[Template] Cookie FAQ for websites (PDPL-compliant)

cookie faq template

The template below is a pre-filled Q&A block. Paste it into your “Cookie” or “Privacy” page and replace the content in [brackets].

• Question: What are cookies?

  • Answer: Cookies are small files saved on your browser when you visit [Website name]. Cookies help recognize your session, remember settings, measure performance, and personalize content.

• Question: Why does [Website name] use cookies?

  • Answer: We use (i) necessary cookies to run the features you request (login, shopping cart, security), and (ii) non-essential cookies such as analytics, personalization, advertising to improve our services.

• Question: When is consent required?

  • Answer: Under the PDPL (Law 91/2025/QH15), we request consent before enabling non-essential cookies (e.g., analytics, advertising). Cookies necessary to provide a service you actively request may operate without consent, but will still be clearly disclosed.

• Question: How can I change or withdraw consent?

  • Answer: You can click [“Cookie preferences” link] at any time to turn cookie groups on/off and withdraw consent. When you withdraw, we will stop setting related cookies and will try to delete/de-identify them on your browser when possible.

• Question: Does [Website name] use third-party cookies? Is data transferred overseas?

  • Answer: There may be cookies from third-party providers (e.g., analytics tools, ad networks). Data may be transferred outside Vietnam per the provider’s infrastructure; we list providers and purposes in the cookie inventory table and fulfill obligations under current regulations. Please see the “Providers & purposes” section below.

• Question: Cookie inventory and retention periods?

  • Answer: See the “Cookie inventory” table below. Examples: session cookies (end when the browser closes); analytics cookies 1–24 months; details depend on the provider and may change.

• Question: Contact and your rights?

  • Answer: You can submit requests to access, correct, delete data or lodge complaints via [Contact email/DPA/DPO] or [DSAR form].

• Question: What if there is a cookie leak/compromise?

  • Answer: If an incident risks your rights and interests, we will handle it as required and notify the competent authority and/or you within 72 hours of discovery, where applicable.

[Insert here a “Cookie preferences” link to re-display the banner, and the cookie inventory table in the next section.]

What cookie inventory examples can you paste into the FAQ/banner?

You can use the sample table below and replace it with your actual inventory. Avoid listing tools you do not use.

Note: Identifier names are just common examples. You must check your actual website (DevTools → Application → Cookies) and update regularly. We do not assert any tool is unlawful; each tool triggers corresponding obligations under applicable regulations.

How to ensure the cookie FAQ and banner comply with PDPL 91/2025/QH15?

The core is to seek consent for non-essential cookies before setting them, be transparent about purposes/providers, and keep evidence of consent.

Technical tips for developers:

• Block tags via Consent Mode/Tag Manager using conditions per group consent state.
• Write a hook to delete cookies when the user withdraws consent; prefer storage APIs rather than manually manipulating headers if using a CDN.
• Store consent logs in your backend or with a third party that can export CSV/JSON when A05 or partners request evidence.

What common mistakes occur when implementing cookies in Vietnam?

• Automatically setting analytics/advertising cookies before consent. Fix: block via Tag Manager; default to off.
• Only having an “Accept” button without a “Reject.” Fix: include both buttons and group-level choices.
• Missing cookie inventory table, providers, durations. Fix: publish and keep in sync with the banner.
• Not providing a withdrawal mechanism. Fix: add a persistent “Cookie preferences” in the footer.
• Failing to keep consent evidence. Fix: log minimum data (timestamp, groups, policy version, anonymous ID).

Soft CTA: Need a cookie banner, consent evidence storage, and a DSAR portal? consent.vn helps SMEs/devs deploy quickly with a lightweight SDK and transparent reporting.

Source: the Personal Data Protection Law (Law 91/2025/QH15) (https://thuvienphapluat.vn) | Decree 13/2023/ND-CP (https://thuvienphapluat.vn) | Ministry of Public Security (A05) (https://bocongan.gov.vn)