Japan's Act on the Protection of Personal Information (APPI) does not require consent for cookies by default. Cookies become regulated when their data is linked to an identifiable person, when it is shared with a third party that can identify people from it, or, for some large online services, when the Telecommunications Business Act requires notice of data sent to third parties. As of October 2026, the APPI is also changing: Act No. 56 of 2026, promulgated on 17 July 2026, adds the Personal Information Protection Commission's first monetary surcharge and new rules for children and biometric data.
What the APPI is
The APPI is Japan's main data protection law, first enacted in 2003 as Act No. 57, fifteen years before the GDPR applied. A major amendment in 2015, fully in force on 30 May 2017, created the Personal Information Protection Commission (PPC), the independent supervisory authority. The PPC's English legal page holds the consolidated text.
Next came the 2020 amendment, in force on 1 April 2022, which strengthened individual rights, tightened cross-border transfer rules and introduced personally referable information (PRI), the category that matters most for cookies. The law has a built-in review every three years, and the latest one led to the 2026 amendment.
How the APPI has changed
Who must comply
The APPI applies to businesses that handle personal information of individuals in Japan. Early versions covered only organisations holding records on at least 5,000 people, and the 2015 amendment removed that threshold when it came fully into force in 2017.
The reach is extraterritorial. Foreign companies that handle information about individuals in Japan in connection with providing goods or services to people in Japan are covered, much like under the GDPR, Brazil's LGPD and California's CCPA.
Key definitions that affect cookies
Personal information is information about a living individual that can identify them, alone or combined with other readily available data, including individual identification codes such as passport numbers or biometric identifiers.
Personal data is personal information that forms part of a systematically organised database. The third-party provision rules apply to personal data.
Special care-required personal information covers sensitive categories such as race, creed, social status, medical history and criminal record. Acquiring it requires prior consent.
Personally referable information (PRI) is information that does not identify anyone in your hands but may do so once a recipient combines it with data it holds. Cookie identifiers, browsing histories and IP addresses often fall into this category. If you provide PRI to a third party that will use it as personal data, you must confirm that the recipient has obtained the individual's consent.
How Japan regulates cookies
Under the EU's ePrivacy Directive, storing or reading information on a device needs consent unless strictly necessary. The APPI has no equivalent rule, and cookies are not personal information by default.
Cookies come under the APPI in two situations. If cookie data is linked to an identifiable person, for example after a user logs in, it is personal information. If it goes to a third party that can combine it with other data to identify people, it is PRI.
The Rikunabi case of 2019 shows why the PRI rules exist. Rikunabi, a job-seeking platform, used cookie-based browsing data to calculate how likely each student was to decline a job offer and sold those scores to recruiting companies without consent. The PPC issued recommendations, and the case led directly to the 2020 PRI rules.
The Telecommunications Business Act
The amended Telecommunications Business Act (TBA) regulates cookies more directly. Its external transmission rule, in force since 16 June 2023, applies to online services with a significant impact on users' interests, such as social media, messaging, e-commerce marketplaces, search engines and streaming platforms. Simple corporate websites that show only the company's own information are generally outside it.
When a covered service sends information stored on the user's device, such as cookie identifiers or browsing history, to a third party, the operator must notify users in advance of what is sent and to whom, obtain consent, or offer an opt-out. Data needed for the service itself, such as authentication, security and load balancing, is excluded.
How Japan's privacy law affects ad tracking
Japanese law does not ban ad tracking or require opt-in consent for advertising cookies as such. It regulates what happens to the data. Sharing cookie data with an ad network that can tie it to a person needs that person's consent under the PRI rules, and large online services covered by the TBA must disclose or offer an opt-out for data sent to third-party tags. The first-party versus third-party distinction therefore matters more in Japan than the cookie category does.
First-party data you collect and use yourself is the easier route under the APPI: specify the purpose, tell users, and keep it within that purpose. The 2026 amendment eases some consent requirements further, but does not remove the PRI consent rule.
