Israel has no cookie-specific law, but cookies that identify a visitor are personal data under the Privacy Protection Law, and Amendment 13, in force since 14 August 2025, backs the law with administrative fines of up to 5% of annual turnover. Opt-in consent for analytics and advertising cookies is the cautious approach for Israeli visitors, and a banner built for EU opt-in rules covers it. As of October 2026, the Privacy Protection Authority (PPA) has not issued a cookie fine.
Israel's Privacy Protection Law and how it applies to cookies
Israel enacted its Privacy Protection Law (PPL) in 1981, making it one of the earliest standalone data protection statutes outside Europe. The law governs the collection, storage, use and transfer of personal data held in databases, and it has been amended multiple times to keep pace with technological change.
Cookies are not mentioned anywhere in the PPL's text. There is no Israeli equivalent of the EU's ePrivacy Directive, and no dedicated regulation targeting browser-based tracking technologies.
That does not mean cookies fall outside the law's scope. Amendment 13 expanded "personal information" to any data related to an identified or identifiable person, which covers cookie identifiers that single out a browser. Setting analytics or advertising cookies on a visitor's device without proper notice can therefore breach the PPL's notice duty under section 11 and its consent requirements.
Essential and non-essential cookies under Israeli law
The PPA has not published a dedicated cookie guide. In practice, the line Israeli advisers draw follows the EU model:
Essential cookies: required for the basic functioning of the service (session identifiers such as
PHPSESSID, authentication tokens, load-balancing cookies). These do not need separate consent.Non-essential cookies: analytics trackers like
_ga, advertising pixels such as_fbpand similar third-party technologies. Opt-in consent before they load is the cautious approach.
This distinction mirrors the approach taken under the GDPR and ePrivacy framework, where cookie categories determine whether prior consent is needed. No Israeli rule requires opt-in for cookies in so many words, but ignoring the question carries risk. According to an IAPP analysis of Amendment 13, the PPA has indicated that it will enforce its many guidelines and directives as if they were binding law.
Amendment 13 is a turning point for Israeli data protection
Amendment 13 to the Privacy Protection Law was enacted in August 2024 and entered into force on 14 August 2025. It represents the most significant overhaul of Israeli privacy law in decades, aligning the framework far more closely with the GDPR.
Key changes relevant to website operators include:
| Area | Before Amendment 13 | After Amendment 13 |
|---|---|---|
| Personal information | Narrower statutory definition | Any data related to an identified or identifiable person |
| Highly sensitive information | "Sensitive information" | A new category close to the GDPR's special categories, including biometric, genetic, location and traffic data |
| Administrative fines | Limited sanctions, primarily criminal route | Calculated per data subject, capped at 5% of annual turnover for larger organisations |
| Small business cap | No specific cap | ILS 140,000 (about USD 45,000) per year |
| Privacy Protection Officer | Not mandatory | Required for organisations that meet size and industry criteria |
For cookies, the broader definition of personal information and the new administrative fines mean opt-in consent now matters more. Fines are calculated per data subject and vary by violation. In one example from a law-firm summary of the amendment, ILS 8 per data subject across a database of 1,000,000 people comes to ILS 8 million, so a high-traffic website can accumulate exposure quickly.
Israel's EU adequacy status and what it means for cookies
Israel holds an EU adequacy decision, meaning the European Commission recognises Israeli data protection standards as essentially equivalent to those within the EEA. The Commission kept the decision in place in its first review of the older adequacy decisions, published on 15 January 2024, and Israel remains on its list of adequate countries.
The adequacy status matters for cookies in a practical sense. If your website targets both EU and Israeli visitors, the consent mechanisms you deploy for the EU will generally cover Israeli visitors as well. A banner that collects opt-in consent before firing non-essential cookies goes further than Israeli law spells out.
Comparing Israel's cookie rules with the GDPR
Websites operating across both jurisdictions benefit from understanding where the two frameworks converge and diverge.
| Aspect | GDPR and ePrivacy | Israel PPL (post-Amendment 13) |
|---|---|---|
| Cookie-specific law | Yes, ePrivacy Directive, Article 5(3) | No, general data protection principles apply |
| Consent model | Opt-in for non-essential cookies | Not codified for cookies, opt-in is the cautious approach |
| Supervisory authority | National DPAs (CNIL, ICO and others) | Privacy Protection Authority (PPA) |
| Maximum fine | EUR 20 million or 4% of global turnover | 5% of annual turnover (Amendment 13) |
| Data protection officer | For large-scale processing, public bodies | Privacy Protection Officer for organisations meeting size and industry criteria |
The practical takeaway: if your site already meets EU cookie consent requirements, you are well positioned for Israel. The main gap is awareness: many website owners do not realise that Israeli law applies to data collected from visitors located in Israel, regardless of where the website is hosted.
