Guide · June 17, 2026
Show cookie banners by region/country: PDPL for Vietnam, GDPR for EU
How to show cookie banners by region/country to apply PDPL in Vietnam and GDPR in the EU while optimizing user experience.
Quick answer
What is showing cookie banners by region/country (geo-targeting)?
This is how a website/app determines a user’s country or region and then shows an appropriate cookie notice. For example: visitors from Vietnam see a PDPL-compliant banner, while visitors from the EU see a GDPR-compliant banner. The goal is to optimize the experience while still meeting the corresponding legal obligations.
For Vietnamese businesses, this is not just a UI issue. When you use analytics, ad pixels, A/B testing, heatmaps, retargeting, or third-party SDKs, your system may trigger obligations to obtain consent, disclose processing purposes, allow withdrawal of consent, and keep an audit trail as required.
When to apply PDPL for Vietnam, GDPR for the EU?
Apply by region when your website/app has significant traffic from multiple markets and personal data is collected via cookies or trackers. For users in Vietnam, the Personal Data Protection Law (Law 91/2025/QH15) is expected to take effect 01/01/2026 and will replace Decree 13/2023/ND-CP; for users in the EU, the GDPR remains the mandatory reference framework.
A real example: a Vietnamese SaaS runs LinkedIn and Google Ads and uses GA4. If a visitor comes from the EU, the banner needs clear accept/decline buttons, purpose-based descriptions, and should not fire non-essential trackers before consent. If a visitor comes from Vietnam, you still need to be transparent about the data types, purposes, data recipients, and the mechanism to withdraw consent as required by PDPL.
How to design geo-targeting without breaking the experience?
Do not use geo-targeting to “avoid” obligations. A reasonable approach is to use it to show the right language, legal content, level of detail, and choice flows per region. Users should see information that’s easy to understand, require minimal actions, and not be forced to consent to proceed if the applicable law requires consent.
Determine applicable regions:
Derive country signals from IP, browser language, billing country, or a user’s manual selection. Prefer allowing users to change their region if detection is wrong.
Classify trackers:
Separate cookies/trackers into necessary, analytics, personalization, advertising, and third-party providers. Only auto-enable groups that do not require consent when they are truly necessary for the service.
Map laws by region:
Vietnam shows PDPL content; the EU shows a GDPR banner; other regions use a default policy while still ensuring transparency and opt-out choices.
Store proof of consent:
Record the timestamp, banner version, per-purpose choices, inferred country, and the withdrawal mechanism. This is where many SMEs fall short.
Set a safe fallback:
If the region cannot be determined, show the “higher-standard” banner instead of staying silent. This usually reduces risk versus letting all trackers run.
Test regularly:
Test from multiple IPs/VPNs, on mobile/desktop, and across languages. Ensure the banner doesn’t cover critical CTAs and doesn’t slow page load excessively.
What should you store to prove compliance?
At a minimum, keep: region-specific banner content, the cookie policy, the tracker inventory, display timestamps, consent/decline logs, the policy version, and the history of vendor changes. For marketing systems, also keep your tag manager audit logs so you can cross-check in case of disputes.
This is particularly important because under PDPL, serious violations can be subject to criminal handling; the specific penalty levels will be set by a Government decree and are not yet fixed. The enforcement authority is the Ministry of Public Security — Department of Cybersecurity and Hi‑Tech Crime Prevention (A05).
Practical implementation example for a Vietnamese website
Suppose an online shop in Ho Chi Minh City sells to Singapore, Germany, and Vietnam:
- Users in Vietnam: a Vietnamese banner explaining analytics/ads with options "Accept", "Decline", and "Customize".
- Users in Germany/the EU: a banner in English/German, non-essential trackers off by default, with clearer per-purpose descriptions.
- Users whose region cannot be determined: show the most conservative version and allow manual language and country selection.
This approach helps reduce bounce rate because users see content in the right language, while the ops team still has logs to respond to DSARs, verify consent, and handle withdrawal requests if any.
| Approach | Pros | Risks/considerations | |
|---|---|---|---|
| One banner for all countries | Easy to implement, less code | Content overload, not optimized for each region’s laws | |
| Geo-targeting by IP + manual fallback | Good personalization, less friction | IP can be wrong; allow users to change region manually | |
| No banner, policy only in footer | Minimal UX impact | Insufficient for trackers/scope that require consent under the rules |
Technical notes for devs and SMEs when implementing
Do not rely on IP alone. Combine IP with locale, user account, billing country, and manual selection to reduce detection errors. The banner should load fast and not block the entire page, but non-essential tags must be blocked until a valid consent signal is present under the rules.
If you use a consent management platform, verify it supports versioning, audit logs, geo rules, multi-language, and exporting evidence. For small teams, this is where consent.vn can help you manage cookie banners, store proof of consent, and streamline DSAR workflows.
- Not all do, but if you use cookies/trackers for analytics, advertising, personalization, or third parties, geo-targeting is a practical way to meet each region’s requirements under the rules.
- You can from a design perspective, but only if you’ve correctly assessed the obligations that apply in Vietnam under PDPL. If your trackers trigger obligations to notify, obtain consent, or allow withdrawal, you must comply.
- Allow users to change the country/region manually and use a safe fallback. When unsure, prefer a more conservative banner to reduce risk.
- Yes. You should store the timestamp, banner version, the user’s choices, and the ability to withdraw consent. This is critical for compliance checks or disputes.
Source: the Personal Data Protection Law (Law 91/2025/QH15) and Decree 13/2023/ND-CP: https://thuvienphapluat.vn ; Enforcement authority A05: https://bocongan.gov.vn
Get started — set up in 5 minutes.
Deploy PDPL solutions for your business?