Chile's new data protection law, Law 21.719, applies from 1 December 2026. From that day, non-essential cookies that process personal data need a lawful basis, in practice opt-in consent, and a new authority, the Agencia de Protección de Datos Personales, can fine up to 20,000 UTM. As of October 2026, a government bill to postpone the start to 1 December 2027 is before the Senate but has not passed, so 1 December 2026 is still the legal date.
Chile's data protection overhaul: from Law 19.628 to Law 21.719
Chile was the first country in Latin America to adopt a data protection law. Law 19.628, enacted in 1999, gave Chilean citizens basic rights over their personal data but lacked any real enforcement mechanism: there was no supervisory authority, no mandatory breach notification, and no meaningful penalties for violations.
After eight years of legislative debate, Chile's Congress approved Law 21.719 on 26 August 2024. The law was published on 13 December 2024 and applies from 1 December 2026, the first day of the 24th month after publication, giving organisations a two-year transition period.
On 1 September 2026, the government introduced a bill (boletín 18.623-07) to move that date to 1 December 2027 and to change how the Agencia's board is first appointed. As of October 2026, the bill is at its first stage in the Senate. Until it passes, plan for 1 December 2026.
The reform brings Chile into alignment with international standards, most notably the EU's General Data Protection Regulation (GDPR). It establishes an independent supervisory authority, introduces data breach notification obligations, and creates a tiered penalty system with genuine financial consequences.
What Law 21.719 means for cookies on your website
Law 21.719 does not contain a standalone cookie provision equivalent to the EU's ePrivacy Directive. Cookies are instead governed by the law's general data protection principles: transparency, purpose limitation, and consent.
When a cookie processes personal data, as most analytics and marketing cookies do because they assign unique identifiers to visitors, that processing falls within the scope of Law 21.719. This means you need a lawful basis before setting cookies like _ga or _fbp on a Chilean visitor's device.
Strictly necessary cookies, such as PHPSESSID or session tokens that keep a shopping cart functional, do not require consent because they serve a purpose the visitor explicitly requested.
The Agencia de Protección de Datos Personales is expected to issue specific guidance on cookies and similar tracking technologies after it becomes operational. Until that guidance arrives, applying an opt-in consent model for non-essential cookies is the safest approach.
The Agencia de Protección de Datos Personales
One of the most significant changes is the creation of Chile's first independent data protection authority. The Agencia de Protección de Datos Personales will have regulatory, investigative, and sanctioning powers.
Its responsibilities include supervising compliance with Law 21.719, issuing binding guidelines, administering sanctions, and serving as Chile's point of contact for international data protection cooperation. The Agencia can initiate investigations on its own or in response to complaints from data subjects.
This marks a fundamental shift. Under Law 19.628, individuals had to pursue civil court action to enforce their data protection rights, a slow and expensive process that rarely resulted in meaningful outcomes.
Consent requirements under the new law
Law 21.719 defines consent as a free, specific, informed and unambiguous indication of the data subject's wishes. Read that way, pre-ticked boxes and implied consent through continued browsing do not meet the standard, as they do not under the GDPR.
For your cookie banner, this translates to several practical requirements:
Visitors must take a clear affirmative action (clicking "Accept" or turning on specific cookie categories) before non-essential cookies are set
Consent must be granular: bundling cookie consent with acceptance of the terms of service does not count
Visitors must be able to withdraw consent with the same ease as giving it
Your cookie policy must explain which cookies you use, their purposes, and their retention periods
Consent records should be stored as proof of each choice
Children's data receives additional protection. Processing personal data of minors under 14 requires parental or guardian consent.
Fines and enforcement: the penalty structure
The penalty framework under Law 21.719 uses Chile's Unidad Tributaria Mensual (UTM), a monthly unit whose value in pesos is updated each month, as its currency unit. The tiered structure is as follows:
| Violation level | Maximum fine | Repeat infringement by a company that is not a small business |
|---|---|---|
| Minor | 5,000 UTM | Not applicable |
| Serious | 10,000 UTM | Up to 2% of annual revenue |
| Very serious | 20,000 UTM | Up to 4% of annual revenue |
The revenue-based fines apply to repeat infringements, not to every large company's first offence. Law-firm summaries also describe higher amounts for repeat infringements and a surcharge when a breach is not remedied, so check the sanction articles of the law for the exact rules that would apply to you.
