New Zealand’s Privacy Act 2020 may apply when cookies and similar technologies collect or handle identifiable information. This guide explains how the law affects analytics, advertising, consent, notices, and other privacy controls.
New Zealand does not automatically require every website to use a GDPR-style cookie banner or obtain prior consent for every non-essential cookie.
The appropriate approach depends on what each technology does. Websites should have a lawful purpose, collect only necessary information, provide clear notice, and use and disclose the information consistently with that notice.
Consent or opt-out controls may be appropriate for advertising, detailed profiling, cross-site tracking, and other uses visitors would not reasonably expect.
What Is the New Zealand Privacy Act 2020?
The Privacy Act 2020 is New Zealand’s main privacy law. It applies to almost all organisations and businesses and regulates how they collect, hold, use, disclose, and protect personal information.
The law contains Information Privacy Principles, usually called the IPPs. These principles are technology-neutral. They do not create rules only for browser cookies, but they can apply when cookies, tracking pixels, local storage, device identifiers, analytics tools, or advertising technologies handle personal information.
If you are new to browser cookies, our guide explaining what web cookies are provides a simple introduction to how they store and exchange information.
Does New Zealand Require a Cookie Banner?
Not every New Zealand website automatically needs a cookie consent banner. New Zealand does not have a direct equivalent of the EU ePrivacy rule that commonly requires prior consent before many non-essential cookies are stored or accessed.
The more useful questions are:
- Does the cookie or tracker collect personal information?
- Is the collection necessary for a lawful purpose connected with the organisation’s activities?
- Is the method of collection fair and not unreasonably intrusive?
- Has the visitor received the required information?
- Does later use or disclosure match the original purpose?
- Does a third party use the information for its own purposes?
- Is information disclosed outside New Zealand?
- Would consent or an opt-out provide appropriate visitor control?
A banner may be useful when the website needs a clear choice for optional technologies. In other situations, a privacy notice or opt-out mechanism may be more appropriate. The visual interface should match the organisation’s real data practices.
New Zealand’s Privacy Act does not depend on consent as the primary authority for every collection, use, or disclosure of personal information. Consent can still be important, but it does not replace the requirements for a lawful purpose, necessity, fairness, transparency, and appropriate limits on later use and disclosure.
When Do Cookies Involve Personal Information?
The Privacy Act applies to personal information. Broadly, this is information about an identifiable individual.
A cookie value may appear anonymous when viewed alone. It can become personal information when the organisation or a technology provider can connect it with information such as:
- a customer or user account;
- an email address or telephone number;
- an IP address or persistent device identifier;
- browsing history, search activity, or interests;
- purchase or subscription information;
- location information;
- an advertising profile; or
- information held by another website or platform.
Website owners should assess the complete data flow rather than looking only at a cookie name. Pseudonymous identifiers can still relate to an identifiable person when they are combined with account, device, or behavioural information.
Which Information Privacy Principles Apply?
Several Information Privacy Principles can become relevant to website cookies and tracking. The exact combination depends on the information, purpose, provider, collection method, and data flow.
| Privacy principle | What it covers | Website consideration |
|---|---|---|
| IPP 1 | Purpose and necessity | Collect personal information only when necessary for a lawful purpose |
| IPP 3 | Notice for direct collection | Explain why information is collected, who receives it, and relevant consequences |
| IPP 3A | Notice for indirect collection | Assess notification when personal information comes from another source |
| IPP 4 | Fair manner of collection | Avoid misleading, unfair, or unreasonably intrusive tracking |
| IPP 5 | Storage and security | Protect identifiers, profiles, and consent or preference records |
| IPPs 10 and 11 | Limits on use and disclosure | Check whether analytics, advertising, or vendor sharing matches the original purpose |
| IPP 12 | Disclosure outside New Zealand | Assess personal information disclosed to overseas technology providers |
The Office of the Privacy Commissioner provides an official overview of all the Information Privacy Principles.
What Changed Under the Privacy Amendment Act 2025?
The Privacy Amendment Act 2025 added Information Privacy Principle 3A. The new principle came into force on 1 May 2026.
IPP 3A creates a notification obligation when an organisation collects personal information indirectly, meaning from a source other than the individual concerned. Unless an exception applies, the organisation must take reasonable steps to inform the person.
For website tracking, IPP 3A may become relevant when an organisation obtains personal information about a visitor from:
- an advertising platform;
- a data broker or audience provider;
- another organisation within a business group;
- a social media platform;
- a third-party enrichment service; or
- another website or external database.
The rule does not mean every third-party cookie automatically requires an individual message. The organisation must determine whether it is collecting personal information indirectly, whether an exception applies, and what reasonable notification looks like in the circumstances.
Read the Privacy Commissioner’s current IPP 3A guidance when information is obtained from another source.
