Article · June 17, 2026
Are full-page cookie walls legal under the PDPL?
Full-page cookie walls often undermine voluntary consent. PDPL requires free choice and a right to refuse. See how to design a compliant banner.
Quick answer
Are full-page cookie walls legal under the PDPL?
In most cases, full-page cookie walls for advertising/analytics make consent non-voluntary and struggle to meet valid consent requirements under the PDPL. By law, consent must be freely chosen, specific, informed, and easy to withdraw. If refusal leads to blocking content unrelated to core functionality, such “consent” risks being invalid.
When can a cookie wall be acceptable?
Rarely: when processing via cookies is truly “necessary” to provide the core functionality the user requests (e.g., login sessions, shopping cart, anti-fraud). In that case, refusing necessary cookies means the corresponding function cannot be used. Conversely, for non-essential cookies (measurement, personalization, advertising), blocking access if the user does not consent is generally inappropriate.
Design a PDPL-compliant consent banner (no coercion)
Put users in control and prove voluntariness. Avoid full-page “Accept All” patterns without a “Reject” button.
Classify purposes:
Separate necessary cookies (security, session, payment) from non-essential ones (analytics, ads, personalization).
Display information:
State purposes, data types (device IDs, browsing behavior), recipients (advertisers, CDP), and retention periods.
Symmetric choices:
Provide “Accept all,” “Reject all,” and “Customize” at the same level, visible upfront.
Do not block content:
Allow access to content/core functions when non-essential cookies are refused.
Consent evidence:
Record timestamp, policy version, and accepted purposes. Keep logs for audits.
Easy withdrawal:
Always offer a persistent “Change cookie choices” control; withdrawing must be as easy as consenting.
Third-party checks:
Load tags/SDKs only with a lawful basis; toggle based on user choices.
Incident response:
If data related to cookies/user IDs is breached, establish a process to notify within 72 hours from discovery.
Comparison of banner models and PDPL risks
| Model | Description | UX | PDPL risk | Recommendation | |
|---|---|---|---|---|---|
| Full-page cookie wall | Blocks content, forces “Consent” | Annoying | High: consent not voluntary for non-essential cookies | Avoid; only use for parts truly necessary to operate | |
| Symmetric soft banner | Shows Accept/Reject/Customize choices | Friendly | Low if info is clear and evidence recorded | Recommended | |
| Pay-or-OK (clean version) | Offers a paid no-tracking version + free version with tracking | Medium | Medium: must ensure equivalent choice, no coercion | Consult a lawyer; test carefully |
Real-world examples in Vietnam
- Online newspaper: Blocks articles unless analytics/ads are accepted – high risk because content can be delivered without personal tracking; switch to a soft banner and only fire tags after consent.
- E-commerce marketplace: Session and anti-fraud cookies are necessary for login/checkout; you may require necessary cookies for these functions, but should not full-page block for advertising purposes.
- Internal enterprise application: If cookies are used for access control (SSO), refusal means the app cannot be used – appropriate for the authentication function.
Legal risks, evidence retention, and enforcement
The Personal Data Protection Law (Law 91/2025/QH15) (effective 01/01/2026) requires a lawful basis for processing personal data. For cookies used for tracking/marketing, the basis is typically consent. Consent that is not voluntary (blocked if refused) risks non-compliance. Businesses should:
- Record and store evidence of consent/refusal; honor withdrawals.
- Control tags/SDKs according to choices; keep the third-party list up to date.
- Maintain transparent policies and a process to handle data subject requests (DSAR).
- Prepare incident response and notify data breaches within 72 hours from discovery. Enforcement is by the Ministry of Public Security (A05). Specific penalties will be set by the Government’s guiding decree; serious violations may be subject to criminal liability. In complex scenarios (pay-or-OK, paid content), under the rules, consult a lawyer to assess equivalence and voluntariness.
- For non-essential cookies (analytics/ads), there is a high risk that consent is not voluntary under the PDPL. Use a symmetric banner with a right to refuse and access to core content.
- You may require necessary cookies for the function the user requests (login, payment). But do not full-page block for advertising purposes.
- Consider only when there is a truly equivalent paid, no-tracking option. Risks remain; under the rules, consult a lawyer before rollout.
- Within 72 hours from discovery, notify as required by law.
Need a cookie banner, consent evidence logging, and streamlined DSAR handling? Try consent.vn’s solution.
Source: the Personal Data Protection Law (Law 91/2025/QH15): https://thuvienphapluat.vn; Decree 13/2023/ND-CP: https://thuvienphapluat.vn; Enforcement authority Ministry of Public Security (A05): https://bocongan.gov.vn
Get started — no account needed.
Ready to comply with PDPL?