The Agencia can also issue written warnings and order corrective measures, including temporary or permanent suspension of data processing activities.
How Chile's law compares to the GDPR
Law 21.719 borrows heavily from the GDPR's structure, but there are differences worth noting for organisations already familiar with EU compliance.
| Feature | Chile (Law 21.719) | EU (GDPR) |
|---|---|---|
| Supervisory authority | Agencia de Protección de Datos Personales | National DPAs (CNIL, ICO, etc.) |
| Maximum fine | 20,000 UTM, or 4% of revenue for repeat very serious infringements | 4% of global revenue or EUR 20 million |
| Data breach notification | Required, without undue delay | Required without undue delay, within 72 hours where feasible |
| Data subject rights | Access, rectification, erasure, portability, objection | Access, rectification, erasure, portability, objection, restriction |
| DPO requirement | Not mandatory for all controllers | Mandatory for certain controllers |
| Cookie-specific rules | General principles apply (no ePrivacy equivalent) | ePrivacy Directive + GDPR |
| Transition period | 24 months (until 1 December 2026) | Was 24 months (completed May 2018) |
The absence of a dedicated ePrivacy-style regulation means Chile's cookie rules are less prescriptive than those in EU member states. The Agencia's forthcoming guidance will likely fill this gap.
Checklist for website owners
If your website receives traffic from Chile, these steps will help you prepare before 1 December 2026:
Audit your cookies: run a cookie scan to identify every cookie and tracking technology on your site
Classify cookies by purpose: separate strictly necessary cookies from analytics, marketing, and functional ones
Show an opt-in banner: block non-essential cookies until visitors give explicit consent
Write a clear cookie policy: explain each cookie's name, purpose, provider, and duration in plain language
Offer granular consent: let visitors accept or reject individual cookie categories rather than offering only an all-or-nothing choice
Store consent records: keep timestamped proof of each visitor's consent decision
Respect withdrawal: provide an easy way for visitors to change their preferences at any time
Review third-party scripts: check that tools like Google Analytics, Meta Pixel, and advertising tags respect the visitor's consent state
Chile among Latin American privacy laws
Chile's reform is part of a broader trend across Latin America. Brazil's LGPD has been in force since 2020, with its own supervisory authority (the ANPD) actively issuing fines and guidance. Argentina maintains one of the region's oldest data protection frameworks and holds EU adequacy status. Colombia's Law 1581 has been enforced by the SIC since 2012, Peru's Law 29733 provides a consent-based model, and Ecuador adopted its own data protection law in 2021. The global compliance hub compares them.
For organisations operating across the region, the direction is clear: Latin American countries are converging on GDPR-style consent models. A consent management platform with geo-detection lets you apply the right consent model for each visitor's location.
Questions about cookies under Law 21.719
Does Chile's new data protection law apply to websites outside Chile?
Yes. Law 21.719 applies to any organisation that processes personal data of individuals located in Chile, regardless of where the organisation is based. If your website sets cookies on Chilean visitors, the law applies to you.
When does Chile's cookie consent requirement take effect?
On 1 December 2026. Law 21.719 was published on 13 December 2024 and applies from the first day of the 24th month after publication. A bill to postpone the date to 1 December 2027 was introduced in September 2026 but, as of October 2026, has not passed.
Do I need a cookie banner for visitors from Chile?
If your website sets non-essential cookies that process personal data, you should display a cookie banner requesting opt-in consent from Chilean visitors. Strictly necessary cookies do not require consent.
What is the maximum fine under Chile's new data protection law?
The maximum fine for very serious violations is 20,000 UTM. For a repeat very serious infringement, a company that is not a small business can instead be fined up to 4% of its annual revenue.
How does Chile's law differ from the GDPR for cookie consent?
Chile's law applies general data protection principles to cookies rather than having a separate cookie-specific directive like the EU's ePrivacy Directive. The consent standard is similar (free, specific, informed and unambiguous), but specific cookie guidance from the Agencia is still pending.
Is implied consent through continued browsing acceptable in Chile?
Unlikely. Law 21.719 defines consent as an unambiguous indication of the person's wishes, and continued browsing does not meet that standard in the GDPR's practice either. Ask for an affirmative choice before non-essential cookies load.
Get your banner ready before 1 December 2026
Detection, categorisation, blocking and consent records are the parts of cookie work that go stale when done by hand. Kukie.io handles them, and region rules let you switch Chilean visitors to opt-in on the day the law applies.