When Is Cookie Consent Required in New Zealand?
The Privacy Act does not make consent the universal starting point for all website tracking. An organisation must first identify a lawful purpose and ensure that collecting the personal information is necessary for that purpose.
Consent or an express visitor choice becomes particularly important when:
- the tracking is optional and privacy-intrusive;
- information will be used for a new purpose that the visitor would not expect;
- information will be disclosed to a third party for its own purposes;
- the technology supports detailed profiling or cross-site tracking;
- the collection involves sensitive information;
- the website has promised to obtain consent;
- another applicable law or contractual requirement requires consent; or
- the website also serves regions with stricter prior-consent requirements.
Permission can sometimes support a use or disclosure that differs from the original purpose under IPPs 10 and 11. However, consent should not be treated as a way to justify collecting excessive information that is not necessary for a lawful purpose.
A generic statement such as “By using this website, you accept all cookies” does not by itself solve New Zealand privacy requirements. The organisation must still identify a lawful purpose, collect only necessary information, act fairly, explain relevant practices, and control later use and disclosure.
Necessary and Optional Cookies
New Zealand’s Privacy Act does not use the EU “strictly necessary cookie” exception as its universal legal test. However, separating necessary and optional technologies remains a useful practical step.
Technologies that may support requested website functions include:
- authentication and login-session cookies;
- shopping-cart and checkout cookies;
- security and fraud-prevention technologies;
- load-balancing cookies;
- cookies that store information entered during a transaction; and
- cookies that remember privacy choices.
Analytics, personalised advertising, remarketing, social media tracking, and cross-site profiling are usually optional from the visitor’s perspective. Our guide to the main types of website cookies explains these categories in more detail.
A technology should not be called necessary merely because it is useful to the business. Review its real purpose, data, recipients, duration, and whether the requested service can operate without it.
Do Analytics Cookies Require Consent in New Zealand?
There is no universal rule stating that every analytics cookie always requires prior consent under the Privacy Act. The answer depends on whether personal information is collected, whether the collection is necessary, how the tool is configured, and how the provider uses the information.
Before activating analytics, check:
- which cookies, IP addresses, identifiers, and events are collected;
- whether the information is about an identifiable person;
- whether detailed page paths or form values may reveal sensitive information;
- whether the provider uses information for its own purposes;
- whether data is combined across websites or services;
- whether information is disclosed outside New Zealand;
- how long the information is retained;
- whether a less intrusive configuration is available; and
- whether visitors should receive consent or an opt-out control.
If your website uses Google Analytics, read our separate guide to Google Analytics cookie consent. An international website serving both New Zealand and European visitors may choose to keep analytics disabled until consent because stricter prior-consent rules can apply in Europe.
Advertising Cookies, Pixels, and Profiling
Advertising technologies require a more careful assessment. Meta Pixel, Google Ads tags, remarketing services, affiliate trackers, and social media pixels can send browsing events and persistent identifiers to third-party platforms.
These technologies may create profiles, combine information across services, or use website data for the provider’s own advertising purposes. This raises questions under IPP 1, notification requirements, fair collection, limits on use and disclosure, and overseas disclosure.
For optional behavioural advertising or detailed cross-site tracking, prior consent is often the safer practical approach. Keep the relevant tags disabled until the visitor actively accepts the advertising category, especially when the website also serves visitors in stricter regions.
Labels such as “improve your experience” are not enough when the actual purpose is personalised advertising or profile building. Explain the purpose and relevant third parties clearly.
Our guide explaining what tracking pixels are shows how these technologies collect information even when no traditional browser cookie is visible.
What Should a New Zealand Cookie Banner Include?
New Zealand law does not prescribe one mandatory visual design for every cookie banner. The interface should reflect the website’s actual purposes and privacy requirements.
When prior consent is appropriate, a practical banner can include:
- a short and clear explanation of relevant purposes;
- an Accept All option;
- a visible Reject Optional option;
- a Manage Preferences option;
- separate analytics and advertising categories;
- optional technologies disabled until a choice is made;
- a link to detailed privacy and cookie information; and
- a persistent way to change the choice later.
The interface should not use misleading wording, hidden controls, or unnecessary pressure. See our cookie banner examples for a practical comparison of clear and misleading designs.
If prior consent is not required for a particular technology, a shorter notice or opt-out interface may be more appropriate. The control must still match the organisation’s documented position and the website’s actual behaviour.
What Should the Privacy and Cookie Notice Explain?
IPP 3 requires organisations collecting personal information directly to take reasonable steps to ensure that individuals understand relevant collection details. Since 1 May 2026, IPP 3A also covers qualifying indirect collection.
