APPI
Act on the Protection of Personal Information (Japan)
One of Asia's most established privacy laws - now requiring clearer consent for cookie-linked personal data.
Quick navigation
APPI
What it means
APPI is among the oldest and most respected data protection frameworks in Asia. Global companies entering Asia often start compliance planning with Japan.
Recent updates strengthened rules around data collected through cookies and similar technologies when that data can be linked to an identifiable person. Consent and transparency expectations for marketing tags have tightened.
Japan · Asia-Pacific
Who must comply
- You handle personal information of individuals in Japan.
- You use analytics, advertising, or profiling cookies for Japanese visitors.
- You are a foreign business offering goods or services to people in Japan.
APPI
What you need to do
- Inform users about purposes of cookie-based data collection.
- Obtain consent where required before optional tracking technologies run.
- Provide a way to stop or update consent preferences.
- Apply reasonable security for personal data handled through vendors.
- Respond to individual rights requests under APPI rules.
Plain language
What it is not
APPI
FAQ
Does APPI cover cookies?
Yes, when cookie data can identify or be linked to a specific person, APPI's personal information rules apply.
Why do global companies prioritize Japan first in Asia?
Japan combines large digital ad spend, mature enforcement, and high user trust expectations for privacy UX.
How should consent work under APPI?
Visitors should understand categories and purposes before optional cookies fire, with records kept of their choices.