Cookie consent in Vietnam: what a GDPR-built banner gets right and what it misses

Cookie consent in Vietnam is not governed by a cookie statute. There is no Vietnamese equivalent of the EU ePrivacy rule, and no text prescribes a cookie banner. What applies is the general consent regime of Law 91/2025/QH15 on Personal Data Protection and Decree 356/2025/ND-CP: personal data may be collected only with the data subject's consent obtained before collection, unless the law provides otherwise (Article 11(1) of Law 91), and that consent must be specific to each purpose, verifiable, and never inferred from silence (Article 9(3) and (4)).

For a site that runs analytics or advertising tags, the consent requirements end up close to the GDPR: opt-in, granular, logged. Two points are specific to Vietnam and are usually missing from a banner designed in Europe. Data that tracks a person's online behaviour is classed as sensitive personal data (Article 4(1)(l) of Decree 356), so the consent request must say so. And tags that send data to Google or Meta abroad are cross-border transfers, which need a dossier filed with the A05 Department, Ministry of Public Security, not just a banner.

This guide is for marketing, e-commerce and web teams of foreign-invested companies whose group runs one consent management platform (CMP) for every market.

Cookie consent in Vietnam: what the texts actually say#

Only one provision of Law 91 uses the word "cookies". Article 29(3) requires providers of social network and online communication services to give users an option to refuse the collection and sharing of cookies, and Article 29(4) requires them to offer a "do not track" option or track activity only with the user's consent. A typical corporate or e-commerce website is not a social network; whether a brand site with articles or video counts as an "online communication service" is not defined, so most companies should not build their compliance on Article 29.

The consent requirements that bite on every website are general, and together they make cookie consent in Vietnam an opt-in regime:

Rule	Where it sits	What it means for tags
Consent before collection	Article 11(1) Law 91	Non-essential tags do not fire until the visitor chooses
Informed consent: data types, purpose, controller, rights	Article 9(2) Law 91	The banner or its second layer names what is collected, why, and by whom
Clear, specific, verifiable form	Article 9(3) Law 91; Article 6(1)(d) Decree 356	A "technical set-up for requesting consent" on a website or app is an accepted method
Per purpose; silence is not consent	Article 9(4)(a) and (d) Law 91	Separate toggles; no "by continuing to browse you agree"
No pre-ticked defaults or misleading choices	Article 6(3) Decree 356	"Reject" as visible as "Accept"
Keep the consent and carry the burden of proof	Article 6(2) Decree 356	A consent log the company can produce on request
Behavioural advertising only with consent, with a way to refuse sharing	Article 28(8)(a) and (b) Law 91	Ad pixels and retargeting sit behind an explicit advertising choice

Article 28(8) is the closest thing Vietnam has to a tracking rule. Any organisation that uses personal data for behavioural, targeted or personalised advertising may collect it by tracking websites, portals or apps only with consent, and must provide a way for the person to refuse sharing, set a retention period and delete the data when it is no longer needed. The provision is not limited to advertising agencies.

Tracking data is sensitive personal data in Vietnam#

Decree 356 lists the categories of sensitive personal data. Point (l) of Article 4(1) covers "data tracking the behaviour and activity of using telecommunications services, social networks, online communication services and other services in cyberspace". Analytics events, clickstreams, advertising profiles and cross-site identifiers fall comfortably within that wording once they relate to an identifiable person (see sensitive personal data).

Two consequences follow, neither of which a GDPR banner normally handles:

• The consent request must tell the visitor the data is sensitive (Article 6(4) of Decree 356). Failing to tell data subjects that their sensitive data is being processed carries a fine of VND 30–50 million for an organisation (Article 43(1)(h) of Decree 330/2026/ND-CP).
• Small-business relief is lost for companies that directly process sensitive data. Article 38(2) of Law 91 lets small enterprises and start-ups skip the processing impact assessment and the data protection officer for five years, but not if they directly process sensitive personal data. Most foreign-invested subsidiaries are not small enterprises anyway, but a lean local start-up arm with heavy tracking should not count on the relief.

The fact that a cookie identifier on its own may not reveal a name does not take it out of scope. Personal data is data that identifies or helps identify a specific person (Article 2(1) of Law 91); only data that has been de-identified so that it can no longer do so stops being personal data.