APPI and GDPR compared
| Aspect | Japan APPI | EU GDPR |
|---|---|---|
| Cookie consent | Not required by default. PRI rules apply when data goes to a third party that can identify people | Required for non-essential cookies under the ePrivacy Directive |
| Legal basis | Purpose specification and notice, plus consent for sensitive data, third-party provision and some transfers | Six lawful bases, including legitimate interests |
| Sensitive data | Race, creed, social status, medical history, criminal record and others | Includes biometrics, political opinions and trade union membership |
| Supervisory authority | Personal Information Protection Commission (PPC) | National authorities |
| Breach notification | A prompt preliminary report, then a final report within 30 days (60 for unlawful attacks) | 72 hours under Article 33 |
| Monetary sanctions | Criminal fines today, plus a PPC surcharge from a date set by Cabinet Order, by 17 July 2028 | Administrative fines up to EUR 20 million or 4% of worldwide turnover |
| Data protection officer | Not mandatory | Mandatory in specific cases |
The EU-Japan mutual adequacy decision
In January 2019 the European Commission adopted an adequacy decision for Japan, and the PPC recognised the EU in return, the first mutual adequacy arrangement. The PPC's Supplementary Rules add protections for personal data transferred from the EU and, since then, the UK. The Commission's first review in April 2023 confirmed the arrangement and moved reviews to every four years.
Personal data can therefore flow between the EU and Japan without standard contractual clauses, as long as the Japanese recipient follows the APPI and the Supplementary Rules. South Korea has a similar EU adequacy decision, covered in South Korea's PIPA.
Enforcement and the 2026 amendment
Until the amendment takes full effect, the PPC enforces in steps: guidance, then recommendations, then binding orders. Criminal penalties apply mainly when a business ignores an order or provides a personal information database unlawfully, with fines for companies of up to 100 million yen.
The amendment was approved by the Cabinet on 7 April 2026, passed by the Diet on 10 July 2026 and promulgated on 17 July 2026. According to a summary of the Act by A&O Shearman, it brings in:
- An administrative surcharge. The PPC can order one only when five conditions are all met: a specified kind of violation, money or other consideration received for it, a failure to take reasonable care, significant harm, and more than 1,000 people affected. The amount follows the consideration received.
- Rules for under-16s. Where consent or notice is needed, it is in principle obtained from or given to the child's legal representative, and the child's best interests come first.
- Specified biometric personal information. Advance notice of purpose and type, a right to stop its use, and no provision to third parties under the opt-out route.
- Wider consent exceptions, including provision to third parties solely for statistical outputs such as AI training, under transparency conditions.
- Heavier criminal penalties for unlawful provision of personal information databases.
Stronger criminal penalties apply from 17 January 2027. The surcharge, the children's and biometric rules and the consent changes apply from a date set by Cabinet Order, no later than 17 July 2028.
Practical steps for website owners
Audit your cookies and scripts. Find which ones send data to third parties, and whether those third parties can identify people from it. A cookie scanner lists what your site sets.
Check whether the TBA applies. Marketplaces, social platforms and other covered services must give notice, obtain consent or offer an opt-out for external transmissions.
Update your privacy notice. Specify the purposes of use, and for international transfers describe the destination country and its protection.
Collect consent for third-party sharing where it identifies people. Sending cookie data to ad networks that link it to individuals triggers the PRI consent check. If you also serve EU visitors, geo-targeting lets you apply opt-in in the EU and a different model in Japan.
Prepare for 2027 and 2028. Review how you handle data of under-16s and any biometric data before the amendment's main rules apply. The privacy laws by region overview tracks Japan alongside other countries.
Questions about Japan's APPI
Does the APPI require cookie consent for all websites?
No. Cookies are not personal information by default. Consent comes into play when cookie data is provided to a third party that will use it to identify people (the PRI rules) or when it involves special care-required information. Cookies for your own site's functions generally need no consent under Japanese law.
What is the External Data Transmission Rule under the TBA?
In force since 16 June 2023, it requires certain large online services to notify users in advance, obtain consent or offer an opt-out when information stored on the user's device, including cookie data, is sent to third parties.
Does the APPI apply to websites outside Japan?
Yes. It covers foreign businesses that handle information about individuals in Japan in connection with providing goods or services to people in Japan.
What are the penalties for APPI non-compliance?
Today, criminal fines of up to 100 million yen for companies, mainly after a PPC order is ignored or for unlawful provision of databases. The 2026 amendment adds a PPC surcharge for serious, profit-driven violations affecting more than 1,000 people, from a date no later than 17 July 2028.
Can data flow freely between the EU and Japan?
Yes. A mutual adequacy arrangement has applied since January 2019 and was confirmed in the 2023 review. No standard contractual clauses are needed if the Japanese recipient follows the APPI and the Supplementary Rules.
What did the 2026 APPI amendment change?
Act No. 56 of 2026, promulgated on 17 July 2026, adds an administrative surcharge, consent through legal representatives for under-16s, rules for specified biometric information, wider consent exceptions for statistics and AI training, and heavier criminal penalties from 17 January 2027.
Apply different consent rules for Japan and the EU
Kukie.io detects the cookies your site sets, lets you set region rules so visitors in Japan and the EU see the model each region calls for, and keeps a record of every choice.
