Peru's Law 29733: cookie rules for Peruvian visitors
Peru requires consent that is free, prior, express, unambiguous and informed before personal data is processed, and its new regulation, in force since the end of March 2025, says a click or a tap counts as express consent while a published privacy policy does not replace it. The regulation also reaches companies abroad that analyze the behavior of people in Peru or build profiles of them, which is what advertising cookies do. The Autoridad Nacional de Protección de Datos Personales, part of the Ministry of Justice and Human Rights, can fine up to 100 UIT, capped at 10% of the offender's annual gross income.Quick facts
| Applies to | Processing in an establishment in Peru, by processors acting for a Peruvian controller, and by controllers abroad that offer goods or services to people in Peru or analyze their behavior or build profiles of them (Regulation, Article VI) |
| Consent model | Free, prior, express and unambiguous, and informed (Regulation, Articles 2 to 6); clicking, tapping or similar actions count as express consent; written consent for sensitive data (Article 8) |
| Cookie rule | No cookie-specific article; a privacy policy fulfils the duty to inform but does not replace consent (Regulation, Article 7); processing without required consent is a serious infringement |
| Authority | Autoridad Nacional de Protección de Datos Personales (ANPD), exercised by the Ministry of Justice and Human Rights (MINJUSDH) |
| Maximum penalty | 0.5 to 5 UIT (minor), over 5 to 50 UIT (serious), over 50 to 100 UIT (very serious), never more than 10% of the offender's gross income in the previous year (Law, Article 39) |
| In force since | Law 29733 of 3 July 2011; new Regulation published on 30 November 2024, in force 120 calendar days later (end of March 2025), replacing Supreme Decree 003-2013-JUS |
What is Peru's data protection law?
Law 29733, the Personal Data Protection Law, was enacted in 2011 to give effect to Article 2(6) of the Peruvian Constitution, which protects people against information services that affect their personal and family privacy. Its first regulation, Supreme Decree 003-2013-JUS, applied from 2013. On 30 November 2024 the government published a new Regulation, approved by Supreme Decree 016-2024-JUS, which repeals the 2013 text and, in its own words, regulates processing "particularly in the digital environment". It entered into force 120 calendar days after publication, at the end of March 2025.
Under Article 32 of the Law, the Autoridad Nacional de Protección de Datos Personales (ANPD) is exercised by the Ministry of Justice and Human Rights, through its Directorate General for Transparency, Access to Public Information and Personal Data Protection. It keeps the National Registry of Personal Data Protection, hears complaints from data subjects, inspects and sanctions.
Who does the law apply to?
Article VI of the new Regulation sets the territorial scope. The law applies to processing carried out:
- in an establishment of the controller located in Peru;
- by a processor, wherever it is, acting for a controller established in Peru;
- by a controller not established in Peru that uses means located in Peru, including when it offers goods or services to people in Peru or carries out activities to analyze the behavior of people located in Peru and build profiles that seek to predict conduct, preferences or habits;
- by a controller abroad to which Peruvian law applies by contract or international law.
Foreign controllers covered by these rules must, in most cases, provide a representative. A website abroad that uses analytics or advertising cookies to profile Peruvian visitors is in scope.
Personal data is any information about a natural person that identifies them or makes them identifiable by means that can reasonably be used. Sensitive data in Peru includes biometric data that can identify a person by itself, racial and ethnic origin, economic income, political, religious, philosophical or moral opinions or convictions, union membership, and health or sex life information.
What does the law require for cookies?
There is no cookie article, but the Regulation's consent rules are detailed and apply to any cookie that processes personal data.
Four conditions. Consent is valid only if it is free, prior, express and unambiguous, and informed (Article 2 of the Regulation).
- Free: given without error, bad faith, violence or fraud. Making a service conditional on consent to data that is not indispensable for it affects that freedom (Article 3).
- Prior: requested before the data is collected (Article 4). Cookies that collect personal data must not fire before the choice.
- Express and unambiguous: shown by an action that demonstrates concrete, direct and explicit acceptance. Article 5 lists verbal and written forms and digital channels, including "clicking", "tapping", touch or similar actions, and requires that the person's acts show acceptance without room for doubt.
- Informed: the person must be told, clearly and in plain language, the controller's identity and address, the purposes, the recipients, the database, the consequences of providing or refusing data, any national or international transfers, the existence of automated decisions including profiling, the retention period, and how to exercise rights (Article 6).
A privacy policy is not consent. Article 7 says that publishing a privacy policy fulfils the duty to inform and the principle of transparency but does not exempt the controller from obtaining consent. A footer link to a policy plus continued browsing is therefore not enough for cookies that need consent.
Exceptions. Article 14 of the Law lists cases where consent is not needed, including data necessary to prepare, conclude or perform a contract to which the person is a party. Strictly necessary cookies for a service the visitor requested fit that exception.
Sensitive data and proof. Consent for sensitive data must be in writing, through a handwritten, digital or electronic signature or another method that guarantees the person's will (Article 8), and the controller always bears the burden of proving consent (Article 9). Consent can be withdrawn at any time without justification (Article 10).
Data protection officer. The Regulation requires a data protection officer for large-volume or sensitive processing, phased in by company size from one year after publication for companies with annual sales above 2,300 UIT to four years for micro-enterprises.
What are the penalties?
Article 39 of the Law sets fines in tax units (UIT, unidad impositiva tributaria, updated every year): from 0.5 to 5 UIT for minor infringements, from more than 5 to 50 UIT for serious ones, and from more than 50 to 100 UIT for very serious ones. A fine can never exceed 10% of the offender's gross annual income in the previous year. The Regulation classifies the infringements:
| Category | Examples from the Regulation |
|---|---|
| Minor (Article 132) | Processing data that is not necessary for the purpose, informing incompletely on two or fewer conditions, late answers to rights requests, not registering databases |
| Serious (Article 133) | Processing without free, express, unambiguous, prior and informed consent where required, failing to inform on three or more conditions, obstructing rights, security failures that harm the person |
| Very serious (Article 134) | Processing by fraudulent, unfair or unlawful means, giving false information to the Authority, ignoring corrective orders, security failures exposing sensitive data |
Repeating the same infringement within a year is an aggravating factor (Article 135).
How Cookiequiet handles Peru
Peru is not in Cookiequiet's default list of regulated countries, so add it to a custom list with geo-targeting, which is free on every plan, and Peruvian visitors will see the consent banner: a click on Accept all or Reject all, both with the same weight, categories off by default, and Spanish text picked from the browser. Scripts wait for consent, matching the prior consent rule, and the consent log keeps the proof that Article 9 places on you. The cookie scanner lists the cookies and recipients to describe under Article 6. See also Colombia, Chile and Brazil's LGPD.