Enforcement and recent PPA activity
The PPA has historically focused enforcement on database security breaches and unsolicited marketing rather than cookie tracking. As of October 2026, no cookie-related fine has been reported.
Smaller cases show the Authority acting on notice failures. In March 2025, the PPA fined EY and PwC Israel NIS 15,000 each for scanning visitors' ID cards at their Tel Aviv offices without the notice section 11 of the law requires. The PPA added that after Amendment 13, a breach of section 11 can carry much larger sanctions.
With Amendment 13's expanded enforcement toolkit now active, the PPA can issue administrative orders, monetary sanctions and cease-and-desist directives. It can also order the suspension of data processing entirely. Websites setting third-party cookies without notice or consent are increasingly exposed to regulatory action.
Checklist for Israeli cookie consent
Use this checklist to audit your website's cookie practices against Israeli requirements:
Audit your cookies: identify every cookie your site sets, including those placed by third-party scripts such as
_gaand_fbp. A cookie scanner automates this process.Categorise each cookie: separate essential cookies from analytics, marketing and functional cookies.
Use opt-in consent: block non-essential cookies until the visitor actively agrees. Pre-ticked boxes or implied consent through continued browsing are weak evidence of consent.
Display a clear cookie banner: explain what data you collect, why and which third parties receive it, as section 11 notice requires. Use plain language.
Publish a cookie policy: list each cookie by name, purpose, duration and provider. Link to it from your banner.
Record consent: store proof that each visitor consented, including timestamp and the categories they accepted.
Allow withdrawal: visitors must be able to change or revoke their consent at any time.
Check your database duties: Amendment 13 changed which databases must be registered or notified to the PPA, so confirm your position with an adviser if you hold sensitive data at scale.
Cookie consent for websites targeting the Middle East
If your website serves visitors across the Middle East, Israel's requirements sit alongside other regional frameworks. Saudi Arabia's PDPL imposes its own consent obligations for personal data processing, while Egypt's privacy law covers data collected from Egyptian residents. Turkey's KVKK follows a GDPR-influenced model with explicit consent requirements for cookies.
A banner that adjusts its consent model to the visitor's location handles these overlapping requirements. Kukie.io's geo-targeting applies the consent model you set for each region. The global compliance hub covers the rest of the world.
Questions about cookies and Israeli privacy law
Does Israel have a specific cookie law?
No. Israel does not have a dedicated cookie law equivalent to the EU's ePrivacy Directive. Cookies fall under the general Privacy Protection Law (1981), as amended by Amendment 13, whenever they collect personal information.
Do I need consent before setting cookies for Israeli visitors?
No Israeli rule requires opt-in for cookies in so many words, but cookies that identify a visitor are personal information and need notice and a legal basis. Opt-in consent before analytics and advertising cookies is the cautious approach. Essential cookies required for your site to function do not need separate consent.
What are the fines for privacy violations in Israel after Amendment 13?
Amendment 13 introduced administrative fines calculated per data subject, capped at 5% of annual turnover for larger organisations and ILS 140,000 per year for small and micro businesses. The amount per data subject varies by violation.
Is Israel considered GDPR-adequate for data transfers?
Yes. The European Commission has recognised Israel under an adequacy decision, kept after its review published on 15 January 2024, so personal data can flow from the EEA to Israel without additional safeguards such as standard contractual clauses.
Does Amendment 13 require a data protection officer?
Amendment 13 introduced a Privacy Protection Officer, the Israeli equivalent of a DPO, for organisations that meet size and industry criteria. Most small websites are unlikely to meet these thresholds.
Can I use the same cookie banner for EU and Israeli visitors?
In most cases, yes. A banner that collects opt-in consent before firing non-essential cookies, with a clear notice of purposes and recipients, meets the EU standard and goes beyond what Israeli law spells out.
Set up one banner for Israeli and EU visitors
Scan your site, review the cookies it finds and publish a banner that asks before optional cookies load. Kukie.io handles region rules, consent logging and script blocking, so the same setup serves visitors in Israel, the EU and elsewhere.
