Israel PPL Amendment 13
Amendment 13 to the Protection of Privacy Law, 5741-1981
Key Facts
Overview
Amendment 13 to Israel's Protection of Privacy Law is a sweeping reform approved by the Knesset in August 2024 and effective from August 2025. It introduces GDPR-level enforcement capabilities including 5% turnover penalties, a private right of action without proof of harm, and extraterritorial scope. IP addresses, online identifiers, and geolocation data are explicitly defined as personal data.
What This Means for Your Website
- Consent is required before processing personal data of Israeli visitors
- IP addresses, online identifiers, and geolocation data are explicitly personal data
- Data subjects can sue for statutory damages of ILS 10,000-100,000 without proving harm
- The PPA's expected binding cookie guidance will make consent banners essential
- Extraterritorial scope means the law applies to foreign entities processing Israeli residents' data
- A mandatory privacy protection officer must be appointed
Key Requirements
The PPA enforces the law with penalties up to 5% of annual turnover, statutory damages of ILS 10,000-100,000 (no proof of harm required), up to 3 years imprisonment, and processing suspension orders. The private right of action creates direct litigation risk from individual data subjects. Special requirements apply to data brokers. The expanded sensitive data definition covers biometrics, genetics, criminal records, sexual orientation, and financial details.
How ConsentStack Handles This
ConsentStack applies opt-in consent collection for Israeli visitors, treating IP addresses and online identifiers as personal data in line with the law's explicit definitions and supporting compliance with the PPA's evolving cookie guidance.
Penalties
Up to 5% of annual turnover. ILS 10,000-100,000 statutory damages (no proof of harm required). Up to 3 years imprisonment. Processing suspension orders.
Key Requirements
- Consent required for personal data processing
- Mandatory privacy protection officer appointment
- IP addresses, online identifiers, and geolocation data are personal data
- Expanded sensitive data definition (biometrics, genetics, financial details)
- Data subjects can sue without proving harm (statutory damages up to ILS 100,000)
- Specific requirements for data brokers
Notable Provisions
- Private right of action WITHOUT proof of harm (statutory damages up to ILS 100,000)
- Extraterritorial scope
- 5% turnover penalty ceiling
- PPA can order deletion of unlawfully obtained data and prohibit processing
- Specific data broker requirements
Other Middle East & North Africa Regulations
Frequently Asked Questions
Can individuals sue without proving harm under Amendment 13?
Yes. Data subjects can claim statutory damages of ILS 10,000-100,000 without needing to prove actual harm — a powerful enforcement mechanism.
Does Amendment 13 apply extraterritorially?
Yes. The law applies to all entities processing personal data of Israeli residents, regardless of where the entity is located.
Are cookies covered under Amendment 13?
While there are no explicit cookie provisions yet, IP addresses and online identifiers are defined as personal data, and the PPA's opt-in recommendations are expected to become binding guidance.
Stay compliant with Israel PPL Amendment 13
ConsentStack helps you implement Opt-in consent for State of Israel automatically.