# Japan's APPI and cookies: what websites must do

> Japan has no general opt-in rule for cookies. Since 16 June 2023, Article 27-12 of the Telecommunications Business Act requires covered online services to tell users what data their tags send to third parties, or to get consent or offer an opt-out instead. The Act on the Protection of Personal Information (APPI) adds a consent rule when a cookie ID or browsing history is passed to a recipient that will link it to a known person, and requires consent for most transfers of personal data abroad.

Source: https://cookiequiet.com/laws/japan
Published: 2026-10-21
Publisher: Cookiequiet

## Quick facts

- **Applies to:** Businesses handling personal information in Japan, and foreign businesses that handle the personal information of people in Japan in connection with supplying goods or services to them (APPI Article 171); the external transmission rule covers four types of online service
- **Consent model:** Notice of the purpose of use for collection; opt-in consent for providing personal data to third parties (Article 27), for sensitive data, and for transfers abroad (Article 28)
- **Cookie rule:** Telecommunications Business Act Article 27-12 (since 16 June 2023): notify or publish what is sent to third parties, or get consent, or offer an opt-out; APPI Article 31: confirm the person's consent before providing cookie data to a recipient that will identify them
- **Authority:** Personal Information Protection Commission (PPC) for the APPI; Ministry of Internal Affairs and Communications (MIC) for the external transmission rule
- **Maximum penalty:** For a company whose staff violate a PPC order: a fine of up to 100 million yen (Articles 178 and 184); the individual faces up to one year of imprisonment or a fine of up to 1 million yen
- **In force since:** APPI fully in force 1 April 2005, amended with effect from 1 April 2022; external transmission rule 16 June 2023; 2026 amendment promulgated 17 July 2026, mostly in force within two years

## What are Japan's cookie rules?

Two laws share the subject. The Act on the Protection of Personal Information (APPI, Act No. 57 of 2003) is Japan's general data protection law, supervised by the Personal Information Protection Commission (PPC). The Telecommunications Business Act, supervised by the Ministry of Internal Affairs and Communications (MIC), gained a rule on "external transmission" of user information that took effect on 16 June 2023. It was the first Japanese rule written for cookies, tags and SDKs as such.

Neither law imposes the European model of prior opt-in for every non-essential cookie. Japan relies on transparency, with consent required in specific situations.

## Who do the rules apply to?

The APPI applies to any business that uses a personal information database for its business, with no size threshold. Article 171 extends it to businesses outside Japan that handle the personal information of people in Japan in connection with supplying goods or services to them, so a foreign online shop or app with Japanese customers is within scope.

The external transmission rule in Article 27-12 has a narrower scope. It covers telecommunications carriers and operators of online services in four categories listed in MIC's ordinance and FAQ: messaging between users; social networks, bulletin boards and online marketplaces; search services; and services that deliver news, weather, maps or similar information. MIC's FAQ says a company website that only introduces its own business, or a page that only takes bookings for the company's own services, is not covered.

## Do cookies need consent in Japan?

Not as a general rule. What applies depends on the situation.

- **External transmission rule.** When a covered service has a user's browser or app send information to a third party (an analytics provider, an ad network, a social plugin), the operator must either notify the user or make it readily known what information is sent, the name of the recipient and the purpose. Getting consent or offering an opt-out are the alternatives. MIC's FAQ adds that the information must be readable in Japanese and that an ID in a first-party cookie sent only to the operator itself is outside the notice duty.
- **Personally referable information.** The APPI calls data such as a cookie ID or a browsing history that does not identify anyone on its own "information related to personal information" (Article 2(7)). Under Article 31, a business may not provide it to a third party that is expected to obtain it as personal data, for example by matching it to its own customer records, without confirming that the person has consented to that acquisition. The rule was added after the 2019 Rikunabi case, described below, and took effect on 1 April 2022.
- **Personal information.** When cookie data is linked to an identified person, the APPI requires the purpose of use to be specified and notified or published, consent for use beyond that purpose, consent before providing the data to a third party (Article 27), and consent before acquiring sensitive personal information.

## What must consent look like?

The APPI does not define consent in detail. The PPC's general guidelines treat it as the person's expression of agreement, obtained in a way that is reasonable and appropriate for the business, after the person has been given enough to make a decision. A clear choice on a banner or a sign-up form fits that description. For Article 31, the consent is normally collected by the recipient, such as the ad platform, and the website providing the data must confirm and record that it was obtained.

## How are transfers abroad regulated?

Article 28 requires the person's prior consent before personal data is provided to a third party in a foreign country, and Article 28(2) requires that the person first be told which country, what its data protection system is, and what measures the recipient takes. Consent is not needed when the country is recognized by the PPC as having an equivalent system (the EEA and the United Kingdom), or when the recipient maintains a system that meets the PPC's standards, for example through a contract, in which case the business must make sure those measures are applied continuously. Article 31 adds the foreign-country information to the confirmation for cookie data sent abroad.

