# Israel: cookie and consent rules under the Privacy Protection Law

> Israel has no cookie-specific rule, but since Amendment 13 took effect on 14 August 2025 the Privacy Protection Law names online identifiers in its definition of personal data, so tracking cookies fall under it. Consent under the Law is informed consent, explicit or implied, and the Privacy Protection Authority's opinion of 25 February 2026 says silence is not consent and that profiling not needed for the service calls for a separate opt-in. The Authority can now impose monetary sanctions calculated per data subject, reduced to 5% of turnover on request.

Source: https://cookiequiet.com/laws/israel
Published: 2026-10-21
Publisher: Cookiequiet

## Quick facts

- **Applies to:** Anyone who processes personal data in a database, whatever its size; the Law does not define its territorial reach
- **Consent model:** Informed consent, explicit or implied (section 3); the Authority's 2026 opinion asks for a separate active opt-in for profiling not needed for the service
- **Cookie rule:** No cookie-specific provision; online identifiers are personal data, and requests for personal data must carry the section 11 notice
- **Authority:** Privacy Protection Authority (Ministry of Justice)
- **Maximum penalty:** Monetary sanctions under section 23KF, per data subject or fixed (for example NIS 4 per person, at least NIS 200,000, for processing for an unlawful purpose); reduced to 5% of turnover on request
- **In force since:** 1981; Amendment 13 in force since 14 August 2025

## What is Israel's Privacy Protection Law?

The Privacy Protection Law, 5741-1981, is Israel's general privacy statute. Its first chapter makes infringing a person's privacy without consent a civil wrong and, in some cases, an offense. Its second chapter regulates databases of personal data: registration, the duty to inform people when their data is requested, access and rectification rights, data security and direct mailing. The Privacy Protection Authority, part of the Ministry of Justice, supervises it.

Amendment 13, passed by the Knesset on 5 August 2024, took effect on 14 August 2025 and is the largest revision of the Law since it was enacted. It replaced the old vocabulary with terms close to the [GDPR](/laws/gdpr) (personal data, database controller, processor, data of special sensitivity), narrowed the registration duty, required some organizations to appoint a data protection officer, and gave the Authority a schedule of monetary sanctions, inspection powers and the power to order a violation to stop.

## Who does the Law apply to?

The database chapter applies to any database controller or processor, with no size threshold. A website that collects names, emails or identifiers into a customer, newsletter or analytics database is a database controller in the Law's sense. Registration is now limited to public bodies and to databases whose main purpose is to provide personal data to others as a business, such as direct mailing services, with data on more than 10,000 people (section 8A). The duty to appoint a data protection officer covers public bodies, data brokers above 10,000 people, and organizations whose core activities involve regular and systematic monitoring of people on a significant scale, including tracking their behavior or location (section 17B1).

The Law does not contain a territorial clause like the GDPR's Article 3. It clearly reaches controllers and databases in Israel; how far it reaches a foreign website that tracks visitors in Israel has not been set out in the Law or in a published decision of the Authority.

## Do cookies need consent in Israel?

There is no Israeli rule equivalent to the EU ePrivacy Directive that requires consent before a cookie is stored. The question is answered through the general Law. Since Amendment 13, personal data means data about an identified or identifiable person, and an identifiable person is one who can be identified with reasonable effort, directly or indirectly, including by an identifier such as a name, an identity number, location data or an online identifier. A cookie ID or advertising ID tied to a visitor is therefore personal data, and keeping it in a database brings the database chapter into play.

Two rules follow. First, section 11 requires every request for personal data for a database to come with a notice: whether providing the data is a legal obligation or voluntary and what happens if the person refuses, the purpose, the controller's name and contact details, who will receive the data and why, and the rights of access and rectification. Second, using information about a person's private affairs for a purpose other than the one it was given for is an infringement of privacy (section 2(9)), and processing a database for an unlawful purpose is a violation (section 8(b)). Using browsing data for advertising profiles without a basis in consent is where these rules bite.

Consent itself is defined in section 3 as informed consent, explicit or implied. The Authority's opinion on consent, published on 25 February 2026, explains how it will apply that definition when it supervises and imposes sanctions:

- informed means the person understood the request, its purposes and the consequences of agreeing or refusing, and the presentation counts as much as the content;
- silence or the absence of an objection is not, on its own, valid consent;
- dark patterns and design choices that make the meaning of consent harder to understand weigh against free consent;
- consent can be active (opt-in) or passive (opt-out) depending on the circumstances, but consent to profiling that is not needed for the service, between parties with unequal power, must be a separate active opt-in;
- requests to withdraw consent should be considered favorably.

For a website, the practical reading is that strictly necessary cookies need only the section 11 notice in the privacy policy, while advertising and cross-site profiling cookies are safest behind an opt-in banner with a Reject option, as in the [Reject all guide](/guides/reject-all-button).

