Singapore's PDPA does not use the word “cookie”. It still requires consent before a tracker collects personal data — and a banner that appears after your tags have already fired does not provide it.
Search the Personal Data Protection Act 2012 for the word “cookie” and you will not find it. That absence produces two opposite mistakes. Some operators conclude a banner is a European problem that does not apply to them. Others install a banner, see it appear, and assume the matter is closed — without ever checking whether it stops anything from loading. Both leave the same gap.
This is compliance research, not legal advice. Sitetals is an independent scanner, not a law firm and not affiliated with the Personal Data Protection Commission.
Whether a specific obligation applies to your organisation is a question of fact and law. For a decision that carries risk, take advice from a Singapore-qualified practitioner.
Not as such. The PDPA does not require a banner, and it does not regulate cookies as a category. What it requires is that you must not collect personal data unless the individual has consented or is deemed to have consented, and that before consent can be valid you must have told them what you are collecting it for.
“An organisation must not … collect, use or disclose personal data about an individual unless — (a) the individual gives, or is deemed to have given, his or her consent under this Act to the collection, use or disclosure …; or (b) the collection, use or disclosure … without the individual’s consent is required or authorised under this Act or any other written law.”
Section 14(1) then sets the condition that trips most websites. Consent has not been given unless two things are true: the individual was provided with the information required under section 20, and they gave consent for that purpose in accordance with the Act.
Section 20(1)(a) fixes the timing: you must inform the individual of the purposes for collection on or before collecting the personal data.
Section 15 allows deemed consent where the individual voluntarily provides the data for a purpose and it is reasonable that they would. It does not naturally stretch to a third-party advertising pixel the visitor never saw and would not expect.
Section 16 requires that consent can be withdrawn on reasonable notice, and section 16(3) says you must not prohibit withdrawal.
The test is not the file type. It is whether the data collected identifies an individual or can be linked to one.
| What it does | Typical examples | Consent needed before it loads? |
|---|---|---|
| Keeps a session or shopping cart working | Session ID, cart contents, CSRF token | Generally no — strictly necessary for a service the visitor requested |
| Remembers a preference the visitor set | Language choice, consent record itself | Generally no |
| Security and abuse prevention | Bot-detection token, rate-limit key | Generally no |
| Measures behaviour with a persistent identifier | Google Analytics 4, Hotjar, Clarity, Matomo with identifiers | Usually — a persistent identifier plus behaviour is personal data where the individual can be identified from it, or from it together with other information you hold or are likely to hold (s.2(1)) |
| Builds an advertising or remarketing profile | Meta Pixel, Google Ads / DoubleClick, TikTok Pixel, LinkedIn Insight | Yes — and this is the clearest case of all |
| Embeds third-party content that phones home | YouTube (non-privacy mode), live-chat widgets, embedded maps | Usually — the third party sets its own identifiers |
The PDPA does have a Legitimate Interests exception, in Part 3 of the First Schedule. It is not the GDPR Article 6(1)(f) balancing test, and it is narrower than practitioners coming from Europe expect.
Relying on it requires an assessment carried out before collection that identifies any adverse effect on the individual and implements reasonable measures to eliminate, reduce or mitigate it, and it requires giving the individual reasonable access to information about the reliance.
And by paragraph 1(4) it expressly does not apply where the purpose is sending an individual a message for an “applicable purpose” within section 37(6) — the marketing purposes listed in the Tenth Schedule.
Where a tag exists to feed that kind of messaging, the carve-out bites directly; where it does not, the pre-collection assessment and the outweighing test in paragraphs 1(2) and 1(3) still have to be satisfied, which is a demanding bar for advertising and remarketing tags.
These are constructed illustrations, not findings about any real site and not a view on yours. They show how the sections above apply to three common setups; whether any of them describes your position is a question of your own facts, and only the PDPC decides whether the Act has been contravened.
A Shopify store loads Google Analytics 4 and the Meta Pixel on every page, including the homepage, before the visitor touches anything. Both assign persistent identifiers; the Pixel can match activity back to a Meta profile. A visitor who has landed from a search result has requested a webpage, not an advertising profile, so nothing about that collection is reasonably expected under section 15. Notification has not happened, and consent has not been given.
A WooCommerce site installs a free consent plugin. The banner appears, the visitor clicks Accept, and the operator considers the matter handled. In the network log, the analytics and pixel requests fired on page load — before the banner even rendered. The plugin was in its default display-only mode, which shows a notice but blocks nothing.
The site now has a consent record that documents the problem rather than solving it. Installing a banner is not the work. Making it block is the work.
A WooCommerce site runs a session cookie for the cart, a security cookie, and nothing else. The Consent Obligation in section 13 attaches to the collection, use or disclosure of personal data, so a cookie that collects none does not engage it, and there may be nothing here to consent to.
Two cautions. First, this is rarer than operators believe — one marketing app installed two years ago and forgotten is enough to end it. Second, you still need to satisfy section 20 for the personal data you do collect through forms and checkout, so you still have to tell people what you collect it for, which in practice means a published notice. What that policy has to contain is covered here.
google-analytics.com,
googletagmanager.com, connect.facebook.net,
analytics.tiktok.com, snap.licdn.com,
doubleclick.net. Anything in that list that loaded before you clicked is
firing pre-consent._ga, _gid,
_fbp, _gcl_au. If they exist before you have answered the
banner, the banner is not blocking.Sitetals fetches your homepage and reports which non-essential tracker code is present in the page it receives, and whether a consent mechanism with a reject option is detectable in that page.
It reads HTML rather than opening a browser, so treat every finding as something to check on your own site, not as a verdict. No sign-up, no card.
Run a free PDPA scanFree scan. Full PDF report with the PDPA references and a fix list from S$68.
Shopify's built-in customer privacy banner is designed around its Customer Privacy API. Whether it actually blocks depends on your apps honouring that API, and many third-party apps inject scripts directly through theme code or app embeds, outside it.
Go to Online Store → Themes → Edit code and check
theme.liquid and the additional-scripts fields for hard-coded tags, then
review App embeds. A tag hard-coded into the theme will not be blocked
by any consent tool that works through the app layer.
The usual cause is a plugin that loads scripts globally on wp_head,
independent of your consent plugin. Audit active plugins for anything that injects analytics or advertising code, and configure your consent platform to withhold the tags themselves until a choice is made — script-blocking rules, or tag-manager triggers that do not fire before consent.
Google Consent Mode on its own is not blocking: in its basic form the tag still loads and still sends requests, and only cookie writing is withheld, so a site relying on it alone will still fail the network-tab test above.
Where a plugin cannot be gated, moving the tag into a tag manager that respects consent state, or removing the plugin, are the honest options. