Article · June 17, 2026
Do we still need a cookie banner if we have a privacy policy?
Why privacy policy and cookie banner are different PDPL duties, plus practical implementation for Vietnamese sites.
Quick answer
If we already have a privacy policy, do we still need a cookie banner?
Yes, in most cases you still do. A privacy policy explains who processes data, what is processed, for which purposes, retention periods, who data is shared with, and the data subject’s rights. A cookie banner is the “consent interface” shown before or as the user accesses the site, enabling them to accept/decline non-essential cookie or tracker categories, while also allowing the business to store evidence of those choices.
If the website uses only strictly necessary technical cookies to run the site, the banner need may be simpler. But when you have analytics, advertising, retargeting, heatmaps, social media pixels, A/B testing, or behavior-tracking SDKs, you should have a cookie banner and a clear preference management mechanism under the regulations.
Why don’t a privacy policy and a cookie banner replace each other?
They differ in timing and function:
- Privacy policy: static content explaining overall personal data processing.
- Cookie banner: interaction at access time, letting users choose before non-essential cookies run.
- Consent evidence: the banner/log helps prove who chose what, when, and under which policy version.
In short: the privacy policy answers “what you do with data”; the cookie banner answers “how the user consented or declined.”
When should Vietnamese websites have a cookie banner?
You should have one if your website/app has at least one of the following:
- Uses Google Analytics, Meta Pixel, TikTok Pixel, or similar measurement tools.
- Runs behavioral ads, remarketing, or content personalization.
- Embeds videos, maps, chatbots, or third-party plugins that may set cookies.
- Uses SDKs in an app to track events, attribution, or crash analytics.
- Has retargeting purposes or shares data with third parties.
Real-world example: a children’s goods store in Ho Chi Minh City installs Google Tag Manager, GA4, and Meta Pixel to track conversions. Even with a “Privacy Policy” page, the homepage still needs a cookie banner so users can choose “Accept,” “Decline,” or “Customize” before non-essential trackers fire.
:::comparison
| Criteria | Privacy policy | Cookie banner |
|---|---|---|
| Purpose | Disclose how data is processed | Record users’ choices |
| Timing | Usually a separate page, viewable anytime | Shown on access or before trackers run |
| Nature | Informational/document | Interactive mechanism |
| Evidence | Insufficient to prove specific consent | Can store logs/cookie preferences |
| Relation to PDPL | Transparency/information duty | Consent/permission duty by processing purpose |
| ::: |
How to build a cookie banner correctly and pragmatically?
Below is a minimal implementation for SMEs:
Classify cookies/trackers:
clearly separate necessary, analytics, advertising, functional, and third-party.
Block non-essential cookies by default:
only activate after the user consents by category or by purpose.
Show clear choices:
“Accept,” “Decline,” “Customize” buttons; do not design to pressure acceptance.
Store evidence of choices:
record timestamp, banner/policy version, and user choices for internal review.
Allow changes later:
include a “Cookie settings” or “Manage preferences” button in the footer.
Align with the privacy policy:
the policy must describe cookie types, purposes, recipients, and how to withdraw choices.
What’s a ready-to-use cookie banner copy?
You can use the short template below and adapt it to your actual setup:
Title: We use cookies to operate the website and improve your experience.
Content: We use necessary cookies for the site to function and, if you agree, analytics/marketing cookies to measure performance and personalize content. You can accept, decline, or customize your choices at any time.
Buttons: [Accept all] [Reject non-essential] [Customize]
Accompanying links: See Privacy Policy | Manage cookies
If you are building an e-commerce website, you should store consent logs by session/user ID in your internal system, especially when multiple third-party trackers are involved.
What are the risks if you have only a privacy policy without a cookie banner?
The main risk is that you may not be able to prove users were informed and given choices regarding non-essential cookies/trackers. When inspected under the regulations, a business may have to explain how it collects consent, how it stores evidence, how choices can be withdrawn, and how it manages data recipients. Specific penalties will follow the Government’s guiding decree; serious violations may incur criminal liability.
If a leak occurs related to the tracking system, the business must also consider the obligation to notify a data breach within 72 hours from discovery.
What should be prioritized before launching a website?
If you cannot do everything at once, prioritize in this order: 1) add a banner for non-essential cookies, 2) block trackers before consent, 3) update the privacy policy to accurately describe processing, 4) store choice logs, 5) review contracts with measurement/advertising tool providers. For businesses using many SDKs or pixels, have both legal and dev teams verify the actual execution flow, not just the documents.
Soft CTA: If you need a cookie banner, consent logs, or a minimal DSAR flow for your website/app, consent.vn can help you implement a ready-to-use, SME-focused setup.
- Yes, if the website uses non-essential cookies/trackers. A privacy policy provides information; a cookie banner records choices and consent evidence.
- Typically, strictly necessary cookies for basic operation have lower requirements, but you should still describe them clearly in the policy and classify them correctly under the rules.
- You should have one, as analytics are non-essential cookies/trackers in many cases. You should block them first and only enable them after the user chooses.
- No. The banner is an interaction mechanism; the policy is a transparency document about processing. These are different duties and you should have both.
Source: the Personal Data Protection Law (Law 91/2025/QH15): https://thuvienphapluat.vn; Decree 13/2023/ND-CP: https://thuvienphapluat.vn; Ministry of Public Security (A05): https://bocongan.gov.vn
Get started — no account needed.
Ready to comply with PDPL?