Cookie consent is the permission a website must obtain from visitors before storing or reading cookies on their device, especially cookies that can recognize that visitor again later. This obligation gets overlooked often, since many website owners treat cookies as a purely technical matter rather than a legal one.
That assumption is wrong. An academic study published by Springer found that only 30.66% of websites offered a reject button as prominent as their accept button in 2024, up from just 2.94% in 2018, meaning most websites worldwide still fall short of a proper consent standard.
In Indonesia, a similar obligation applies under the PDP Law, even though the law never uses the word “cookie” directly. This article covers when cookie consent is required, its legal basis, and how to build a banner that actually holds up.
What Is a Cookie and Why Does It Need Consent Under the PDP Law?
A cookie is a small file a browser stores when someone visits a website, holding information such as language preference, browsing history, or device identity. Some cookies simply keep a site working properly, while others record visitor behavior for advertising or analytics purposes.
Indonesia’s PDP Law defines Personal Data as data about an identified or identifiable individual, whether directly or indirectly, through electronic or non-electronic systems. A cookie that can recognize a device or a person’s habits indirectly already falls under that definition, which means its processing is bound by the same rules as any other personal data.
Read also: Customer Consent: Definition, Differences, and How to Obtain It
Types of Cookies and Which Ones Require Consent
Not every cookie requires explicit consent, since the requirement depends on what the cookie actually does. The four categories below are the most common ones websites use, along with their consent status.
| Cookie Type | Function | Requires Consent? |
|---|---|---|
| Essential cookies | Run core site functions, such as login or a shopping cart | Usually not, since they are needed to deliver the service the user requested |
| Functional cookies | Remember user preferences, such as language or display settings | Yes, though the risk is relatively low |
| Analytics cookies | Record visitor behavior to measure site performance | Yes, especially when the data is sent to a third party |
| Marketing or advertising cookies | Track visitors across sites to target ads | Yes, carrying the highest risk since it involves profiling |
The Legal Basis for Cookie Consent Under the PDP Law
The legal basis for cookie consent sits in Article 20(2) of Indonesia’s PDP Law, which requires every instance of personal data processing to rest on a valid basis, and explicit consent is one of six recognized bases.
For non-essential cookies such as analytics and marketing, user consent is practically the only basis that applies, since these cookies are not part of fulfilling a contract or a legal obligation.
As with the PDP Law’s other obligations, this applies extraterritorially, so a website operated by a foreign company is still bound by the same requirement whenever it processes the personal data of visitors in Indonesia.
When consent is used as the basis, Article 21 requires the site to disclose 7 elements to visitors, including the purpose of processing and the data retention period, and Article 22 adds that consent must be written or recorded in plain language, with consent that fails to meet these conditions considered void.
How to Build a Compliant Cookie Banner
Building a compliant cookie banner means making sure every element in Article 21 and Article 22 is actually satisfied, not just displaying a notification. The five steps below are how that plays out in practice.
- Give the reject option equal weight to accept.
A “Reject All” button needs to be just as easy to find and click as “Accept All,” not buried inside a secondary menu. The Springer study above shows plenty of websites still violate this basic principle. - Do not activate non-essential cookies before consent is given.
Analytics and marketing cookies should only start running after a visitor clicks accept, not automatically the moment the page loads. Turning cookies on first and asking for consent afterward defeats the purpose of valid consent. - Offer granular choice by category.
Visitors should be able to approve cookie categories individually, for instance allowing analytics cookies while declining marketing cookies. A single button that approves every category at once does not meet Article 21’s specificity requirement. - Use plain, clear language.
A banner only needs to explain what kinds of cookies are used and why, without technical jargon that confuses an ordinary visitor. This lines up with the plain-language requirement set out in Article 22. - Keep records and allow consent to be withdrawn.
Every consent event should be logged with a timestamp and the policy version in effect at the time, and visitors need to be able to change their choice at any point. That record matters if a regulator ever asks the company to account for it.
The Risk of a Non-Compliant Cookie Banner
A non-compliant cookie banner puts a company at risk of being found to process personal data without a valid basis. Article 57 of the PDP Law sets administrative fines of up to 2% of annual revenue for violations like this.
This kind of risk is not theoretical. France’s data protection authority, CNIL, fined Google and Amazon a combined €135 million in December 2020 after advertising cookies were set on visitors’ devices before they had given consent.
The investigation also found a reject mechanism that did not fully work, since one advertising cookie stayed stored even after a visitor turned off ad personalization. A technical flaw that small was enough for the regulator to rule the entire consent mechanism invalid.
Conclusion
Cookie consent is not just a technical formality. It is a legal obligation that kicks in the moment a website’s cookies collect data that can identify a visitor.
The PDP Law never spells out the word “cookie,” but its definition of personal data is broad enough to cover non-essential cookies such as analytics and marketing ones. Meeting this requirement does not have to come at the cost of user experience, since a banner built with clear choices and plain language tends to build visitor trust rather than erode it.
Ready to Manage Privacy Compliance as a Business Risk?
See how GRC helps map personal data risks, monitor compliance with the PDP Law, and prepare companies for audits without complicated manual processes.
FAQ
It is required if the site uses non-essential cookies, such as analytics or marketing cookies, that can identify visitors. A site that only uses essential cookies for core functions usually does not need to request explicit consent.
Yes, since Google Analytics sends visitor behavior data to a third party and can be used to identify visitors indirectly. It falls under the analytics category, which requires consent before it runs.
That is not advisable, since valid consent under the PDP Law requires an option to reject that is just as accessible as the option to accept. A banner with no reject option risks being treated as invalid consent.
Yes. A privacy policy explains how visitor data is processed as a whole, while cookie consent is the specific consent mechanism for the cookies placed on a visitor’s device.
The PDP Law does not set a fixed duration, so common practice is to renew it after a reasonable period or whenever the cookie policy changes materially, whichever comes first. The more sensitive the data being collected, the more often that consent should be refreshed.
