the GDPR
While the two frameworks share common principles, several gaps exist.
| Requirement | Argentina PDPA | EU GDPR |
|---|---|---|
| Consent standard | Free, express and informed | Freely given, specific, informed, unambiguous |
| Cookie-specific rules | None (general data protection principles apply) | ePrivacy Directive Article 5(3) plus national implementations |
| Data breach notification | No mandatory timeline in Law 25.326 | 72 hours to supervisory authority |
| DPO requirement | Not required | Required in certain cases |
| Maximum fines | ARS 100,000 per infringement | Up to EUR 20 million or 4% turnover |
| Database registration | Mandatory with AAIP | Not required (replaced by ROPA) |
| Right to erasure | Yes (suppression) | Yes (right to be forgotten) |
The database registration requirement is unique to Argentina. Any organisation that maintains a personal data file or database must register it with the AAIP. This includes databases populated through cookie-based data collection if they contain personal data.
Checklist for cookie consent in Argentina
Use this checklist to check your site against the current PDPA requirements for Argentine visitors.
Run a cookie scan to identify every cookie your site sets and classify each one by category
Block analytics and marketing cookies until the visitor gives express opt-in consent
Display a cookie banner in Spanish (or the visitor's language) with equal-weight Accept and Reject buttons
Provide granular category controls so visitors can consent to analytics separately from marketing
Publish a cookie policy listing every cookie by name, purpose, provider, and retention period
Allow visitors to withdraw consent at any time through a persistent settings link
Register any personal data databases with the AAIP if you store data collected from Argentine users
Keep consent records as proof of valid consent for each visitor
Re-check your setup whenever you add new third-party scripts or tracking tools
Argentina among Latin American privacy laws
Argentina's PDPA sits within a broader wave of data protection legislation across the region. Mexico's LFPDPPP, Colombia's Law 1581, Chile's new Law 21.719 and Peru's Law 29733 all share a European-influenced consent model. Brazil's LGPD is the most comprehensive, with explicit cookie-related guidance from the ANPD.
Argentina shares EU adequacy status in Latin America with Uruguay, adequate since 2012, and Brazil, whose adequacy decision the Commission adopted on 26 January 2026. For businesses operating across the region, Argentina's framework often serves as a practical baseline. The global compliance hub compares the region's laws.
A new law along the lines of bill 3397-D-2026 would bring Argentina closer to Brazil's LGPD in scope and enforcement power, if Congress passes it.
Questions about Argentina's cookie rules
Does Argentina require cookie consent on websites?
Argentina's PDPA requires express and informed consent before collecting personal data. Cookies that track behaviour or identify users, such as analytics and advertising cookies, fall under this requirement. Strictly necessary cookies do not require consent.
What is the AAIP in Argentina?
The AAIP (Agencia de Acceso a la Información Pública) is Argentina's data protection authority. It oversees enforcement of Law 25.326, handles complaints, maintains the database registry, and issues guidance on data protection matters.
What fines can the AAIP impose for cookie non-compliance?
Fines range from ARS 1,000 to ARS 100,000 per infringement under Resolution 126/2024. The AAIP can also issue warnings and suspend, close or cancel databases. Bill 3397-D-2026, filed in July 2026, would replace the law, but it has not passed as of October 2026.
Does Argentina have EU adequacy status for GDPR?
Yes. Argentina has held EU adequacy status since 2003. The European Commission reconfirmed this status in its review published on 15 January 2024, meaning personal data can flow between the EU and Argentina without Standard Contractual Clauses or other transfer mechanisms.
Do I need to register my cookie database with the AAIP?
If your website collects personal data from Argentine visitors and stores it in a database, you must register that database with the AAIP. This obligation applies regardless of where your business is located.
How does Argentina's cookie law compare to Brazil's LGPD?
Both require consent for non-essential data collection. Brazil's LGPD is more modern, with 10 legal bases for processing, a dedicated supervisory authority (ANPD), and explicit guidance on cookies. Argentina's PDPA is older and less specific about cookies, and a bill to replace it is before Congress.
Ask Argentine visitors in Spanish before cookies load
The rules only matter once your banner applies them. Kukie.io scans your site, shows a Spanish banner with Accept all and Reject all, blocks non-essential cookies until consent and keeps a record of each choice.
