Cookies and similar tracking technologies may fall under South Africa’s POPIA when they process personal information. This guide explains how the law affects analytics, advertising, direct marketing, overseas transfers, cookie notices, and consent choices.
South Africa does not have a universal GDPR-style rule requiring prior consent for every non-essential cookie. However, when cookies or similar technologies process personal information, the website operator must follow POPIA’s conditions for lawful processing.
This includes identifying an appropriate legal justification, collecting information that is adequate, relevant, and not excessive, providing clear notice, protecting the information, and respecting visitor rights. Consent may be appropriate for optional tracking, but it is not the only legal justification available under POPIA.
The sections below help you identify which technologies process personal information and decide what notice, consent choices, and controls your website may need.
What Is POPIA?
The Protection of Personal Information Act 4 of 2013, commonly called POPIA, is South Africa’s main data protection law. It regulates how public and private bodies process personal information and gives individuals rights over information connected to them.
POPIA is technology-neutral. It does not regulate only names, email addresses, or information submitted through forms. It can also apply to browser cookies, tracking pixels, device identifiers, analytics events, and advertising profiles when that information relates to an identifiable person.
The Act sets eight conditions for lawful processing. These cover accountability, processing limitations, purpose specification, limits on further use, information quality, openness, security, and data-subject participation. The complete requirements appear in the official Protection of Personal Information Act.
If you are new to the technology, start with our guide explaining what web cookies are and how they work.
Does South Africa Require a Cookie Banner?
POPIA does not contain a separate rule saying that every South African website must display a cookie banner. It also does not copy the European Union’s general ePrivacy approach of requiring prior consent before many non-essential cookies are stored or accessed.
The more useful question is whether a cookie or tracker processes personal information and, if it does, whether the processing meets POPIA’s conditions. Depending on the answer, a website may need a privacy or cookie notice, consent controls, an opt-out method, or a combination of these measures.
A banner is only an interface. It does not make a website compliant by itself. The wording and controls must match the technologies that actually load, the information they process, the purposes involved, and the legal justification relied upon.
When Do Cookies Involve Personal Information?
POPIA defines personal information broadly as information relating to an identifiable living person and, where applicable, an identifiable existing juristic person. A random cookie value may not identify anyone when viewed alone. It can become personal information when a website or provider can connect it with other data.
This can happen when a cookie, pixel, or identifier is linked to:
- a customer or member account;
- an email address, phone number, or contact form;
- an IP address or persistent device identifier;
- browsing history, search activity, or purchase information;
- a location, interest, or advertising profile;
- events collected by analytics or marketing platforms; or
- information held by another website, platform, or data provider.
Website owners should assess the complete data flow rather than judging a technology only by its name. Our guide to the main types of website cookies explains how necessary, analytics, preference, and marketing cookies differ.
Which POPIA Requirements Apply to Website Tracking?
The exact duties depend on the information, purpose, provider, and website. The following POPIA principles are especially relevant to cookies and tracking technologies.
| POPIA requirement | What it means | Website example |
|---|---|---|
| Lawful and reasonable processing | Processing must be lawful and must not unreasonably infringe privacy | Do not deploy intrusive tracking without a valid justification |
| Minimality | Information must be adequate, relevant, and not excessive | Avoid collecting full URLs or form values when aggregated events are enough |
| Lawful justification | At least one basis under section 11 must support the processing | Document consent, contract, legal duty, or legitimate interests as applicable |
| Purpose specification | Collection needs a specific, explicitly defined, lawful purpose | Describe analytics, security, or advertising as separate purposes |
| Openness | Visitors must receive the information required by section 18 | Use a clear privacy or cookie notice before collection where required |
| Retention | Records should not be kept longer than authorised or necessary | Review cookie durations and analytics retention settings |
| Security | Reasonable technical and organisational safeguards are required | Restrict access to identifiers, profiles, and preference records |
| Visitor rights | People may have access, correction, deletion, and objection rights | Explain how visitors can contact the responsible party |
| Foreign transfers | Section 72 conditions may apply to overseas recipients | Review international analytics and advertising providers |
Is Cookie Consent Required Under POPIA?
Consent is one lawful justification under section 11 of POPIA, but it is not the only one. Processing may also be justified when it is necessary for a contract, required by law, protects a legitimate interest of the data subject, supports a public-law duty, or is necessary for the legitimate interests of the responsible party or a third party.
This means consent is not automatically required for every cookie. A login-session cookie may support a service requested by the visitor. A security cookie may help protect users and the website. Optional advertising or detailed profiling is harder to justify in the same way and needs a more careful assessment.
When a website relies on consent, POPIA defines it as a voluntary, specific, and informed expression of will. The responsible party bears the burden of proving consent, and the data subject may withdraw it. A vague statement such as “By using this website, you accept all cookies” is therefore a weak foundation for optional tracking.
A shopping-cart cookie may be needed to remember products during checkout. A cross-site advertising tracker is not needed to complete that purchase. The two technologies should not automatically receive the same legal justification or visitor control.
Necessary, Analytics, and Advertising Cookies
POPIA does not use the EU concept of “strictly necessary cookies” as a universal statutory exception. Separating necessary and optional technologies is still a useful practical method because their purposes and privacy effects are different.
Necessary and security cookies
Cookies used for authentication, shopping carts, load balancing, fraud prevention, security, or remembering privacy choices may support a requested service or legitimate interest. They still need an identified purpose, proportionate data collection, suitable retention, transparency, and security.
Analytics cookies
There is no blanket POPIA rule saying that every analytics cookie always requires prior consent. Website owners should examine which identifiers and events are collected, whether the provider uses the information for its own purposes, whether less intrusive settings are available, how long the data is retained, and where it is sent.
