Key Facts
Overview
Japan's APPI is the country's primary data protection law, with specific cookie and tracking provisions added by the 2023 Telecommunications Business Act. Consent is required before providing person-related identifiers (cookies, IPs, device IDs) to third parties that will link them to identified individuals. The PPC conducts mandatory three-year review cycles.
What This Means for Your Website
- Consent is required before providing cookies, IP addresses, and device IDs to third parties that link them to identified users
- First-party cookies and essential technical data (OS, browser, language) are exempt
- The purpose of data use must be specified and publicly available
- Breach notification to the PPC and affected individuals is mandatory
- Cross-border transfers require adequacy, consent, or contractual safeguards
- Foreign businesses serving Japanese users are subject to extraterritorial application
Key Requirements
The PPC enforces APPI with penalties up to 100 million JPY for legal entities and 1 year imprisonment for individuals. The 2026 Policy Direction proposes stricter rules for minors under 16, administrative monetary penalties, and collective redress schemes. Draft amendments are expected to take effect around 2027.
How ConsentStack Handles This
ConsentStack detects Japanese visitors and manages cookie consent in compliance with both APPI and the Telecommunications Business Act, blocking third-party tracking until consent is given.
Penalties
Individuals: up to 1 year imprisonment or 1M JPY. Legal entities: up to 100M JPY. Marketing violations: up to 30M JPY for entities.
Key Requirements
- Opt-in consent before providing person-related identifiers to linking third parties
- Notification or disclosure about cookie usage required
- Purpose of use must be specified and publicly available
- Mandatory breach notification to PPC and affected individuals
- Cross-border transfer restrictions with adequacy, consent, or contractual safeguards
Notable Provisions
- Mandatory three-year PPC review cycle
- 2026 Policy Direction proposes stricter minors rules and administrative penalties
- Telecommunications Business Act adds specific cookie transparency obligations
- First-party cookies and essential technical data are exempt
Data Subject Rights
Ask a business for the purpose of use of the personal data it holds about you and, if it sent your data to a third party abroad relying on that party's equivalent safeguards, for information on those safeguards; subject to limited exceptions, it must answer without delay (no fixed number of days).
Request disclosure of the personal data a business holds about you, by electronic record or another method you specify; the business must disclose it without delay (no fixed number of days), may charge a reasonable fee, may withhold it on limited grounds, and can be sued two weeks after your request arrives.
Request disclosure of the records a business must keep when it provides your personal data to a third party (including the date and the third party's name) or receives it from one, on the same terms and timing as a disclosure request.
If personal data a business holds about you is not factual, request that it be corrected, added to or deleted; the business must investigate without delay (no fixed number of days), make the corrections needed for the purpose of use, and tell you the result.
Ask a business to stop using or sharing your data if it was misused, obtained improperly or shared in breach of the Act, is no longer needed, was in a reportable breach, or risks harming your rights or legitimate interests, or at any time if shared under a filed opt-out scheme; justified requests are met without delay.
Ask a business to delete your personal data if it was used beyond its purpose or improperly, obtained improperly, is no longer needed, was in a reportable breach, or risks harming your rights or legitimate interests; if justified, it must delete or stop using it without delay as needed, or take alternative measures.
Make a purpose-of-use, disclosure, correction, cessation or erasure request through an agent, namely the legal representative of a minor or adult ward, or an agent you have appointed to make the request.
Raise a complaint about how a business handles your personal information with the business itself, which must make its complaint contact available to you and endeavor to process complaints appropriately and promptly (the Act sets no response period).
Raise a complaint about a business's handling of your personal information with the Personal Information Protection Commission, which can mediate between you and the business, with a local government, or with an accredited personal information protection organization that covers the business.
Other Asia Pacific Regulations
Frequently Asked Questions
Stay compliant with APPI
ConsentStack helps you implement Opt-in consent for Japan automatically.