For website cookies and tracking, explain:
- which categories of cookies and similar technologies are used;
- what personal information may be collected;
- why the information is collected;
- who will receive or access it;
- whether providing the information is voluntary or compulsory;
- what may happen if the information is not provided;
- whether information is disclosed outside New Zealand;
- how long information is retained;
- how visitors can reject, opt out, or change preferences; and
- how individuals can request access or correction and contact the organisation.
The Office of the Privacy Commissioner explains the difference between a privacy statement, privacy notice, and internal privacy policy.
Review the notice whenever you add a plugin, advertising campaign, video embed, chat widget, analytics tool, or other third-party service. A cookie scanner can help identify technologies that may otherwise be missed. You can also follow our guide explaining how to find cookies on a website using browser tools.
Overseas Analytics and Advertising Providers
Analytics, advertising, cloud, chat, payment, and consent-management providers may receive personal information outside New Zealand.
IPP 12 applies when an organisation discloses personal information to a foreign person or entity. The disclosing organisation generally needs reasonable grounds to believe that the recipient is subject to comparable safeguards or that another permitted condition applies.
Website owners should identify:
- which overseas providers receive personal information;
- whether the provider processes information only on the organisation’s behalf;
- whether the provider uses or discloses information for its own purposes;
- which contractual or legal safeguards apply;
- whether onward disclosures occur; and
- whether the privacy notice accurately explains overseas disclosures.
The Privacy Commissioner’s guide to sending personal information overseas includes practical tools and model clauses.
Direct Marketing and Unsubscribe Rights
New Zealand’s Privacy Act is not the only law that may affect online marketing. The Unsolicited Electronic Messages Act 2007 regulates commercial electronic messages with a New Zealand link.
The law covers commercial email, fax, instant messages, and mobile text messages. It does not create a general rule for website pop-ups or browser cookies.
Businesses sending covered commercial electronic messages should obtain the required form of consent, identify the sender, and provide a functional unsubscribe facility. Review the Department of Internal Affairs’ official guide explaining what New Zealand anti-spam law means for businesses.
A cookie banner does not replace email or text-message marketing requirements. The website’s newsletter form, advertising trackers, and later marketing messages may each require a separate assessment.
Do Foreign Websites Need to Follow New Zealand Privacy Law?
The Privacy Act can apply to an overseas organisation carrying on business in New Zealand, even if it does not have a physical office in the country.
Relevant factors may include:
- New Zealand customers or registered users;
- goods or services directed to New Zealand;
- payments or profit from New Zealand business;
- local advertising campaigns;
- New Zealand-specific prices, delivery, or support;
- local employees or commercial relationships; and
- the scale and regularity of New Zealand activity.
A small number of accidental visits does not by itself provide a complete answer. Foreign websites should assess their real business activity and data flows rather than relying only on where the company or server is located.
Cookies and Children’s Personal Information
The Privacy Act requires particular care when personal information is collected from children and young people. Under IPP 4, whether collection is fair depends on the circumstances, including the person’s age and capacity and the sensitivity of the information.
A child-directed website should:
- use notices suitable for the expected age group;
- collect only information genuinely needed for the service;
- avoid unnecessary behavioural advertising and profiling;
- consider whether a parent or guardian should be involved;
- avoid misleading or overly persuasive design; and
- assess third-party apps, embeds, and advertising providers carefully.
Children and young people have privacy rights of their own. An ordinary adult-facing cookie banner should not be treated as a complete solution for a child-directed service.
Practical New Zealand Cookie Consent Examples
| Website setup | Likely approach | Why |
|---|---|---|
| Simple portfolio with no analytics, pixels, accounts, or optional cookies | A consent banner may not be needed | Confirm the hosting platform and whether any personal information is collected |
| Online store using only cart, checkout, authentication, and security cookies | Explain the technologies; prior consent may not be required | The cookies support services requested by the visitor |
| Business website using limited first-party analytics | Assess necessity, transparency, configuration, and visitor controls | Analytics does not produce one automatic answer under the Privacy Act |
| WordPress site using Google Analytics and Google Ads remarketing | Use prior consent for optional advertising and profiling technologies | Third-party tracking and secondary advertising uses create greater privacy risks |
| Health website sending page names or form events to an advertising platform | Do not activate without a careful privacy assessment and appropriate choice | The events may reveal sensitive information about identifiable visitors |
| International website serving New Zealand and the EU | Use a strict global model or dependable regional configuration | Different privacy and cookie regimes may apply to the same website |
New Zealand Cookie Compliance Checklist
Use this checklist as a practical starting point for a website serving visitors in New Zealand.
- Scan the website for cookies, pixels, local storage, identifiers, embeds, and third-party requests.
- Determine which technologies collect or handle personal information.
- Document a lawful purpose and why each collection is necessary.
- Check that collection methods are fair and not unreasonably intrusive.
- Provide the information required under IPP 3 for direct collection.
- Assess IPP 3A when personal information comes from another source.