## Who enforces the rules, and what are the penalties?

The PPC can issue guidance, recommendations and, where a recommendation is ignored and a serious infringement is imminent, orders (Article 148). Violating an order is a crime: up to one year of imprisonment or a fine of up to 1 million yen for the individual (Article 178), and a fine of up to 100 million yen for the company (Article 184). The PPC can also publish the violation. For the external transmission rule, MIC can use the Telecommunications Business Act's business improvement orders.

The penalty picture is changing. A bill amending the APPI passed the Diet on 10 July 2026 and was promulgated on 17 July 2026. It introduces an administrative surcharge on serious cases of improper acquisition or use, reported as limited to cases affecting more than 1,000 people, adds rules for children under 16, and allows some data use for statistics without consent. Most provisions take effect on a date set by Cabinet Order within two years of promulgation.

## What has the PPC done so far?

The best-known case is Rikunabi. On 26 August 2019 the PPC issued a recommendation to Recruit Career, whose service predicted the probability that job-seeking students would decline job offers and provided the scores to client companies; data on 7,983 people had been provided without consent. The case is why the 2020 amendment created the Article 31 rule for cookie-based data.

On 28 March 2024 the PPC issued a recommendation to LY Corporation (LINE Yahoo) under Article 148 after a malware infection at a contractor led to a leak of LINE user data, and it has published follow-up reports on the company's remediation since. Japanese enforcement remains mostly administrative: recommendations, guidance and public statements rather than fines.

## What should a website serving Japan do?

- Inventory the tags and SDKs that send data to third parties, with the recipient and purpose of each. A [cookie scanner](/tools/cookie-scanner) gives you the starting list.
- If your service falls within the four categories, publish a Japanese notice of external transmissions that is easy to reach from every page, or ask for consent.
- Confirm with ad and analytics partners whether they will link your cookie data to identified users, and if so how they collect the consent Article 31 requires.
- Ask for consent before transfers of personal data abroad unless an exception applies, and list the countries in your privacy policy.

Japan is not in Cookiequiet's default list of regulated countries, but geo-targeting is free on every plan and you can add Japan to a custom list. The banner's 24 languages do not yet include Japanese, and every string is editable per language. Sites with European visitors will also need the opt-in model of the [GDPR](/laws/gdpr); for Japan's neighbors, see [South Korea](/laws/south-korea) and [China](/laws/china).

## Questions

### Does Japan require a cookie banner?

Not in the European sense. Covered online services must tell users what their tags send to third parties under Article 27-12 of the Telecommunications Business Act, or ask for consent or offer an opt-out. Consent is required when cookie data goes to a recipient that will link it to an identified person, and for most personal data transfers abroad.

### Are cookies personal information under the APPI?

A cookie ID that does not identify anyone on its own is usually not personal information but information related to personal information. It becomes personal information when it can easily be matched with other data that identifies the person. Providing it to a recipient that will make that match requires the person's consent, which the provider must confirm.

### Does the APPI apply to companies outside Japan?

Yes. Article 171 applies the APPI to foreign businesses that handle the personal information of people in Japan in connection with supplying goods or services to them. The PPC can issue recommendations and orders to them.

### What are the fines under the APPI?

A company whose staff violate a PPC order can be fined up to 100 million yen, and the person responsible faces up to one year of imprisonment or a fine of up to 1 million yen. The 2026 amendment adds an administrative surcharge for serious cases, which takes effect on a date set by Cabinet Order within two years of 17 July 2026.

## Sources

- [Act on the Protection of Personal Information (Act No. 57 of 2003), English translation, Japanese Law Translation](https://www.japaneselawtranslation.go.jp/en/laws/view/4241/en)
- [MIC, External transmission rule (外部送信規律)](https://www.soumu.go.jp/main_sosiki/joho_tsusin/d_syohi/gaibusoushin_kiritsu.html)
- [MIC, External transmission rule FAQ](https://www.soumu.go.jp/main_sosiki/joho_tsusin/d_syohi/gaibusoushin_kiritsu_00002.html)
- [PPC, 2026 amendment of the APPI (令和8年 改正個人情報保護法について)](https://www.ppc.go.jp/personalinfo/legal/r8kaiseihogohou/)
- [PPC, Promulgation of the amending act (17 July 2026)](https://www.ppc.go.jp/news/press/2026/260717/)
- [PPC, Administrative action against LY Corporation (28 March 2024)](https://www.ppc.go.jp/news/press/2024/240328/)
- [PPC, Recommendation to Recruit Career (26 August 2019)](https://www.ppc.go.jp/news/press/2019/20190826/)