Key Facts
Overview
Japan's APPI is the country's primary data protection law, with specific cookie and tracking provisions added by the 2023 Telecommunications Business Act. Consent is required before providing person-related identifiers (cookies, IPs, device IDs) to third parties that will link them to identified individuals. The PPC conducts mandatory three-year review cycles.
What This Means for Your Website
- Consent is required before providing cookies, IP addresses, and device IDs to third parties that link them to identified users
- First-party cookies and essential technical data (OS, browser, language) are exempt
- The purpose of data use must be specified and publicly available
- Breach notification to the PPC and affected individuals is mandatory
- Cross-border transfers require adequacy, consent, or contractual safeguards
- Foreign businesses serving Japanese users are subject to extraterritorial application
Key Requirements
The PPC enforces APPI with penalties up to 100 million JPY for legal entities and 1 year imprisonment for individuals. The 2026 Policy Direction proposes stricter rules for minors under 16, administrative monetary penalties, and collective redress schemes. Draft amendments are expected to take effect around 2027.
How ConsentStack Handles This
ConsentStack detects Japanese visitors and manages cookie consent in compliance with both APPI and the Telecommunications Business Act, blocking third-party tracking until consent is given.
Penalties
Individuals: up to 1 year imprisonment or 1M JPY. Legal entities: up to 100M JPY. Marketing violations: up to 30M JPY for entities.
Key Requirements
- Opt-in consent before providing person-related identifiers to linking third parties
- Notification or disclosure about cookie usage required
- Purpose of use must be specified and publicly available
- Mandatory breach notification to PPC and affected individuals
- Cross-border transfer restrictions with adequacy, consent, or contractual safeguards
Notable Provisions
- Mandatory three-year PPC review cycle
- 2026 Policy Direction proposes stricter minors rules and administrative penalties
- Telecommunications Business Act adds specific cookie transparency obligations
- First-party cookies and essential technical data are exempt
Data Subject Rights
Right to request disclosure of retained personal data
Right to request correction, addition, or deletion of inaccurate retained personal data
Right to request cessation of utilization or provision to third parties of retained personal data
Other Asia Pacific Regulations
Frequently Asked Questions
Does Japan require cookie consent?
Yes for third-party tracking. The APPI and Telecommunications Business Act require consent before providing cookies, IPs, and device IDs to third parties that link them to identified users.
What are the APPI penalties?
Up to 100 million JPY for legal entities and 1 year imprisonment for individuals. The 2026 reforms may introduce administrative surcharges.
Are first-party cookies regulated in Japan?
First-party cookies and essential technical data are generally exempt. The focus is on person-related information provided to linking third parties.
Does APPI apply extraterritorially?
Yes. Foreign businesses providing goods or services to individuals in Japan are subject to APPI.
Stay compliant with APPI
ConsentStack helps you implement Opt-in consent for Japan automatically.