Article · June 17, 2026
Do Vietnam-only Vietnamese sites need cookie consent?
Sites serving only Vietnam may still need cookie consent if using non-essential tracking under the PDPL.
Quick answer
Do Vietnamese websites serving only Vietnam need cookie consent?
Yes, if your website uses non-essential cookies or trackers. Targeting only Vietnamese users does not remove your obligations to comply with personal data protection; the focus is on the purpose of data processing, the types of tools used, and whether users are informed and given choices.
Real-world example: an e-commerce website in Vietnam written only in Vietnamese, shipping domestically only, but implements Google Analytics, Meta Pixel, TikTok Pixel, and ad banners. In this case, you still have obligations for collection, notice, recording, and managing consent; when needed, you must be able to prove that users properly consented.
When do cookies not require consent?
Cookies that support essential functions typically do not require separate consent, because without them the website may not function correctly. Examples: keeping login sessions, remembering carts, anti-fraud security, load balancing, saving language choice, or minimal cookie status.
However, "no consent needed" does not mean "nothing to do." You should still:
- Clearly disclose which cookies are used and the purpose of each group.
- Distinguish essential from non-essential cookies.
- Do not mix operational cookies with advertising/measurement cookies.
- Provide a way for users to change their choices later.
Which cookies typically trigger a consent requirement?
The following cookie/tracker groups commonly require consent under the regulations, especially when they track user behavior on the web:
- Analytics/behavior measurement: e.g., traffic analytics, heatmaps, session replay.
- Advertising and remarketing: pixels, retargeting, conversion tracking.
- Non-essential content/personalization.
- Sharing data with third parties for marketing.
A note for SMEs and dev teams: many sites think “we don’t store phone numbers or national ID, so it’s not personal data.” In reality, cookie IDs, device identifiers, IPs, click behavior, browsing history, etc., can still be personal data or data related to a person depending on how they are processed.
| Cookie/tracker type | Purpose | Consent typically required? | Practical notes | |
|---|---|---|---|---|
| Session / login | Session persistence, security | Typically no | Describe in the cookie policy | |
| Cart / language | Core utility | Typically no | Use strictly for stated purpose | |
| Analytics | Traffic measurement | Typically yes | Enable only after user consents | |
| Advertising / remarketing | Retargeting | Typically yes | Needs an equally prominent reject button | |
| Session replay / heatmap | Behavior tracking | Typically yes | Higher transparency risk |
How to implement cookie consent for a site serving only Vietnamese users?
Classify cookies/trackers:
inventory all scripts, SDKs, pixels, tag managers and split into essential and non-essential.
Block before consent:
for non-essential tools, do not load by default; activate only after the user has consented.
Display a clear notice:
state purposes, cookie categories, third parties receiving data, and how to change choices.
Store evidence of consent:
record timestamp, banner version, the user’s selections, and how they consented.
Make rejecting as easy as accepting:
the "Reject" button must be easy to see, not buried or confusing.
Re-review when adding new tools:
any time you add a pixel, chat widget, A/B testing, or an embedded map, re-check obligations.
What are the risks if you don’t obtain consent?
The risk is not just fines under the implementing decrees in case of violations. More importantly, you may lose the validity of your marketing data, be unable to prove the source of consent, and face difficulties handling requests to withdraw consent or delete data.
For serious violations, beyond administrative measures under the implementing decrees, criminal liability may also apply. The current enforcement authority is the Ministry of Public Security, specifically A05. If your system uses many third parties, you should review data flows before finalizing the banner.
Minimal checklist for Vietnamese SMEs
If your website serves only Vietnamese users, check these 5 items:
- Is there a cookie banner before loading non-essential trackers?
- Is there a reject button as prominent as accept?
- Is there an easy-to-understand cookie policy in Vietnamese?
- Are Google Analytics/Meta Pixel blocked prior to consent?
- Do you log evidence of consent to reconcile during audits or when users ask?
If you use a consent banner, make sure it can store evidence of consent and supports changing choices; this is where consent.vn is commonly used by website operations teams to reduce the risk of incorrect implementation.
- Yes if the site uses non-essential cookies/trackers such as analytics, advertising, remarketing, or session replay. Only basic operational cookies typically do not require separate consent.
- Typically yes, because it measures user behavior. The safe approach is to block it first and enable only after the user consents as required.
- You may face compliance risks, be unable to prove the source of consent, and your marketing data may be challenged during internal reviews or when working with enforcement authorities.
- You should have a cookie policy or a dedicated section in your privacy policy that states cookie types, purposes, third parties, and how users can change their choices.
Source: the Personal Data Protection Law (Law 91/2025/QH15): https://thuvienphapluat.vn ; Decree 13/2023/ND-CP: https://thuvienphapluat.vn ; Ministry of Public Security (A05): https://bocongan.gov.vn
Get started — no account needed.
Ready to comply with PDPL?