## Can data leave Israel?

The Privacy Protection (Transfer of Data to Databases Abroad) Regulations, 5761-2001, allow a transfer when the destination country's law ensures protection no lower than Israel's, or under listed conditions, including the data subject's consent, transfer within a group under the controller's control, a contract binding the recipient to Israeli standards, and transfer to a country party to the Council of Europe's data protection convention. The recipient must also give a written undertaking that it protects the data and will not pass it on. Separate 2023 regulations set extra duties for personal data received from the European Economic Area. Most analytics and ad providers process data abroad, so a privacy policy should name them.

## What are the penalties?

Section 23KF sets the monetary sanctions, which are either fixed or multiplied by the number of people concerned:

| Violation | Sanction under section 23KF |
| --- | --- |
| Processing in an unregistered database that must be registered | NIS 150,000, doubled for databases with data on 1,000,000 people or more |
| Refusing access or rectification | NIS 15,000 |
| Requesting personal data without the section 11 notice | NIS 50 per person asked (NIS 100 for sensitive data), at least NIS 30,000 |
| Requesting data from an unspecified group without the notice, such as a web form | NIS 2 per person in the database (NIS 4 for sensitive data), at least NIS 20,000 |
| Processing for an unlawful purpose | NIS 4 per person in the database (NIS 8 for sensitive data), at least NIS 200,000 |

Schedule 5 reduces sanctions for clean records, self-reporting and remedial measures (by up to 70% combined), caps them at NIS 20,000 to 140,000 for micro and small enterprises (turnover up to NIS 4 million and NIS 10 million), and, at the violator's request, brings them down to 5% of turnover. Courts can also award exemplary damages of up to NIS 10,000 without proof of harm for listed violations, including a missing section 11 notice in some cases.

On 21 July 2026 the Authority fined the Meuhedet health fund NIS 256,000, after reductions, for failing to report a severe security incident immediately, its first such fine since Amendment 13 took effect.

## How Cookiequiet fits

Israel is not in Cookiequiet's preset list of regulated countries, so add it to a custom country list or show the banner everywhere; geo-targeting is included on every plan, including Free. The banner holds analytics and marketing scripts until the visitor chooses, shows Reject all next to Accept all, and the consent log keeps each choice as evidence. Hebrew is not one of the 24 built-in languages: visitors whose browser asks for it see the site's default language, whose strings you can edit. Run the [cookie scanner](/tools/cookie-scanner) to list what your site sets, and see [pricing](/pricing) for the plans. The policy templates are not written for the Israeli Law and are not legal advice.

## Questions

### Does Israel require a cookie banner?

No law requires a banner by name. Since Amendment 13, online identifiers are personal data, requests for personal data need the section 11 notice, and the Privacy Protection Authority's 2026 opinion says silence is not consent and that profiling not needed for the service needs a separate opt-in. A banner with Accept and Reject is the practical way to meet that for advertising cookies.

### When did Amendment 13 take effect?

On 14 August 2025. The Knesset passed it on 5 August 2024. It modernized the definitions, limited database registration, introduced data protection officers and gave the Privacy Protection Authority the power to impose monetary sanctions.

### How are fines calculated under Amendment 13?

Many sanctions are multiplied by the number of people in the database or the number of people asked for data, with minimum amounts, for example NIS 4 per person and at least NIS 200,000 for processing for an unlawful purpose. Reductions apply for clean records, self-reporting and small businesses, and a violator can ask for the sanction to be cut to 5% of turnover.

### Is implied consent still valid in Israel?

Yes, the Law defines consent as informed consent, explicit or implied. The Authority's opinion of 25 February 2026 narrows it in practice: silence alone is not consent, dark patterns undermine it, and explicit, active consent is preferred where sensitive data or serious privacy harm is involved.

## Sources

- [Privacy Protection Authority, Protection of Privacy Law, 5741-1981, unofficial English translation updated after Amendment 13](https://www.gov.il/BlobFolder/legalinfo/legislation/en/Protection-of-Privacy-Law57411981unofficialtranslatioup.pdf)
- [Privacy Protection Authority, Legislation (unofficial translations, Hebrew text prevails)](https://www.gov.il/en/pages/legislation)
- [Privacy Protection Authority, opinion on consent in privacy protection law (25 February 2026, Hebrew)](https://www.gov.il/he/pages/consent-2026)
- [Privacy Protection (Transfer of Data to Databases Abroad) Regulations, 5761-2001, unofficial translation](https://www.gov.il/BlobFolder/legalinfo/legislation/en/Privacy-ProtectionTransferofDataabroadRegulationsun.pdf)
- [Privacy Protection Authority, monetary sanction on the Meuhedet health fund (21 July 2026, Hebrew)](https://www.gov.il/he/pages/21072026-1)