South Korea's PIPA: what it requires for cookies and tracking

What is PIPA?

The Personal Information Protection Act (PIPA) is South Korea's general data protection law. It took effect on 30 September 2011 and is often described as one of the strictest privacy laws in Asia. In 2020 the data protection provisions that used to sit in the Network Act (the Act on Promotion of Information and Communications Network Utilization and Information Protection) were moved into PIPA, and the Personal Information Protection Commission (PIPC) became the single supervisory authority. The PIPC reports to the Prime Minister and has the power to investigate, order corrections and impose surcharges.

Two recent amendments matter for websites. The amendment that took effect on 15 September 2023 merged the special rules for online service providers into the general rules, widened the routes for transfers abroad and changed how the maximum surcharge is calculated. The amendment promulgated on 10 March 2026 and in force since 11 September 2026 raised the ceiling for repeated or serious violations to 10% of turnover and made chief executives responsible for supervising data processing.

Who does PIPA apply to?

PIPA applies to personal information controllers: public institutions, companies, organizations and individuals who process personal information to run their business. The law has no express clause on its territorial reach, but the PIPC applies it to foreign companies that collect data from people in Korea, as its decisions against Google and Meta show. Article 31-2 requires a controller with no address or office in Korea to designate a domestic agent when it meets thresholds set by Presidential Decree, based on factors such as sales and the number of people whose data it holds. The agent's details must appear in the privacy policy.

Do cookies need consent in South Korea?

PIPA does not mention cookies by name. It applies to them when the data they collect is personal information, which includes information that identifies a person when easily combined with other information. Article 15(1) lists the legal bases for collection: consent, a legal obligation, the performance of a contract with the person, protection of life or property, a legitimate interest that clearly outweighs the person's rights, and a few public purposes. Analytics and advertising cookies rarely fit anything but consent.

Article 30(1) item 7 requires the privacy policy to describe the installation and operation of automatic collection tools, including internet access files, and how users can refuse them. Korean privacy policies therefore have a cookie section explaining what is collected and how to disable it in the browser.

Behavioral advertising is the area the PIPC watches most: its largest decisions concern data collected across other companies' websites and apps for targeted ads, described below.

What must consent look like?

Article 22 sets the method. Each matter that requires consent must be presented in a clearly recognizable way, and consent must be obtained separately for each category: collection and use, provision to third parties, sensitive information and unique identifiers, and marketing. When consent is given in writing or electronically, the key matters, such as the purpose and the items collected, must be stated clearly and be easy to understand. Data processed without consent must be listed separately, with its legal basis, and the controller must prove that consent was not required. A controller may not refuse goods or services because a person declines optional consent or consent to marketing (Article 22(5)). Consent for a child under 14 comes from a legal guardian.

Commercial advertising messages are covered by Article 50 of the Network Act, which requires the recipient's prior consent before advertising information is sent by electronic transmission.

How are transfers abroad regulated?

Article 28-8 prohibits providing, entrusting or storing personal information abroad unless one route applies: separate consent from the person; a statute or treaty that provides for the transfer; necessity for a contract with the person, where the details are disclosed in the privacy policy or notified; a recipient holding a certification recognized by the PIPC; or a destination country that the PIPC recognizes as offering substantially equivalent protection. The 2023 amendment added the last two routes and a power to order a transfer to stop when the law is breached.

Who enforces PIPA, and what are the penalties?

The PIPC can order corrections and impose surcharges. Under Article 64-2 the ceiling is 3% of total revenue, excluding revenue from activities unrelated to the violation; where there is no revenue, a fixed ceiling applies. Since 11 September 2026 a special provision allows up to 10% for repeated or serious violations, and the surcharge can be reduced when a company shows real investment in data protection, except for intentional or grossly negligent breaches. Administrative fines and criminal penalties apply to other breaches.

What has the PIPC done about tracking?

On 14 September 2022 the PIPC fined Google 69.2 billion won and Meta 30.8 billion won, about 100 billion won in total, for collecting users' behavioral information from other companies' websites and apps and using it for personalized advertising without valid consent. Google had set the option to agree by default and hidden it behind further settings; Meta had not given the required information or obtained consent at sign-up. It was the first Korean sanction for collecting behavioral information for targeted advertising, and both companies were ordered to obtain clear consent. Both went to court, and on 22 January 2025 the Seoul Administrative Court dismissed their claims and upheld the sanctions.

On 4 November 2024 the PIPC imposed another 21.6 billion won in surcharges and fines on Meta, partly for using behavioral data such as pages liked and ads clicked to create advertising topics tied to sensitive information without a lawful basis.

What should a website serving Korea do?

• List your cookies and tags and their purposes; the cookie scanner gives a first inventory.
• Ask for consent before analytics and advertising cookies collect personal information, with each purpose shown separately and nothing pre-selected.
• Publish a Korean privacy policy with the automatic collection section and, if you meet the thresholds, your domestic agent.
• Do not block the service for people who refuse optional cookies.

South Korea is in Cookiequiet's default list of regulated countries, so with geo-targeting on, which is free on every plan, Korean visitors see the opt-in banner with Reject all and the consent log keeps the record of each choice. The banner's 24 languages do not yet include Korean, and every string is editable per language. For Korea's neighbors, see Japan and China; the European rules are on the GDPR page.