Cookies Policy

1. Revised Personal Data Protection Bill, 2019: The new Personal Data Protection Bill, 2019 although has not been enacted yet but should be modified. This bill defines personal data as any data about a natural person that is directly or indirectly identifiable. This certainly pertains to identification of information related to a natural person. However, cookies generally do not have a function of identification of a natural person and thus this is outside its purview. In accordance with the views of the experts, personal data cannot be irreversibly anonymized and hence the companies which use browsing history as a way to identify individual users run the risk of de-anonymization. 

A study also finds that half of the population is uniquely identified based on place, date of birth and gender details. This bill proves to be inadequate in the regulation of the cookies as it does not address the standards of characterisation of the process of anonymisation and hence should be revised considering the gravity of the issue of privacy in the future. 

2. Need of a Cookie Law: 

The solution to all questions regarding the ambiguity in different legislations related to privacy, is a comprehensive cookie policy law which is jurisdiction-based, which shall prove beneficial in resolving interpretational problems and ensure robust enforcement. Enforcing a cookie law shall also ensure the protection of economic interests of the companies with elimination of privacy concerns by incorporating penalising regulations under such laws.  

1. The Act on the Protection of Personal Information. 
2. The Act on Regulation of the Transmission of Specified Electronic Mail.

Under the APPI, consent for transfer of personal data and its collection requires mandatory consent. So, the first party might not require cookies; however disclosure of the privacy policy is prohibited. Hence it can be stated that Japan might require consent for third party cookies.