Yes. Consent would not be required for placing cookies, subject to the below:
the laws that regulate the use of cookies in Japan are primarily the Act on the Protection of Personal Information (“APPI”) and the amended Telecommunications Business Act, became fully effective on June 16, 2023 (“TBA”);
under the APPI, Cookies per se are not categorized as personal information because they cannot identify a specific individual. In general, you can place cookies without consent unless information collected via cookies can be readily collated with other information and thereby identify a specific individual;
however, if a business discloses information collected via cookies to a third party and it is anticipated that the third-party recipient can collate such information with other information and identify an individual even when the discloser cannot, such data is regulated as personally referable information. The APPI requires the discloser to confirm an individual’s consent about the disclosure of the personally referable information. This is mainly intended to regulate the use of cookies via a data management platform; and
the TBA applies to various online services provided through web browsers and apps, and it has regulations regarding processing any data that would externally transfer any user information stored in their terminals, including cookies. However, even if it applies to a business, consent is not necessarily required. Instead, a notice or public announcement will suffice. Also, 1st party cookies and certain information necessary for providing the service are exempt from the regulations.
Are cookie rules (whether specific or within general data protection laws) followed in practice?
Yes. In general, the APPI and TBA are generally complied with.
Are there any exemptions if consent is required?
Consent is generally not required except for a few specific circumstances. Please see the question “Can you place cookies without consent?” above. However, when consent is required, exemptions available under the APPI are quite limited such as where there is a need to protect human life, body, or fortune and when it is difficult to obtain consent.
Can you place the following cookies automatically:
i. Analytics cookies, ii. Advertising cookies, iii. Social media cookies
Yes, except for the limited circumstances where consent would be required. Please see the question “Can you place cookies without consent?” above.
Are you able to gain consent without a user ticking ‘accept’, i.e., imply consent from a user continuing to browse the site?
Yes. Under the APPI, there are no formality requirements for consent (such as a separate form, strict granularity, or notice of the right to withdrawal). Depending on the circumstances, a user could be deemed or implied to have consented to the collection of data through cookies.
Can you set cookies without a cookie notice?
Yes, but subject to the below:
there is no specific requirement to have a cookie notice under the APPI. However, if a business collects personal information through cookies, it is required to notify an individual of the utilization purpose, for example, by including cookie-related information in a privacy policy; and
if a company is subject to the TBA, it must provide users with certain information, such as the processing of the information collected via cookies, who would process the information using the telecommunications facilities to which the information would be sent, and the purposes for which the information would be used.
Can you set cookies without a cookie banner/ management tool?
Yes, but subject to the below:
there is no specific requirement to have a cookie banner or management tool under the APPI; and
however, if a business is subject to the TBA, a valid notice under the TBA should be easily recognizable by users and displaying a cookie banner is one way of doing this.
Are you able to use cookie walls?
Yes.
Is the local regulator currently enforcing decisions against breaches of cookie rules?
There have been no reported enforcement actions taken against a company for violations specifically related to cookies under the APPI. The amended TBA will not become fully enforceable until 16 June 2023.
Are there any current consultations relating to ad tech/cookies?
No, we are not aware of any.
Are there any anticipated changes to the rules and/ or have there been changes to the attitudes in the market (for example, case law or industry body decisions)?
