New Zealand has no cookie law and no opt-in requirement for cookies. The Privacy Act 2020 applies whenever cookies collect personal information about an identifiable person, and its information privacy principles require you to tell visitors what you collect, why and who receives it, and to collect it fairly. Since May 2026, a new principle, IPP 3A, also requires notice when you collect information about people from someone other than them.
New Zealand websites do not need opt-in cookie consent
Do New Zealand websites need cookie consent? Not in the EU sense. The Privacy Act 2020 sets no prior consent rule for cookies, unlike the EU's ePrivacy Directive. It relies on transparency and fairness: tell visitors about tracking that collects personal information, collect only what you need and collect it in a way that is not unfair or unreasonably intrusive. A clear banner or notice is the practical way to do that.
The Privacy Act 2020 came into force on 1 December 2020, replacing the Privacy Act 1993. It applies to every "agency" that collects, holds, uses or discloses personal information, which includes any organisation running a website that sets cookies able to identify a visitor, whether a _ga analytics cookie, a _fbp marketing cookie or a session identifier like PHPSESSID.
The Office of the Privacy Commissioner (OPC) is the independent regulator. It enforces the Act and publishes guidance, and online tracking falls within its scope whenever the data can be linked to an identifiable person.
The information privacy principles that matter for cookies
The Act is built around the information privacy principles (IPPs), which cover the whole life of personal information. Several of them shape how a website handles tracking.
| IPP | Subject | What it means for cookies |
|---|---|---|
| IPP 1 | Purpose of collection | Collect personal information only for a lawful purpose connected with your functions |
| IPP 2 | Source of collection | Collect it from the person directly where possible |
| IPP 3 | Direct collection: what to tell people | Tell visitors what you collect, why and who receives it |
| IPP 3A (since May 2026) | Indirect collection: what to tell people | Notify people when you collect their information from someone else |
| IPP 4 | Manner of collection | Collection must be lawful, fair and not unreasonably intrusive |
| IPP 5 | Storage and security | Protect cookie data against loss, misuse and unauthorised access |
| IPP 10 | Limits on use | Do not use information for a different purpose without a basis |
| IPP 11 | Disclosure | Limits sharing with third parties |
| IPP 12 | Disclosure outside New Zealand | Overseas disclosure needs comparable protection or the person's authorisation |
How IPP 3 shapes your cookie banner
When you collect personal information directly from someone, IPP 3 requires reasonable steps to make sure they know about it. For cookies, that means disclosing which cookies your site sets, the purpose of each and whether third parties receive the data.
A clear cookie banner with a cookie policy behind it meets that need. Name the categories and say what each does, rather than burying the detail in legal text.
The Act does not prescribe opt-in or opt-out. There is no equivalent of the GDPR's prior consent for cookies, and the emphasis is on transparency and fair collection.
IPP 3A has applied since May 2026
The Privacy Amendment Act 2025 added IPP 3A, which the OPC says came into force in May 2026. It covers personal information an agency collects about someone from a source other than that person.
The agency that collects indirectly must take reasonable steps, as soon as reasonably practicable, to make sure the person knows that the information was collected, the purpose, the intended recipients, the name and address of the agencies collecting and holding it, any law that authorises or requires the collection, and their rights of access and correction.
For websites, IPP 3A matters when third-party tools send you information about your visitors: audience segments, enriched profiles or cross-site identifiers from an advertising network. If you receive that kind of data, you may need to tell visitors.
There are exceptions. The duty does not apply if the person was already told about all of these matters, for example by the agency that collected the information from them, or where the agency believes on reasonable grounds that not complying would not prejudice the person's interests, or that the information is publicly available.
The Act reaches agencies outside New Zealand
The Privacy Act 2020 applies to overseas agencies in relation to actions taken in the course of carrying on business in New Zealand, wherever the agency is based or the information is held. Targeting New Zealand customers, for example by selling to them or pricing in NZD, is the kind of activity that can amount to carrying on business there. A .nz domain on its own is not the test. This extraterritorial approach resembles the GDPR's.
IPP 12 adds a rule on disclosure overseas: the recipient's country must offer comparable protection, or the person must authorise the disclosure. Many analytics and advertising cookies send data to servers in the United States, so check where your data goes.
