Most websites today use cookies — small files stored in the user browser. But not all cookies are alike, and Vietnamese law treats them differently: advertising cookies versus technical cookies.
1. How the two types differ
- Technical cookies serve basic website functions: keeping users logged in, remembering shopping carts, ensuring security, load balancing. Without them, many features cannot work.
- Advertising cookies track user behavior — pages viewed, content clicked, search history — to display targeted ads, measure campaign performance, or share data with third parties.
The core legal distinction: advertising cookies collect personal data (habits, preferences, browsing behavior), while purely technical cookies may process no personal data at all.
2. Advertising cookies: consent is mandatory
The Personal Data Protection Law 91/2025/QH15 (effective 01/01/2026, replacing Decree 13/2023/ND-CP) sets a strict consent standard in Article 9: consent must be voluntary, given for each specific purpose, free from coercion in any form — and silence or non-response does not count as consent.
Applied to websites, this means:
- Cookie banners must not pre-tick advertising consent; users must actively choose each purpose (advertising, analytics, third-party sharing);
- Access to the website must not be blocked merely because a user refuses advertising cookies (that is coercion);
- Users must be able to withdraw consent as easily as they gave it.
3. Technical cookies: not mandatory if no personal data is processed
For purely technical cookies that do not process personal data, prior consent is not mandatory. The boundary is not always clear, however: a cookie labeled technical but carrying an identifier that tracks users across sessions is in substance a tracking cookie and must meet the Article 9 consent standard.
4. Key note: Vietnamese law has no standalone definition of “cookie”
Vietnamese law currently has no standalone provision defining “cookie”. This article classifies cookies under a “whether personal data is collected” logic: collection triggers the Personal Data Protection Law; no collection means no consent obligation. Businesses should audit each cookie running on their website under this logic rather than trusting vendor labels.
5. Legal framework to watch
- Personal Data Protection Law 91/2025/QH15 — effective 01/01/2026, replacing Decree 13/2023/ND-CP: consent standard (Art. 9), data subject rights, controller and processor obligations.
- Cybersecurity Law 116/2025/QH15 — effective 01/7/2026: cybersecurity assurance and data protection in cyberspace.
Websites without purpose-by-purpose consent mechanisms should audit and upgrade now, before Law 91/2025 takes effect, to avoid legal risk as enforcement intensifies.
Frequently asked questions
Does a website using only login and cart cookies need consent?
Not mandatory if those cookies process no personal data. But if a cookie carries a tracking identifier, consent is required.
Can the “Accept all” button be prominent while “Reject” is hidden?
Not advisable. Designs that coerce or trick users into consenting violate the voluntary, coercion-free principle of Article 9 of Law 91/2025.
Does silence on a cookie banner count as consent?
No. The law is explicit: silence or non-response does not constitute consent.
Legal basis: Personal Data Protection Law 91/2025/QH15 (Art. 9; effective 01/01/2026; replacing Decree 13/2023/ND-CP); Cybersecurity Law 116/2025/QH15 (effective 01/7/2026).
Does your website have a cookie consent mechanism meeting the Article 9 standard of Law 91/2025? Contact FLAT Law Firm via the contact page for a compliance review.
For general information only; not legal advice.
The legal content of this article was reviewed by the AI Legal Council of FLAT and submitted to the owner for approval; it is not the opinion of a human lawyer and does not replace legal advice for specific cases.
