Singapore PDPA: Does your website need a cookie banner?

When does a cookie need consent?

The PDPA applies when cookies collect personal data: data about an individual who can be identified from it, alone or with other information you have or are likely to access (section 2). Chapter 7 of the PDPC’s Advisory Guidelines on Selected Topics applies this to cookies.

1. A cookie that collects no personal data

PDPC guidance: consent is not needed for cookies that do not collect personal data, such as a session cookie that only stores the technical data needed to play a video.

Check before concluding this: the more data points you tie to an identifier such as an IP address over time, the more likely a person becomes identifiable.

2. A cookie linked to an identifiable user for a requested function

PDPC guidance: for activities the user clearly requested, consent may not need to be sought where the user knows the purpose and voluntarily provided the data, for example completing a purchase, logging in, security, preferences and streaming.

This mirrors deemed consent by conduct (section 15(1)), which covers only purposes obvious from the circumstances. Logging in to book a class is not agreement to advertising use of the session data.

3. Optional advertising cookies

PDPC guidance: ad targeting that collects and uses personal data through cookies requires consent, and as good practice the PDPC recommends on-site cookie preferences. The obligation sits with whoever collects the data, so check whether that is your site or a third party.

Practical tip: keep advertising cookies off until the visitor opts in, with a settings link that reopens the choice. The PDPA prescribes no banner format, but this records consent and eases withdrawal.

Permission routes and their limits

Section 13 requires consent unless the PDPA or another law allows processing without it. Each route has conditions; none is a general license to track:

• Consent (sections 13–14): valid only after you notify the purposes, and not if you demand more than the service needs or mislead.
• Deemed consent by conduct (section 15(1)): data volunteered for an obvious purpose, such as paying for an order, but not unrelated marketing.
• Deemed consent by contractual necessity (section 15(3)–(7)): disclosures reasonably necessary to conclude or perform a contract with the person, such as to a payment provider or courier.
• Deemed consent by notification (section 15A): a prior adverse-effect assessment, adequate notice and a reasonable opt-out period; not for sending direct marketing messages.
• Legitimate interests exception: an adverse-effect assessment, a balancing test where effects remain, and public disclosure. The PDPC’s examples are fraud prevention, security and preventing misuse of services.
• Business improvement exception: using data you already hold lawfully to improve products or understand preferences, where identifiable data is needed and the use is reasonable. It does not cover new collection outside a corporate group.

Practical tip: record the route for each purpose. If you cannot show its conditions are met, ask for consent.

Notification and withdrawal

PDPA requirement: when relying on consent, state your purposes on or before collection and, on request, name a contact for questions (section 20). The PDPC suggests layered notices; see its Guide to Notification.

PDPA requirement: people can withdraw consent, including deemed consent, on reasonable notice. Explain the likely consequences and stop the collection, use or disclosure, including by data intermediaries, unless the law allows it without consent (section 16).

PDPC guidance: ten business days is a rule of thumb for reasonable notice, and the PDPC says people must be allowed to withdraw consent for optional purposes without losing necessary ones.

Practical tip: a settings link that reopens the banner makes withdrawal quick; then check that tags and audience lists follow it. See Let visitors change or withdraw consent.

Example: a fitness studio’s booking site

A fitness studio in Singapore takes class bookings online: members log in, enter contact details and pay by card. The site also runs analytics and a remarketing pixel.

The login cookie and booking form can rest on consent given in the form or deemed consent by conduct, and passing card details to the payment provider on contractual necessity. The remarketing pixel targets ads with personal data, so it waits for an opt-in. Analytics that only counts visits without identifying anyone may fall outside the PDPA.

Cookie choices and other marketing channels

PDPA requirement: marketing calls, texts and faxes to Singapore telephone numbers fall under the separate Do Not Call provisions, with their own Register and consent rules. A cookie choice does not satisfy them.

PDPC guidance: obtain express, opt-in consent for direct marketing messages; pre-ticked boxes are not appropriate, and deemed consent by notification, legitimate interests and business improvement cannot be used to send them.

Practical tip: store cookie, email and phone marketing permissions as separate fields, so a “yes” to advertising cookies is never read as permission to call or email.

Website checklist

• Classify cookies: mark which collect personal data, alone or combined.
• Match a route: record consent, deemed consent or exception per purpose.
• Test ad cookies: confirm they stay off until the visitor opts in.
• Test withdrawal: confirm tags and audience exports stop.
• Separate channels: keep cookie, email and DNC permissions apart.
• Requests: route access and correction requests (sections 21–22).

FAQ