Which cookies collect personal information
The Act applies only to personal information, meaning information about an identifiable individual, and not every cookie meets that threshold.
A strictly necessary session token or a cookie that remembers a language or currency choice, without tracking behaviour, is unlikely to identify anyone on its own. Analytics cookies such as _ga assign a unique identifier and follow browsing over time, and combined with other data they can relate to an identifiable person. The same applies to marketing cookies such as _fbp and advertising pixels that build cross-site profiles.
The careful approach is to treat any cookie that assigns a unique identifier or tracks behaviour as collecting personal information.
Enforcement and complaints
The OPC investigates complaints and can issue compliance notices requiring specific steps. Failing to comply with a compliance notice is an offence with a fine of up to NZD 10,000.
The Act also requires notification of notifiable privacy breaches: if a privacy breach has caused or is likely to cause serious harm, you must notify the OPC and the people affected. Individuals can take unresolved complaints to the Human Rights Review Tribunal, which can award damages, including for humiliation and loss of dignity.
Practical steps for websites with New Zealand visitors
- Scan your site: find every cookie and tracker, including those set by third-party scripts. A cookie scanner lists them for you.
- Categorise them: strictly necessary, functional, analytics and marketing.
- Show a clear notice: tell visitors what cookies you use, why and who receives the data, as IPP 3 requires.
- Offer a real opt-out: the Act does not require prior consent, but letting visitors decline non-essential cookies supports fair collection under IPP 4. Consent models explains the options.
- Check overseas transfers: confirm IPP 12 is met where analytics or advertising data leaves New Zealand.
- Review indirect collection: if you receive information about visitors from third parties, decide how you meet IPP 3A.
New Zealand compared with other privacy regimes
New Zealand sits between the EU's opt-in model and narrower sector-based approaches. The comparison with Australia and the EU:
| Feature | NZ Privacy Act 2020 | GDPR and ePrivacy Directive | Australia Privacy Act |
|---|---|---|---|
| Cookie-specific law | No | Yes (ePrivacy Directive) | No |
| Consent model | Transparency-based | Opt-in for non-essential cookies | Transparency-based |
| Reaches overseas businesses | Yes | Yes | Yes |
| Breach notification | Mandatory | Mandatory (72 hours) | Mandatory |
| Maximum penalty | NZD 10,000 for ignoring a compliance notice | EUR 20 million or 4% of worldwide turnover | The greater of AUD 50 million, three times the benefit or 30% of adjusted turnover, for serious interferences |
| Regulator | Office of the Privacy Commissioner | National authorities | OAIC |
New Zealand's fines are modest by international standards. Complaints, tribunal damages and lost trust are the larger risks. The Australia Privacy Act guide covers the neighbouring regime, and the privacy laws by region overview compares more countries.
Questions about the NZ Privacy Act and cookies
Does New Zealand have a cookie consent law?
No. New Zealand has no standalone cookie law. The Privacy Act 2020 applies to cookies and tracking technologies when they collect personal information about identifiable individuals.
Do I need a cookie banner for a New Zealand website?
The Act does not explicitly require one. A banner is the most practical way to meet the IPP 3 duty to tell visitors what you collect through cookies, why and who receives it.
What is IPP 3A and when did it take effect?
IPP 3A was added by the Privacy Amendment Act 2025 and came into force in May 2026. It requires agencies that collect personal information about someone from another source to tell that person about the collection, its purpose, the recipients and their rights, unless an exception applies.
Does the NZ Privacy Act apply to websites outside New Zealand?
Yes, for overseas agencies carrying on business in New Zealand, wherever the agency is located or the data is held.
Are analytics cookies like Google Analytics covered by the Privacy Act?
Analytics cookies that assign unique identifiers and track browsing are likely to collect personal information. Treat cookies like _ga as in scope and tell visitors about them.
What are the penalties for breaching the NZ Privacy Act?
Ignoring a compliance notice is an offence with a fine of up to NZD 10,000. Individuals can also take claims to the Human Rights Review Tribunal, which can award damages.
Give New Zealand visitors notice and a way to decline
Kukie.io lets you set region rules per site, so New Zealand visitors can see a notice or opt-out banner while visitors from the EU get opt-in, and every choice is stored as a consent record.