Consent may be the clearer approach when analytics creates persistent profiles, follows known users, captures detailed page paths, or combines information across services. International websites may also need prior consent because stricter laws can apply to visitors in other regions.
Advertising cookies and pixels
Advertising tags can send page views, purchases, identifiers, and audience information to third-party platforms. They may support remarketing, cross-site tracking, or behavioural profiles. These activities generally create a stronger case for express visitor choice and for keeping the tags disabled until the chosen lawful approach has been implemented.
Website owners should also review tracking pixels, scripts, local storage, and browser fingerprinting. POPIA’s application depends on personal-information processing, not on whether the technology is technically called a cookie.
POPIA, Cookies, and Direct Marketing
Section 69 of POPIA regulates direct marketing through unsolicited electronic communications such as email, SMS, fax, and automated calls. It generally prohibits this processing unless the person has consented or the existing-customer conditions are met.
A behavioural advertising cookie is not automatically the same thing as an unsolicited marketing email. However, cookie and profile data may feed a wider direct-marketing system. Website owners should assess the tracking activity under the general POPIA conditions and separately check section 69 when personal information is used to contact people electronically.
The Information Regulator’s official direct-marketing guidance explains the consent, existing-customer, objection, and unsubscribe rules. Accepting cookies should not be treated as automatic permission for every future marketing message.
What Should a South African Cookie Notice Explain?
Section 18 requires a responsible party to take reasonably practicable steps to make the data subject aware of important collection details. When information is collected directly, this should generally happen before collection unless the person is already aware or an exception applies.
A practical privacy and cookie notice should explain:
- which cookie and tracking categories are used;
- what personal information may be collected;
- the specific purpose of each category;
- the identity and address of the responsible party;
- whether providing the information is voluntary or mandatory;
- the consequences of refusing an optional or necessary technology;
- which providers or categories of recipients receive the information;
- whether information is transferred outside South Africa;
- how long relevant information or identifiers are retained;
- how visitors can object, withdraw consent, or change preferences;
- how they can request access, correction, or deletion; and
- how they can contact or complain to the Information Regulator.
Review the notice whenever you add analytics, advertising, embedded video, chat, payment, testing, or social-media tools. A cookie scanner can help locate technologies, but its report is an inventory aid rather than a legal conclusion.
What Should a POPIA-Friendly Cookie Banner Include?
South African law does not prescribe one universal banner layout. The interface should reflect the website’s documented purposes and lawful justifications.
When consent is the chosen justification for optional tracking, a practical banner should provide:
- a short and accurate explanation of the purposes;
- a clear affirmative action for optional categories;
- a visible way to reject or leave optional technologies disabled;
- separate controls for analytics and advertising where appropriate;
- a link to detailed privacy and cookie information;
- a persistent way to change or withdraw the choice; and
- technical blocking that follows the visitor’s selection.
Avoid preselected optional categories, hidden reject controls, misleading colours, or descriptions such as “improve your experience” when the real purpose is behavioural advertising. See our cookie banner examples for practical design comparisons.
Practical POPIA Cookie Checklist
Use this checklist before choosing a banner, notice, consent mechanism, or opt-out control.
- Inventory cookies, pixels, scripts, local storage, and device identifiers.
- Identify which technologies process personal information.
- Document a specific purpose and lawful justification for each activity.
- Remove data fields and tracking that are not necessary for the purpose.
- Review providers, contracts, retention periods, and overseas transfers.
- Give visitors the information required by section 18.
- Use consent or opt-out controls that match the actual processing.
- Test that tags respect the selected preference.
- Keep records and revisit the assessment when the website changes.
Common POPIA Cookie Mistakes
Common mistakes include:
- assuming that POPIA and GDPR impose identical cookie rules;
- treating every cookie as personal information without checking the data flow;
- assuming consent is the only possible lawful justification;
- calling analytics or advertising “necessary” because it benefits the business;
- using one acceptance button without explaining separate purposes;
- loading optional tags before the stated choice takes effect;
- ignoring third-party use, foreign transfers, and retention periods;
- collecting complete URLs or form values that reveal more information than expected; and
- publishing a cookie policy that does not match the website’s current technologies.
Test the website in a private browser window before and after each preference choice. Check both browser storage and network requests, because some pixels and scripts can transfer information without creating a traditional cookie.
Conclusion
POPIA focuses on whether cookies and tracking technologies process personal information and whether that processing is lawful, reasonable, transparent, secure, and connected to a defined purpose.
The correct setup depends on the technology and data flow. Inventory the website, identify the purpose and lawful justification, review third parties and international transfers, provide a clear notice, and offer meaningful controls where needed. This article provides general information and is not legal advice.
Frequently Asked Questions
Common questions about this topic
South Africa does not have a universal rule requiring every website to display a GDPR-style cookie banner. A website may still need a notice, consent, opt-out controls, or another mechanism when cookies or trackers process personal information.
It can. POPIA becomes relevant when a cookie, pixel, device identifier, or similar technology processes personal information relating to an identifiable person.
Not automatically in every case. The website should assess the information collected, purpose, lawful justification, provider use, retention, transparency, and whether a less intrusive configuration is available.
POPIA does not contain a blanket cookie-consent rule, but optional behavioural advertising, cross-site tracking, and detailed profiling require careful justification. Express consent is often the clearer and lower-risk approach for these activities.
It should explain the information collected, purposes, responsible party, recipients, overseas transfers, retention, available choices, data-subject rights, and how to contact the organisation or Information Regulator.
