Chile's Law 21,719: cookie rules for Chilean visitors
Chile's Law 21,719, published on 13 December 2024, rewrites the 1999 privacy law on the GDPR model and is scheduled to apply from 1 December 2026. It reaches foreign websites that track or profile people in Chile, requires consent that is free, informed, specific, prior and unambiguous unless another legal basis applies, and creates the Agencia de Protección de Datos Personales with fines of up to 20,000 UTM, or 4% of annual revenue for large companies that reoffend. A government bill filed on 31 August 2026 would postpone the start to 1 December 2027; it was still in the Senate in October 2026.Quick facts
| Applies to | Controllers or processors established in Chile, and foreign ones whose processing offers goods or services to people in Chile or monitors their behavior, including tracking and profiling (Article 1 bis) |
| Consent model | Consent must be free, informed, specific, prior and unambiguous, by a statement or a clear affirmative act (Article 12); other bases include contract and legitimate interest (Article 13) |
| Cookie rule | No cookie-specific article; tracking and profiling of people in Chile is within scope, and people can object to marketing and profiling (Articles 1 bis, 8, 8 bis) |
| Authority | Agencia de Protección de Datos Personales, an autonomous technical agency created by the law |
| Maximum penalty | Up to 5,000 UTM (minor), 10,000 UTM (serious) or 20,000 UTM (very serious); up to three times for repeat offenses; for companies that are not small businesses, repeat serious or very serious offenses up to 2% or 4% of annual revenue |
| In force since | Not yet: scheduled for 1 December 2026; bill No. 18.623-07 to postpone it to 1 December 2027 pending in the Senate in October 2026 |
What is Chile's Law 21,719?
Law 21,719 was published in the Diario Oficial on 13 December 2024. It amends Law 19,628 of 1999 on the protection of private life so deeply that the old law is renamed the "law on the protection of personal data". Its transitory provisions set the start date as the first day of the 24th month after publication, which is 1 December 2026. Until then, Law 19,628 applies, with no specialized regulator: people enforce their rights through the courts.
On 31 August 2026 the government filed a bill (Boletín No. 18.623-07) that would postpone the start to 1 December 2027, change the composition of the Agency's board and extend to all companies, during the first year, the option of a written warning instead of a fine. In October 2026 the Senate Constitution Committee had approved it in general and was still discussing the details. Unless that bill becomes law before 1 December 2026, the original date stands. Check the bill's status before relying on either date.
Who does the law apply to?
Article 1 bis gives the law a territorial reach similar to the GDPR. It applies when the controller or processor is established in Chile, when a processor anywhere acts for a Chilean controller, and when a controller or processor outside Chile carries out processing aimed at offering goods or services to people in Chile, paid or not, or at monitoring the behavior of people in Chile, including its analysis, tracking, profiling or prediction. A foreign website that tracks Chilean visitors with analytics or advertising cookies is therefore in scope. The law does not apply to individuals processing data for personal activities.
Sensitive data includes data revealing ethnic or racial origin, political, trade union or professional association membership, socioeconomic situation, ideological or philosophical convictions, religious beliefs, health, human biological profile, biometric data, sex life, sexual orientation and gender identity. Children's and adolescents' data get special protection.
What does the law require for cookies?
There is no article written for cookies. The general rules apply to any cookie or identifier that relates to an identifiable person.
Consent is the general rule. Article 12 says processing is lawful when the person consents, and that consent must be free, informed, specific as to its purposes, given in advance and unambiguous, through a verbal or written statement, an equivalent electronic means, or an affirmative act that clearly shows the person's will. The definition in Article 2 adds that it can be a statement or a clear affirmative action. Silence, inactivity or a pre-ticked box does not meet that standard.
Other legal bases. Article 13 allows processing without consent when it is necessary to perform a contract or pre-contractual steps the person asked for, to comply with a legal obligation, to pursue the legitimate interests of the controller or a third party without affecting the person's rights and freedoms, or for legal claims. Strictly necessary cookies, such as a cart or a login session, fit the contract basis. Whether analytics can rely on legitimate interest will depend on the Agency's guidance; advertising profiles are harder to justify that way because the law gives a specific right to object to them.
Objection and profiling. People can object to processing carried out exclusively for direct marketing, including profiling (Article 8). Article 8 bis adds a right not to be subject to automated decisions, including profiling, that produce legal effects or significantly affect them, unless the decision is necessary for a contract, is based on prior and express consent, or is authorized by law.
Transparency. Article 14 ter requires controllers to keep available on their website a data processing policy with its date and version, their identity and contact channel, the categories of data, the recipients, the purposes and legal bases (naming the legitimate interests relied on), security measures, and the rights to access, rectification, deletion, objection and portability, including the right to complain to the Agency. Failing to do so is a minor infringement.
In practice, a banner for Chilean visitors that keeps analytics and advertising cookies off until the visitor accepts, explains purposes in Spanish, and makes refusal as easy as acceptance meets the consent standard.
What are the penalties?
The Agency classifies infringements in three tiers (Articles 34 bis to 34 quáter) and fines them under Article 35:
| Tier | Examples | Maximum fine |
|---|---|---|
| Minor | Incomplete transparency information, late or missing answers to requests | Written warning or 5,000 UTM |
| Serious | Processing without consent or another legal basis, processing for a different purpose, obstructing rights | 10,000 UTM |
| Very serious | Fraudulent processing, knowingly processing sensitive data or children's data unlawfully, deliberately hiding a security breach | 20,000 UTM |
The UTM (unidad tributaria mensual) is a monthly tax unit indexed to inflation. If the ordered corrections are not made within 60 days, the fine is increased by 50%. Repeat offenders can be fined up to three times the amount, and a company that is not a small business under Law 20,416 and repeats a serious or very serious infringement can be fined up to 2% or 4% of its annual revenue from the previous calendar year. During the first 12 months, small businesses can receive a written warning instead of a fine. Sanctions are recorded in a public national register.
How Cookiequiet handles Chile
Chile is not in Cookiequiet's default list of regulated countries, so add it to a custom list with geo-targeting, which is free on every plan, and Chilean visitors will see the consent banner: Accept all and Reject all with the same weight, categories off by default, and Spanish text picked from the browser and editable. Tags wait for consent, and the consent log records each choice as proof. It is set up with one script tag in about five minutes; see pricing. For other countries in the region, see Brazil's LGPD and Argentina.