Which cookies need consent, and which do not#

Vietnam has no statutory "strictly necessary" exemption like Article 5(3) of the ePrivacy Directive, and no "legitimate interests" ground. The cases where processing needs no consent are closed and listed in Article 19(1) of Law 91: emergencies and protection of rights against infringement, security and crime prevention, State functions, performance of an agreement between the data subject and the organisation (point (d)), and other cases provided by law.

LexData reads the texts as giving this split:

• Anonymous session tokens that are not linked to an account, a profile or any other data about the visitor do not identify or help identify a person, so they are not personal data (Article 2(1) Law 91) and fall outside the consent rules altogether.
• Session, cart, login, checkout and load-balancing cookies that exist only to deliver what the visitor asked for rest on Article 19(1)(d), the performance of the agreement with the visitor: the terms of use, the account terms or the sale contract.
• Security and fraud-prevention cookies (bot detection, login-abuse and payment-fraud checks) rest on the second limb of Article 19(1)(a): protecting the rights or legitimate interests of the organisation or others "as necessary" against an infringing act. The text puts the burden of proving that ground on the controller, so record what each cookie protects against and why it is needed.
• For both no-consent groups, Article 19(2) requires a control mechanism (procedures, protection measures, periodic checks, a channel for complaints), and the cookies should be listed, with their legal basis, in the privacy notice.
• Analytics cookies need consent. Measuring traffic is not something the visitor asked for, and without a legitimate-interests ground there is nothing else in Article 19 to hold them. Because they generate behavioural tracking data, which is sensitive (Article 4(1)(l) Decree 356), the consent request must also say so (Article 6(4)). The EU practice of exempting "audience measurement" under conditions has no counterpart in the Vietnamese texts.
• Advertising, retargeting and social media pixels need consent under Article 11(1) and, specifically, Article 28(8)(a).
• Preference cookies (language, region) are borderline. If they store only a setting the visitor chose, Article 19(1)(d) is arguable; if they feed personalisation, put them behind consent.

Retuning a global CMP for cookie consent in Vietnam#

Group consent platforms usually apply opt-in to the EU, UK and a few other jurisdictions and a notice-only or opt-out mode to "rest of world". Vietnam belongs in the opt-in group. The table compares a standard EU configuration with what cookie consent in Vietnam requires.

Banner element	Typical EU set-up	Vietnam
Default for non-essential tags	Off until consent	Same (Article 11(1) Law 91)
"Reject all" on the first layer	Usually yes	Do it: unclear or misleading choices are prohibited (Article 6(3) Decree 356)
Purpose categories	Analytics, marketing, functional	Same, consent "for each purpose" (Article 9(4)(a) Law 91)
Sensitive data statement	Not used	Add: tell visitors that behavioural tracking data is sensitive personal data (Article 6(4) Decree 356)
Legitimate-interest toggles (common in IAB TCF set-ups)	Present for some vendors	Remove: no such ground exists; rely on consent
Transfer abroad	Covered by SCCs, often not mentioned on the banner	Add to the notice: that data goes abroad, to whom, for what purpose (penalty: Article 56(2)(b) Decree 330)
Consent record	Consent string or ID with timestamp	Must show who consented, when and to what (Article 6(1) Decree 356); keep banner versions
Withdrawal	"Cookie settings" link	Same; a withdrawal request must be answered within 2 working days and carried out within 15 days, or 20 days where a processor or third party has to stop (Article 5(2) Decree 356)
Language	English and local languages	Vietnamese text: the visitor must "know clearly" what they agree to (Article 9(2) Law 91)

Bundling is a separate trap. Consent may not be made conditional on agreeing to purposes unrelated to the service (Article 9(4)(b) Law 91), so a "cookie wall" that blocks ordinary content unless the visitor accepts advertising is risky. Conditioning a service on consent to unrelated purposes is a fineable act (Article 43(1)(b) of Decree 330). See also what counts as consent and withdrawal of consent. The privacy policy page behind the banner usually needs the same retuning; see what to change in a group GDPR privacy policy.

Google Analytics, Meta Pixel and cookie consent in Vietnam: the transfer side#

A cookie banner solves consent. It does not solve the cross-border transfer. Using a platform outside Vietnam to process personal data collected in Vietnam is a cross-border transfer (Article 20(1)(c) of Law 91), and Decree 356 confirms that this includes storage on the cloud service of a provider abroad (Article 17(1)(a)). GA4, Google Ads, Meta Pixel and the Conversions API, TikTok Pixel, Hotjar and most CMPs themselves process data on servers outside Vietnam.

