Cookies, consent and POPIA: what your website actually needs

South Africa's Protection of Personal Information Act (POPIA) has no section about cookies, and no rule that every website must show a cookie banner. But POPIA counts an "online identifier" as personal information, so a cookie that can be tied to a visitor brings the Act's general rules into play: a lawful reason for collecting it, telling visitors what you collect, keeping it secure, and consent before using it for electronic direct marketing. This article explains what the law says, when consent is needed, and how to collect less in the first place. It is general information, not legal advice.

What a cookie is

A cookie is a small piece of text a website stores in your browser so it can recognise you on the next page or the next visit. Cookies do very different jobs:

The first kind is needed for the site to work, and it is also a security matter: a stolen session cookie can let a criminal into an account without the password. Our article on infostealer malware explains how. The last two kinds are where privacy questions arise.

What POPIA actually says

POPIA does not use the word "cookie". What it does say:

• Personal information includes online identifiers. Section 1 lists "location information, online identifier or other particular assignment to the person" as personal information. A cookie value that lets a site recognise an identifiable person is likely to fall within that.
• Processing needs a lawful ground. Section 11 lists six. Consent is one; others include performing a contract with the person, complying with the law, and the legitimate interests of the business. Consent is not the only route.
• Consent has a definition. POPIA defines it as a voluntary, specific and informed expression of will. If you rely on consent, you must be able to prove it, and the person can withdraw it at any time.
• People can object. Where you rely on legitimate interests, a person may object, and you must then stop.

When consent is needed

The clearest consent rule is section 69, on direct marketing by electronic communication such as email and SMS. It needs the person's consent, or an existing customer relationship with a simple way to opt out in every message. Under the regulations as amended in 2025, an opt-out does not count as consent for unsolicited electronic direct marketing.

The Information Regulator's guidance note on direct marketing, published in December 2024, lists "use of cookies" among the methods of direct marketing by unsolicited electronic communication. The note does not explain further, and it says itself that it is advisory and not legal advice. The cautious reading is that cookies used to profile visitors and target marketing at them should rest on consent.

Analytics that only count visits are less clear. They may rest on another ground, such as legitimate interests, but you still have to tell visitors about them.

Tell visitors what you collect

Section 18 requires you to take reasonably practicable steps so people know, at the time you collect their information:

• what you collect, and the source if it is not from them;
• your name and address;
• why you collect it;
• whether it goes to anyone else, including outside South Africa;
• their rights to see and correct it, and to object;
• their right to complain to the Information Regulator, with its contact details.

A privacy notice on your website, with a section on cookies, is the usual way to do this. Online shops have a further duty: the Electronic Communications and Transactions Act requires suppliers selling online to show their privacy policy and security procedures on the website.

If your visitors are in Europe

European rules are stricter and more specific. The EU's ePrivacy Directive requires consent before a website stores or reads anything on a visitor's device, unless it is strictly necessary for a service the visitor asked for. The General Data Protection Regulation (GDPR) defines consent as freely given, specific, informed and unambiguous, by a clear affirmative act. Pre-ticked boxes and silence do not count, and withdrawing consent must be as easy as giving it.

GDPR does not reach every South African site that a European happens to visit. It applies to a business outside the EU when it offers goods or services to people in the EU, for example with prices in euro or delivery there, or when it monitors their behaviour in the EU, such as tracking and profiling them. If either describes your site, take advice on EU rules as well.

Collect less: analytics without third-party cookies

The simplest way to reduce cookie questions is to collect less. Open-source analytics tools you host yourself count visits without sending visitor data to an advertising company:

These tools are not automatically outside POPIA. Plausible and Umami, for example, identify visitors for a day or a month using a scrambled form of their IP address, and that may still be personal information while it exists. Matomo itself advises taking legal advice on whether its cookieless mode needs consent. What they do give you is less personal information, kept on a server you control, with no third party building profiles from it.

A consent banner that actually blocks scripts

If you do use tracking or advertising cookies, the banner has to do more than display a message. It must hold back the tracking scripts until the visitor agrees. Two open-source tools you can host on your own site:

• CookieConsent (MIT licence) by Orest Bida. Scripts are marked with a category and run only once that category is accepted.
• Klaro (BSD licence). Check that it is still maintained before you choose it; its last release was in 2024.

After installing either, test it. Open the site in a private window, refuse everything, and check in your browser's developer tools that no tracking cookies were set.

Our help articles on WordPress cookies and consent and WordPress's built-in privacy tools cover the WordPress side.

Keep what you collect safe

Privacy and security come together. Section 19 of POPIA requires appropriate, reasonable technical and organisational measures to protect the personal information you hold, including analytics data on your own server. Section 21 requires a written contract with any operator that processes it for you, such as an analytics or marketing service. And if that service stores data outside South Africa, section 72 limits such transfers to listed grounds, such as adequate protection in the other country or the person's consent.

In practice: keep the website and its plugins updated, delete tracking you no longer use, keep analytics data only as long as you need it, and use strong, unique passwords for anything that holds visitor data. Our WordPress security checklist is a good start.

Where to get help

Fewer plugins and fewer trackers make a site faster, safer and simpler to explain to visitors. WordPress Care keeps WordPress, your consent plugin and everything else updated every week, with a restore point taken first, and patches known vulnerabilities as fixes are released. If you have questions about your site, open a ticket and we will help where we can. Noiz is not a law firm; for advice on your own obligations, speak to a qualified adviser.

Sources

Checked 19 October 2026. General information, not legal advice.

South African law and guidance

• Protection of Personal Information Act 4 of 2013 (Government Gazette 37067)
• Proclamation R21 of 2020, commencement of POPIA sections
• POPIA Regulations 2018
• Amended POPIA Regulations (Information Regulator copy, January 2025)
• Information Regulator, Guidance note on direct marketing
• Information Regulator, Guidance notes
• Electronic Communications and Transactions Act 25 of 2002

European law

• Directive 2009/136/EC (amending the ePrivacy Directive)
• General Data Protection Regulation (EU) 2016/679

Tools

• Matomo, How do I go cookieless? and tracking consent
• Plausible, Data policy and self-hosting
• Umami source code
• CookieConsent and managing scripts
• Klaro

Noiz

• WordPress Care
• Help articles linked in the text, on docs.noiz.ie

Note: while some of this content was produced with the help of AI, the final editing has been done by a real human being.