Cookie Rules in Japan: The External Transmission Rule, APPI Consent, and How Japan Differs from the GDPR

Japan has no general rule, like the EU's, requiring prior consent before cookies are stored. The core rule is the external transmission rule under the Telecommunications Business Act (in force since June 16, 2023): covered websites and apps must, before tags or SDKs send user information elsewhere, notify users of — or make readily available — what information is sent, who receives it, and for what purpose (Article 27-12).

Separately, under the Act on the Protection of Personal Information (APPI), if a recipient is expected to link cookie-based data to personal data it holds, the provider must first confirm that the individual has consented (Article 31). Services aimed at users in the EU must also address consent under the GDPR and the ePrivacy Directive.

• Your news or content site runs analytics or ad-measurement tags.
• Logged-in member pages carry an ad vendor's tag that sends data together with member IDs.
• Your Japanese site uses the global cookie banner supplied by headquarters without changes.
• Your app targets foreign residents in Japan, so its privacy notices are in English only.

Two laws matter most when you use cookies or tags in Japan.

The two differ in scope and in what they require. A site outside the external transmission rule is still subject to the APPI. Conversely, data that is not personal information may still require notice or publication under the external transmission rule.

The rule applies to businesses that operate a telecommunications business and provide, through a browser or app, services designated by ministerial ordinance as having a significant effect on users (Article 27-12; Ordinance for Enforcement, Article 22-2-27). The Ministry of Internal Affairs and Communications (MIC) groups them into four categories.

By contrast, MIC treats an e-commerce site selling a company's own products, or a corporate website used for the company's own communications, as merely using telecommunications as a means for its core business. These are not a telecommunications business and fall outside the rule (MIC FAQ).

Coverage can differ page by page: on the same site, news pages may be covered while company-profile pages are not. Information sites earning revenue from ads or affiliate programs may be covered even when run by an individual.

Overseas businesses are not exempt by default. Since April 1, 2021, offering telecommunications services from abroad to users in Japan has been treated as within the scope of the Telecommunications Business Act (MIC).

External transmission means causing information about a user that is recorded on the user's device to be sent to a server of someone other than the user (Article 27-12). The recipient includes not only third-party servers but also the site operator's own servers (MIC FAQ).

The rule applies even if you do not use cookies, as long as tags or SDKs (data-collection components built into apps) cause information to be sent. The information covered is broad: cookie and advertising IDs, URLs of pages viewed, device information and more.

Before external transmission occurs, a covered business must notify users of, or make readily available, the following (Article 27-12; Ordinance, Article 22-2-29):

Write in Japanese, in plain language, avoiding technical jargon. Text must be legible without the user having to zoom in (Ordinance, Article 22-2-28). MIC states that Japanese is required even for services mainly used by foreign residents of Japan, and that adding English or another language is desirable (MIC FAQ).

When publishing, a website should display the information on the page that sends the tag or on a page easily reached from it. An app should display it on the first screen shown or one easily reached from it. You may indicate purposes by linking to the recipient's published page or to your privacy policy, but MIC recommends also giving a summary of what the link contains.

The following information is excluded (Article 27-12, proviso):

• Information needed to provide the service (for correct display, user authentication, security and similar purposes)
• An identifier the service provider itself issued, sent back to the provider's own server (such as a first-party cookie ID)
• Information whose transmission the user has consented to
• Information for which you offer an opt-out (a way for users to stop transmission or use), have published how it works, and the user has not opted out

A breach of the external transmission rule may lead the Minister for Internal Affairs and Communications to order improvements to business practices (Article 29(2)). Detailed guidance appears in Article 51 of MIC's Guidelines on the Protection of Personal Information in Telecommunications Business and Chapter 7 of their commentary.

A browsing history collected via cookies or other identifiers usually cannot, on its own, identify a specific individual. Such data is "personally related information" — information about a living individual that is not personal information, pseudonymously processed information or anonymously processed information (APPI, Article 2(7)).

However, if your company can readily match that browsing history with members' names or email addresses, it is treated as personal information (Article 2(1)(i)). In that case the rules for personal information apply, including specifying and disclosing the purpose of use and restricting third-party provision. Using it in a way that may encourage or induce illegal or improper conduct is also prohibited (Article 19).

Where a recipient is expected to acquire personally related information as personal data, the provider may not provide it without confirming that the individual has consented (Article 31(1)). When the recipient is in a foreign country, the provider must also confirm that the individual has been given information such as that country's data protection system (Article 31(1)(ii)).

"Acquire as personal data" means the recipient adds the information to its own customer data, for example through an ID. "Expected" covers not only cases where the provider actually knows this, but also cases a business in the same industry would ordinarily anticipate from the circumstances of the transaction (PPC General Rules Guidelines).

