PDPA 2010 Compliance Guide: Are Cookie Consent Banners Mandatory in Malaysia?
Understand Malaysia's PDPA 2010 and 2024 amendments on cookie consent banners, Google Consent Mode v2, dual-language privacy notices, and JPDP penalties.
With the passing of the Personal Data Protection (Amendment) Bill 2024 by Parliament, data privacy enforcement in Malaysia has reached unprecedented rigor. Fines have surged up to RM1,000,000, directors face personal liability, and the appointment of a Data Protection Officer (DPO) is now mandatory for qualifying data controllers.
A frequent compliance question asked by Malaysian business owners is: “Do we legally need a cookie consent banner like in Europe (GDPR), or is a simple Privacy Policy link sufficient under Malaysian law?”
Here is the comprehensive guide to cookie compliance, tracking pixel governance, and Google Consent Mode v2 under the Malaysian Personal Data Protection Act (PDPA 2010).
1. PDPA 2010 & 2024 Amendments: What the Law Says About Cookies
Unlike the European Union's ePrivacy Directive and GDPR (which enforce strict opt-in consent for almost all non-essential cookies), Malaysia's PDPA 2010 is rooted in Notice and Choice Principles.
+--------------------------------------------------------------------+
| MALAYSIAN PDPA 2010: 7 CORE PRINCIPLES |
| |
| 1. General Principle 2. Notice & Choice 3. Disclosure |
| 4. Security Principle 5. Retention Principle 6. Data Integrity|
| 7. Access Principle |
+--------------------------------------------------------------------+
When Do Cookies Constitute "Personal Data"?
Under Section 4 of the PDPA 2010, Personal Data is any information processed in commercial transactions that relates directly or indirectly to an identified or identifiable individual.
- Strictly Necessary Cookies (e.g., WooCommerce session cart, CSRF tokens, load balancer cookies): Do not require prior consent.
- Third-Party Tracking Cookies (e.g., Meta Pixel, Google Analytics 4 User ID, TikTok Pixel, Hotjar session recordings): Because these scripts capture user IP addresses, device identifiers, and browsing habits across sessions to build behavioral profiles, the Department of Personal Data Protection (JPDP) classifies them as processing personal data.
Is a Cookie Banner Mandatory?
Yes, if you use third-party marketing or tracking scripts. Under the Notice and Choice Principle (Section 7):
- You must inform visitors by written notice that their data is being collected via cookies.
- You must provide them with the choice to accept or decline non-essential cookies.
- The notice MUST be presented in both Bahasa Melayu and English.
2. Implementing Google Consent Mode v2 in Malaysia
To maintain accurate tracking in Google Ads and GA4 without violating PDPA rules, you must deploy Google Consent Mode v2.
Consent Mode v2 introduces four essential consent states:
analytics_storagead_storagead_user_dataad_personalization
Technical Implementation Snippet
Place this script in your website's <head> before Google Tag Manager or any tracking tags execute:
<!-- Google Consent Mode v2 Default Configuration -->
<script>
window.dataLayer = window.dataLayer || [];
function gtag(){dataLayer.push(arguments);}
// Set default consent states to 'denied' for tracking
gtag('consent', 'default', {
'ad_storage': 'denied',
'ad_user_data': 'denied',
'ad_personalization': 'denied',
'analytics_storage': 'denied',
'functionality_storage': 'granted',
'security_storage': 'granted',
'wait_for_update': 500
});
</script>
<!-- Google Tag Manager / Analytics -->
<script async src="https://www.googletagmanager.com/gtag/js?id=G-XXXXXXXXXX"></script>
When a user clicks "Accept All" / "Terima Semua" on your dual-language banner, trigger the consent update:
// Update consent upon user acceptance
function onUserAcceptCookies() {
gtag('consent', 'update', {
'ad_storage': 'granted',
'ad_user_data': 'granted',
'ad_personalization': 'granted',
'analytics_storage': 'granted'
});
localStorage.setItem('jagaweb_cookie_consent', 'granted');
}
3. Mandatory Dual-Language Privacy Notice Requirements
Under Section 7(3) of PDPA 2010, any privacy notice directed at Malaysian consumers must be available in both English and the National Language (Bahasa Melayu).
Your website footer and cookie modal must contain:
- The specific categories of data processed (e.g., IP address, browser type, transaction history).
- The purpose of data processing (analytics, targeted advertising, order fulfillment).
- Third-party disclosures (e.g., payment gateways like Billplz, cloud infrastructure like AWS/Google Cloud).
- Data subject rights (Right to request access, correction, or withdrawal of consent).
- Contact details of your designated Data Protection Officer (DPO).
4. Checklist: Are You PDPA Compliant in 2026?
[ ] Dual-language (BM & EN) Privacy Policy accessible from every page footer.
[ ] Cookie banner present with explicit "Accept", "Reject", and "Preferences" buttons.
[ ] Marketing scripts (Meta Pixel, TikTok, GA4) blocked prior to user consent.
[ ] Google Consent Mode v2 active and integrated with GTM.
[ ] Data encryption active in transit (TLS 1.3) and storage (AES-256 for customer databases).
[ ] Designated Data Protection Officer (DPO) contact email published.
Bulletproof Your Data Compliance with JagaWeb
Non-compliance with the updated PDPA 2024 framework puts your company and directors at severe financial and reputational risk.
JagaWeb helps Malaysian enterprises audit, harden, and automate technical privacy compliance.
- RM5,000 Ownership, Access & Security Review: We audit all tracking scripts, implement Google Consent Mode v2, draft custom bilingual cookie policies, and secure your database endpoints.
- RM450/month Managed Care Plan: Continuous compliance monitoring, SSL maintenance, vulnerability patching, and security logging.
Ready to verify who owns your website?
Replace uncertainty with a decision-ready ownership and access report. The fixed Ownership & Access Review is RM1,500 before SST and includes a 30-day action plan.