Argentina's Law 25,326: cookie rules for Argentine visitors

What is Argentina's data protection law?

Law 25,326 on the Protection of Personal Data was passed on 4 October 2000 and partly promulgated on 30 October 2000; Regulatory Decree 1558/2001 implements it. It gives effect to the habeas data guarantee in Article 43 of the Argentine Constitution. Argentina was the first Latin American country to receive an adequacy decision from the European Commission, in 2003, which lets personal data flow from the EU without extra safeguards. Proposals to replace the law with a GDPR-style text have been presented to Congress, but Law 25,326 remains the law in force.

The control authority is the Agencia de Acceso a la Información Pública (AAIP), which took over this role in 2017 from the former National Directorate for Personal Data Protection. The AAIP issues interpretive criteria, keeps the national registry of databases, investigates and imposes sanctions.

Who does the law apply to?

Article 1 covers personal data held in files, registers, databases or other technical means of processing, whether public or private. Personal data is information of any kind about identified or identifiable people, and the law also extends, where relevant, to legal persons. A website or app operated from Argentina, or that keeps a database of Argentine users, falls under it. The law sets no size threshold, so small businesses are covered too.

Sensitive data is data revealing racial and ethnic origin, political opinions, religious, philosophical or moral convictions, trade union membership, and health or sex life information. Under Article 7 no one can be forced to provide it, and it may be collected only for reasons of general interest authorized by law or for statistical or scientific purposes when people cannot be identified.

What does the law require for cookies?

Argentina has no rule written for cookies, so the general principles apply whenever a cookie or similar identifier processes personal data.

Consent must be express. Article 5 says processing is unlawful when the person has not given free, express and informed consent, which must be recorded in writing or by another means that can be treated as equivalent, according to the circumstances. If consent is given together with other statements, it must appear expressly and prominently. That is a higher bar than the tacit consent accepted in Mexico or the opt-out model in US states: silence, continued browsing or a pre-ticked box is hard to defend as express consent.

Exceptions. Consent is not needed when data comes from unrestricted public sources, is collected for state functions or a legal obligation, is limited to basic identification data in listings, or derives from a contractual, scientific or professional relationship and is necessary for it. Cookies strictly needed to deliver a service the visitor asked for, such as a shopping cart or login session, can rely on the contractual exception. Analytics and advertising cookies generally cannot.

Information first. Article 6 requires informing people, before collection and in an express and clear way, of the purpose and the recipients or categories of recipients, the existence of the database and the identity and address of its controller, whether answers are mandatory, the consequences of providing or refusing data, and the rights of access, rectification and deletion.

Advertising profiles. Article 27 allows data to be used to build profiles for promotional, commercial or advertising purposes, or to establish consumption habits, only when the data appears in publicly accessible documents, was provided by the person, or was obtained with consent. The person can access that data free of charge and ask at any time to be withdrawn or blocked from such databases.

A banner for Argentine visitors that explains the purposes and recipients, keeps analytics and advertising cookies off until the visitor accepts, and lets the visitor withdraw later meets these rules. Recording the choice helps prove the consent Article 5 requires.

What are the penalties?

Article 31 lets the control authority impose warnings, suspension, fines of ARS 1,000 to ARS 100,000, and closure or cancellation of the file, register or database, without prejudice to civil damages and criminal penalties. AAIP Resolution 126/2024, published on 24 May 2024 and applicable since 1 June 2024, classifies infringements and grades the sanctions:

Each infringement is sanctioned separately and accumulated. When a decision includes several fines for identical conduct, the total is capped at 500 times the top of the relevant scale, which is ARS 40 million for minor, ARS 45 million for serious and ARS 50 million for very serious infringements. Paying within 20 working days of notification halves the fine. People can also bring a habeas data action in court and claim damages.

How Cookiequiet handles Argentina

Argentina is not in Cookiequiet's default list of regulated countries, so add it to a custom list with geo-targeting, which is free on every plan, and Argentine visitors will see the consent banner: Accept all and Reject all with the same weight, categories off until chosen, and a Spanish text taken from the browser language and editable. Scripts wait for consent, and each choice goes to the consent log. The cookie scanner lists the cookies to describe under Article 6. For the rest of the region, see Brazil's LGPD, Chile and Mexico.