Consent is in principle obtained by the recipient, which will use the information as personal data. The provider may obtain it on the recipient's behalf, but must then name the recipient specifically. On a website, simply posting an explanation is not enough; you need a method such as asking the user to click a button (PPC Guidelines).

The provider confirms consent by a method such as a declaration from the recipient, and creates and keeps a record of the confirmation (Article 31(3), applying Article 30(3) and (4) mutatis mutandis). If the contract provides that the recipient will not use the information as personal data, Article 31 ordinarily does not apply. If there are signs that the recipient is in fact linking the data, however, you need to check again.

An amendment to the APPI was promulgated on July 17, 2026. It will in principle take effect on a date set by Cabinet Order within two years of promulgation.

Article 5(3) of the EU ePrivacy Directive allows storing information on a user's device, or accessing information already stored there, only with consent or where it is necessary for purposes the Directive specifies.

It covers not only cookies but similar technologies. As a result, prior consent for analytics and advertising cookies is standard practice in the EU.

Japan's external transmission rule is satisfied by notice or publication; consent is only one of the exceptions. MIC itself explains that the rule does not share the same scope or content as the ePrivacy Directive (MIC FAQ).

At the same time, the GDPR applies to a Japanese company with no establishment in the EU when it offers goods or services to people in the EU or monitors their behavior there (GDPR, Article 3(2)). For sites with EU users, one option is to show Japanese-style notice to users in Japan and EU-style consent to users in the EU.

Start by listing every tag, SDK and embedded item running on your sites and apps. Check not only your tag manager but also tags hard-coded into pages, embedded videos and social buttons. For each, record the information sent, the recipient's company name, your purpose and the recipient's, whether the external transmission rule applies, and whether Article 31 may apply.

Based on the inventory, create a page on external transmission. Link to it from a place users can reach immediately, such as the footer of each page. If you use a banner, write it in plain Japanese and link to the detailed page.

A consent management platform (CMP) records consent and fires tags according to each user's choices.

Your vendor contracts should make clear whether the vendor links received data to personal data, who obtains consent and how if it does, and how consent is confirmed. If the vendor is overseas, consider the information requirement in Article 31(1)(ii).

Obtain accurate recipient names and purposes from vendors for your publication page.

1. 1

   Check coverage

   Check whether any of your sites or apps fall into the four covered categories (Telecommunications Business Act, Article 27-12).

2. 2

   Inventory tags

   Inventory tags, SDKs and embeds, listing information sent, recipient names and purposes.

3. 3

   Create a publication page

   Create a Japanese-language publication page and make it easily reachable from covered pages.

4. 4

   Test the exceptions

   If you rely on consent or opt-out, confirm there are no pre-ticked boxes and that opting out actually works.

5. 5

   Review vendor contracts

   Review whether data is linked to personal data and who handles consent (APPI, Article 31).

6. 6

   Decide on EU measures

   Check whether you have EU users and decide whether GDPR and ePrivacy measures are needed.

7. 7

   Track the amendment

   Track the cabinet orders, rules and guidelines under the 2026 amendment and review operations before it takes effect.

• You are unsure whether your service, or particular pages, fall under the external transmission rule
• An ad vendor proposes linking data to member IDs or other data integration
• MIC or the Personal Information Protection Commission requests a report or contacts you
• Users complain that their information is being sent without their knowledge
• You serve users in both the EU and Japan and need to design separate consent and notice flows

You can contact our firm through our inquiry page.

FREE CONSULTATION

Internet Issues: your first 30 minutes are free

• ・Handled by Yusuke Abe, admitted in Japan and New York
• ・Online (Zoom etc.) or at our office in Otemachi, Tokyo
• ・In English or Japanese

Choose a time for a free consultationPersonal data and data breaches: how we can help

Japanese law does not impose a general prior-consent requirement for cookies. For services covered by the external transmission rule, notice or publication is sufficient. However, where a recipient is expected to acquire personally related information as personal data, you must confirm the individual's consent (APPI, Article 31).

Under MIC's interpretation, a corporate website for the company's own communications, or an e-commerce site selling its own products, is not a telecommunications business and is outside the rule. If the same site also offers a covered service such as news distribution, those pages are covered. The APPI applies even to sites outside the rule.

Publishing within a privacy policy can work if it states the three items — the information sent, the recipient's name, and the purpose — in plain Japanese. The page must also be easy to reach from the pages that send the tags. Give the recipient's company name, not just a service name.

The external transmission rule requires Japanese. MIC states that Japanese is required even for services mainly used by foreign residents of Japan, and that adding English or another language is desirable. A foreign business offering services to users in Japan may also fall within the Telecommunications Business Act.