On 4 November 2026 Japan's Ministry of Internal Affairs and Communications (MIC) published the "Second Report of the Working Group on User Information (Measures to Ensure Compliance with the External Transmission Rules for User Information)", together with the results of the public consultation on the draft.
The external transmission rules govern websites and apps that cause information about a user stored on the user's device to be sent to a third party's server, for example for advertising or behavioural analysis. They were introduced by the 2022 amendment to the Telecommunications Business Act. The report reviews how well the rules are being followed and sets out measures to secure compliance.
This page sets out what MIC published, together with the statutory wording.
Overview of the publication
| Item | Details |
|---|---|
| Date published | 4 November 2026 |
| Published by | MIC (User Environment Division, Telecommunications Business Department, Telecommunications Bureau) |
| Report | Second Report of the Working Group on User Information (Measures to Ensure Compliance with the External Transmission Rules for User Information) |
| Prepared by | Working Group on User Information, Study Group on the Environment for Using ICT Services |
| Attachment | Handbook on Legal Requirements and Recommended Practices for the External Transmission of User Information by Websites and Apps |
| Consultation period | 20 August to 18 September 2026 |
| Submissions | 24 (counted by submitter) |
| Published documents | Annex 1: the report / Annex 2: summary / Annex 3: submissions received and MIC's views |
The statutory rule
Article 27-12 of the Telecommunications Business Act provides, in summary, that a telecommunications carrier or an operator of a "Category 3 business" (limited to those providing a telecommunications service designated by MIC ordinance as having a significant effect on users' interests, taking account of its content, user base and use), when providing the service and intending to send a user's device an instruction that activates a function sending information about that user to equipment of someone other than the user, must in advance notify the user of, or make readily available to the user, the content of the information to be sent, the equipment to which it will be sent and other matters specified by MIC ordinance.
The proviso to Article 27-12 excludes:
- information specified by MIC ordinance as necessary to send when the user uses the service (item 1)
- an identifier the operator sent to the user's device, when it is sent back to the operator's own equipment (item 2)
- information whose transmission the user has consented to (item 3)
- where the operator offers a mechanism to stop the transmission or use at the user's request (an opt-out) and makes its details readily available, information for which the user has not requested that the opt-out be applied (item 4)
Free Tool Related to This Article
Contract Risk Checker
Try our free simulator related to this topic.
Try for free →Services covered and matters to be disclosed (the Enforcement Regulation)
Article 22-2-27 of the Enforcement Regulation of the Telecommunications Business Act covers the following services when provided through a browser or other software:
- services that intermediate other people's communications (item 1)
- services offering equipment that records information received from users and sends it at the request of unspecified users (item 2)
- services that, in response to search terms entered, output the location of all web pages containing them (item 3)
- other services offering equipment that sends information at the request of unspecified users, for the purpose of allowing unspecified users to view information (item 4)
Under Article 22-2-29, for each such instruction the operator must disclose (1) the content of the user information to be sent, (2) the name of the person who will handle the information using the receiving equipment, and (3) the purpose for which the information will be used.
Article 22-2-28 requires, among other things, that the disclosure be in Japanese, avoid technical terms and use plain language, and be displayed with text of a suitable size without the user having to do anything.
Compliance found by the survey
The report states that a MIC-commissioned survey carried out in December 2025 found that websites tended not to comply with the rules as fully as mobile apps, and that compliance was particularly low, at 43.2%, among websites that do not also offer an app.
A footnote explains that the survey covered high-traffic websites and smartphone apps run by carriers and Category 3 operators subject to the rules.
The report also cites a MIC-commissioned survey from March 2025 in which about half of users said they were interested in how their information is handled, while about 80% said they only skim privacy policies or do not read them.
FREE CONSULTATION
Corporate Law: your first 30 minutes are free
- ・Handled by Yusuke Abe, admitted in Japan and New York
- ・Online (Zoom etc.) or at our office in Otemachi, Tokyo
- ・In English or Japanese
Measures proposed
Securing legal compliance
- MIC to draw up and publish model notices showing the minimum needed to meet the rules on websites and apps
- MIC to survey compliance regularly, publish the results and ask website operators whose response is inadequate to improve
- MIC to work with industry associations to encourage website operators to comply
Best practice beyond the legal minimum
- Operators subject to the rules should, in addition to the required notice or publication, give users a say through consent or an opt-out; at the least, an opt-out allowing users to stop the transmission afterwards is recommended
- Operators of websites and apps not subject to the rules are also expected to act voluntarily in line with their purpose
- Cooperation with third-party providers that supply external transmission functions such as tags and data collection modules
The handbook
The handbook attached to the report explains the rules, how to determine which operators and services are covered, how to give notice or publish and model wording, points to note when using consent or an opt-out, and practices recommended even for websites and apps outside the rules, with model formats. Its intended readers include both operators subject to the rules and operators of websites and apps that are not subject to them but send user information externally.
Issues for further study
The report says the immediate priority is to use the handbook to secure compliance and spread best practice quickly. As medium- to long-term issues it lists the following three, and states that they should be studied as necessary without ruling out changes to the legal framework:
- Reviewing which services the rules apply to (considering whether to simplify and clarify the scope, as the covered services are hard to identify)
- Strengthening user involvement (considering rules on opt-outs at the level of browsers and other interfaces)
- Responding to technological change (examining the privacy impact of methods that identify users without cookies and of new technologies such as AI)
Sources
- MIC press release on the results of the consultation on the draft second report of the Working Group on User Information (4 November 2026, in Japanese) https://www.soumu.go.jp/menu_news/s-news/01kiban18_01000299.html
- Annex 1: the second report, including the attached handbook (in Japanese) https://www.soumu.go.jp/main_content/001099581.pdf
- Annex 2: summary of the report (in Japanese) https://www.soumu.go.jp/main_content/001099582.pdf
- Annex 3: submissions received and MIC's views (in Japanese) https://www.soumu.go.jp/main_content/001099583.pdf
- e-Gov: Telecommunications Business Act (Act No. 86 of 1984) https://laws.e-gov.go.jp/law/359AC0000000086
- e-Gov: Enforcement Regulation of the Telecommunications Business Act (Ministry of Posts and Telecommunications Ordinance No. 25 of 1985) https://laws.e-gov.go.jp/law/360M50001000025
This page is based on what the government published and on the wording of the relevant laws. If you need advice on a specific matter, please consult a lawyer.
