POPIA: cookie and consent rules in South Africa

What is POPIA?

The Protection of Personal Information Act 4 of 2013 is South Africa's data protection law. Signed in 2013, its main provisions commenced on 1 July 2020 with a one-year grace period, so compliance has been enforceable since 1 July 2021. POPIA rests on eight conditions for lawful processing (accountability, processing limitation, purpose specification, further processing limitation, information quality, openness, security safeguards and data subject participation) that echo the GDPR, with its own vocabulary: the controller is the responsible party, the processor is the operator. The Information Regulator supervises it, issues enforcement notices and administrative fines, and also enforces the Promotion of Access to Information Act.

Who does POPIA apply to?

Section 3 applies the Act to processing by a responsible party domiciled in South Africa, and to responsible parties domiciled elsewhere that use means in South Africa, unless the data only passes through. Setting cookies on the browsers of people in South Africa and processing what they return is a use of means in the country, so foreign websites with South African visitors are within scope. Personal information includes information about identifiable juristic persons, which is unusual, and the Act applies to businesses of all sizes.

What does POPIA require for cookies and consent?

The definition of personal information in section 1 lists location information, online identifiers and other particular assignments to a person. A cookie identifier, an advertising ID or an IP address tied to a visitor is therefore personal information, and every operation on it, from storage to sharing with an ad network, is processing.

Processing is lawful only on one of the grounds in section 11: the data subject consents; the processing is necessary for a contract; it complies with a legal obligation; it protects a legitimate interest of the data subject; it is necessary for a public law duty; or it is necessary to pursue the legitimate interests of the responsible party or a third party to whom the information is supplied. Consent is defined as any voluntary, specific and informed expression of will by which permission is given, and the responsible party bears the burden of proving it. A data subject may withdraw consent at any time, and may object to processing based on legitimate interests.

Two further sections matter for websites. Section 18 requires the responsible party to take reasonably practicable steps to make the data subject aware of what is collected, from where, for what purpose, who the recipients are and whether the information will be sent abroad, before or as soon as practicable after collection. Section 69 prohibits direct marketing by unsolicited electronic communications (email, SMS, automatic calling) unless the person has consented, with an exception for existing customers who were given a chance to opt out when their details were collected and in every message. Section 69 regulates messages, not cookies, but it signals the Act's preference for opt-in marketing, and it applies to the email lists that newsletter and marketing tools build from website visits.

The Information Regulator has not published cookie-specific guidance. In practice, strictly necessary cookies rest on the contract or legitimate interest ground, analytics may rest on legitimate interest with transparency and a right to object, and advertising and cross-site profiling are safest on consent, which mirrors the approach of the GDPR and Brazil's LGPD.

What must a compliant banner do?

• Give the section 18 notice in a visible place before tracking starts: what is collected, why, who gets it and whether it leaves South Africa.
• Collect consent for advertising cookies by a positive action, with Accept and Reject of equal prominence and nothing pre-ticked.
• Offer a clear way to object to analytics based on legitimate interest, and to withdraw consent later.
• Keep a record of the choice, since the responsible party must prove consent.
• Link to a privacy policy that covers cross-border transfers (section 72), since most analytics and advertising providers process data abroad.

Enforcement and fines

The Regulator first issues an enforcement notice; failing to comply with it is an offense, and the Regulator may then serve an infringement notice with an administrative fine of up to R10 million (section 109), taking into account the sensitivity of the data, the duration and extent of the breach, the number of people affected and prior offenses. Section 107 attaches criminal penalties to specific offenses: up to ten years' imprisonment or a fine for the most serious ones (obstructing the Regulator, breaching an enforcement notice, unlawful acts with account numbers), up to twelve months for others.

Enforcement has started with the public sector. On 3 July 2023 the Regulator issued its first administrative fine, R5 million against the Department of Justice and Constitutional Development, for failing to comply with an enforcement notice after a 2021 ransomware attack. On 23 December 2024 it fined the Department of Basic Education R5 million for ignoring an enforcement notice about the publication of matric results in newspapers. No cookie fine has been published so far; the Regulator's focus has been on breaches, direct marketing and compliance with its notices.

How Cookiequiet handles POPIA

South Africa is in Cookiequiet's list of regulated countries, so with geo-targeting on, South African visitors see the consent banner. The banner gives the first-layer notice, holds analytics and marketing scripts until the visitor chooses, shows Accept all and Reject all with equal weight, and keeps the preferences center reachable to withdraw. Each choice goes into the consent log as proof. The privacy policy generator includes the Information Regulator as the authority for South African companies and a transfers section for the providers found by the scan; it is a template, not legal advice. See the cookie audit checklist to inventory what your site sets.