New Zealand's Privacy Act 2020: what it means for cookies

What is the Privacy Act 2020?

The Privacy Act 2020 is New Zealand's general privacy law. It received assent on 30 June 2020, replaced the Privacy Act 1993 and has applied since 1 December 2020. It is built on thirteen information privacy principles (IPPs), now fourteen, that cover how agencies collect, store, use and disclose personal information. The Office of the Privacy Commissioner (OPC) supervises it. The 2020 Act added mandatory notification of serious privacy breaches, compliance notices and new rules for sending information overseas.

The Privacy Amendment Act 2025 (2025 No 53) became law in September 2025. Its main change is a new principle, IPP 3A, on personal information collected indirectly, which came into force on 1 May 2026 and applies to personal information collected from that date.

Who does the Privacy Act apply to?

The Act applies to agencies, a term that covers almost any person or organization, public or private, of any size. There is no small business exemption. Section 4 extends it to overseas agencies for any action taken in the course of carrying on business in New Zealand, wherever the information was collected or is held and wherever the person concerned is. The Act says an agency may be carrying on business in New Zealand without being a commercial operation, having a place of business there, receiving payment or intending to make a profit. A foreign website that targets New Zealand customers should assume it is covered.

Do cookies need consent in New Zealand?

No. The Act has no cookie rule and, unlike the European model, no general requirement to obtain consent before collecting personal information. Cookies and trackers fall under the Act when the information they collect is about an identifiable individual, which is often the case once identifiers are linked to an account, an email address or a detailed profile. The principles that matter are:

• IPP 1: collect personal information only for a lawful purpose connected with the agency's functions, and only if collection is necessary for that purpose.
• IPP 3: when collecting from the person, take reasonable steps to make them aware of the collection, its purpose, the intended recipients, the agency's name and address, whether supplying it is voluntary and their rights of access and correction. For a website, this is the privacy statement and any collection notice.
• IPP 3A: when collecting from someone else, tell the person after collection (see below).
• IPP 4: collect by lawful means that are fair and not unreasonably intrusive, taking particular care with children and young people.
• IPP 10 and 11: use and disclose information only for the purposes it was collected for, subject to exceptions.

Consent still appears in the Act as one of the exceptions that allow other uses or disclosures, and as good practice for intrusive tracking. Email and text marketing are covered separately by the Unsolicited Electronic Messages Act 2007, which requires the recipient's consent.

What does IPP 3A change?

IPP 3A applies when an agency collects personal information about someone from a source other than that person, whether another agency, a data partner or a list. The agency must take reasonable steps to make the person aware of the collection, its purpose, the intended recipients, the name and address of the collecting and holding agencies, any law that authorizes the collection, and the rights of access and correction. This must happen as soon as reasonably practicable after collection, unless the person has already been told.

Exceptions include information that is publicly available, cases where not notifying would not prejudice the person's interests, where notifying is not reasonably practicable, and where the information will not be used in a form that identifies the person. The OPC's guidance says the no-prejudice exception should be used only for common, low-risk cases. A business that receives customer or audience data from advertising platforms, data brokers or marketing partners should check whether it now owes a notice.

How are transfers abroad regulated?

IPP 12 governs disclosure of personal information to a foreign person or entity. It is allowed when the person authorizes it after being expressly told that the recipient may not protect the information with comparable safeguards, when the recipient is carrying on business in New Zealand and is subject to the Act, when the recipient is subject to privacy laws with comparable safeguards, is in a prescribed binding scheme or a prescribed country, or is otherwise required to protect the information comparably, for example by contract. Sending data to a cloud provider that only stores or processes it on the agency's behalf is not a disclosure, because the agency remains responsible for it.

Who enforces the Act, and what are the penalties?

The Privacy Commissioner investigates complaints, can issue compliance notices that require an agency to do something or stop doing something, and can refer cases to the Human Rights Review Tribunal, which can award damages. Refusing to comply with a compliance notice is an offence. The Act's criminal fines are modest: up to NZ$10,000 for failing without reasonable excuse to notify the Commissioner of a notifiable privacy breach (section 118), and up to NZ$10,000 for obstructing the Commissioner, misleading an agency to obtain someone's information or destroying information that has been requested (section 212).

Compliance notices have so far concerned security and breaches. On 15 September 2021 the OPC announced a compliance notice to the Reserve Bank of New Zealand after a December 2020 cyber-attack exposed weaknesses in one of its third-party systems, requiring steps to meet IPP 5 on security. There has been no enforcement action about cookies.

What should a website serving New Zealand do?

• Publish a privacy statement that names the analytics and advertising tools in use, what they collect and where the data goes.
• Collect only what you need and avoid unreasonably intrusive tracking, especially of young people.
• Check whether data you receive from partners triggers an IPP 3A notice.
• Review disclosures to overseas vendors against IPP 12.

New Zealand is not in Cookiequiet's default list of regulated countries, which is accurate: no consent rule applies. Geo-targeting is free on every plan, so you can still add New Zealand to a custom list to give visitors a notice and a real choice about advertising cookies, with the choice kept in the consent log. See Australia's Privacy Act for the neighboring rules, and the GDPR if you also have European visitors.