- Review later uses, third-party disclosures, and overseas providers.
- Use consent or opt-out controls where they provide an appropriate visitor choice.
- Keep optional advertising and profiling disabled until consent when that is the selected approach.
- Update privacy and cookie notices so they match the website’s actual behaviour.
- Test the website before acceptance, after rejection, and after preferences are changed.
- Repeat the review whenever plugins, providers, campaigns, or website features change.
New Zealand vs European Union Cookie Rules
New Zealand and the European Union both regulate personal information, but they do not use identical cookie frameworks. For a wider comparison, see our guide to cookie consent laws around the world.
| Question | New Zealand | European Union |
|---|---|---|
| Main framework | Privacy Act 2020 and Information Privacy Principles | GDPR plus national laws implementing the ePrivacy Directive |
| Universal prior consent for non-essential cookies? | No blanket cookie rule; assess personal information, necessity, purpose, notice, use, and disclosure | Prior consent is commonly required unless a storage or access exception applies |
| Is consent the primary authority? | No; lawful purpose, necessity, fairness, and the IPPs are central | GDPR provides several lawful bases, while separate ePrivacy consent requirements may apply |
| Indirect collection notice | IPP 3A applies from 1 May 2026, subject to exceptions | GDPR transparency rules address data obtained from the individual and other sources |
| Overseas disclosure | IPP 12 requires appropriate grounds and comparable safeguards in relevant cases | GDPR restricts transfers outside the EEA unless an approved mechanism applies |
An EU-style prior-consent banner may provide useful controls for New Zealand visitors, especially on an international website. However, the same interface does not replace a New Zealand-specific assessment of necessity, collection notices, use, disclosure, overseas providers, retention, and security.
What Happens If a Website Violates the Privacy Act?
Privacy problems can lead to complaints, Privacy Commissioner investigations, compliance notices, proceedings, contractual disputes, and reputational damage.
Risk is not limited to the visible banner. A website may still have problems when it collects unnecessary information, uses misleading notices, loads undisclosed trackers, shares data for an incompatible purpose, keeps information too long, or fails to assess third-party providers.
If a privacy breach has caused or is likely to cause serious harm, the organisation may need to notify the Office of the Privacy Commissioner and affected individuals. Website owners should ensure their analytics, advertising, cloud, and consent providers report incidents quickly enough for the organisation to assess its obligations.
The strongest process is ongoing: scan, classify, minimise, document, configure, test, and repeat whenever website technologies change.
Conclusion
New Zealand cookie consent laws do not create one universal requirement for every website to use a GDPR-style banner. The correct answer depends on whether cookies and similar technologies handle personal information and whether the organisation complies with the Privacy Act’s Information Privacy Principles.
Website owners should identify a lawful purpose, collect only necessary information, act fairly, provide appropriate notices, and control later use and disclosure. They should also review overseas providers and the new IPP 3A requirements for indirect collection.
A website using only technologies needed for requested functions may not require a consent banner. A website using analytics, advertising pixels, detailed profiling, cross-site tracking, or several regional configurations needs a more complete assessment and may benefit from prior consent or clear opt-out controls.
This guide provides general information about New Zealand privacy and cookie requirements. It does not constitute legal advice.
Recommended Next Step
Now apply these New Zealand requirements to the cookies, analytics tools, advertising pixels, embeds, and other technologies used by your own website.
Use the green Do You Need a Cookie Banner? button below to check whether your website needs consent, a privacy notice, opt-out controls, or another privacy mechanism.
Frequently Asked Questions
Common questions about this topic
New Zealand does not have one universal rule requiring every website to display a GDPR-style cookie banner. A website may still need consent, a privacy notice, opt-out controls, or another privacy mechanism depending on the information collected and how it is used or disclosed.
It can. The Privacy Act applies when cookies, pixels, or similar technologies collect or handle personal information about an identifiable individual.
No universal rule requires prior consent for every analytics cookie. The organisation should assess personal information, necessity, purpose, configuration, transparency, third-party use, and overseas disclosure.
The Privacy Act does not create one blanket cookie-consent rule. However, prior consent is often the safer approach for optional behavioural advertising, cross-site tracking, and detailed profiling, especially when providers use personal information for their own purposes.
IPP 3A is a notification principle for personal information collected indirectly from another source. It came into force on 1 May 2026 and applies unless one of its exceptions is available.
No. Consent does not remove the need for a lawful purpose, necessary collection, fairness, security, and compliance with the other Information Privacy Principles.
It may apply when personal information is disclosed to a foreign provider. The exact position depends partly on whether the provider acts only as the organisation’s agent or uses the information for its own purposes.
It can apply to an overseas organisation carrying on business in New Zealand even when the organisation has no physical office there. The website should assess its New Zealand customers, services, payments, marketing, and other business activity.