That triggers the same obligations as any foreign SaaS, covered in our guide to foreign SaaS in Vietnam:

1. A transfer agreement with each recipient covering purpose, data types, retention, legal basis and responsibilities (Article 7(1) of Decree 356). For Google and Meta this is usually their standard data processing or controller terms accepted in the admin console; check them against the Article 7(1) list and keep a copy, because it forms part of the dossier (Article 18(2)(b)).
2. A transfer impact assessment dossier (report on Form 09 plus contracts and policies) filed with the A05 Department within 60 days of the first transfer (Article 20(2) of Law 91; Article 18 of Decree 356). It is prepared once and updated, so one dossier should describe every tag vendor, not only the CRM. A new vendor or a new purpose is an update event, collected into the six-monthly update (Article 22 of Law 91; Article 20(1) of Decree 356). The full procedure is in our guide to the cross-border data transfer impact assessment.
3. Notice to visitors that the data goes abroad, the recipient and the purpose. Not notifying them, or not securing consent to the transfer purpose, carries VND 50–100 million (Article 56(2)(b) of Decree 330), more than most consent breaches.

For a Vietnamese subsidiary whose website is operated by the regional or global marketing team, decide which entity is the controller for Vietnamese visitors before filing. That is usually the local company if the site is aimed at the Vietnamese market, but the answer depends on who decides the purposes and means.

Google Analytics 4 settings worth checking#

The law requires collecting data only within a specific, clear purpose (Article 3(2) of Law 91), so configuration matters as much as the banner:

• Consent mode. Default analytics_storage, ad_storage, ad_user_data and ad_personalization to denied for Vietnamese visitors and switch to granted only after the relevant choice. In Google's "advanced" mode, tags load before consent and send pings without cookies; whether those pings contain personal data is a factual question about what they carry. The conservative set-up for Vietnam is "basic" mode, where Google tags do not load until consent.
• Google Signals and Ads links. Once enabled, the purpose is behavioural advertising under Article 28(8), not measurement. The banner category and the privacy notice must say so.
• User-ID and enhanced conversions. Sending a customer number or hashed email links tracking data to a known person. Treat it as a separate purpose.
• Retention. GA4 offers 2 or 14 months for event-level data. Pick the shortest period the reporting needs and state it in the privacy notice; Article 28(8)(b) requires a retention period for advertising data.
• Personal data in URLs. Thank-you pages and search URLs often leak emails or phone numbers into page paths. Strip them before they reach any tag.

What enforcement looks like#

Fines in Section 6 of Decree 330 are set for organisations; an individual committing the same act pays half (Article 7(1)). The amounts most relevant to cookie consent in Vietnam:

• VND 30–50 million for processing without consent, pre-ticked or misleading choices, consent that is not clear and verifiable, no per-purpose choice, no consent log, or not telling people their sensitive data is processed (Article 43(1)(a), (c), (d), (e), (g), (h)); also for using basic personal data to deliver advertising without consent (Article 63(1)(a)), and for not preparing or not filing the transfer dossier on time (Article 56(1)(a) and (b)).
• VND 50–70 million for treating silence as consent (Article 43(2)(b)) and for collecting data by tracking websites or apps for behavioural, targeted or personalised advertising without consent, or offering no way to refuse such sharing (Article 63(2)(c) and (d)).
• VND 50–100 million for failing to notify the transfer abroad or secure consent to its purpose (Article 56(2)(b)).

The remedial orders can hurt more than the fine. Data collected without valid consent must be destroyed beyond recovery (Article 43(4)(a)), and data collected unlawfully for advertising likewise (Article 63(4)(a)). For a company that has run tags without proper consent, that can mean deleting audiences and analytics history built on Vietnamese visitors.

A practical starting point is a tag inventory: open the Vietnamese site in a clean browser, record every cookie, script and network call before any choice, map each to a purpose and a recipient, and compare the result with the privacy notice and the transfer dossier. LexData reviews consent flows, privacy notices and tag-related transfer dossiers as part of its PDPL compliance consulting for foreign-invested companies.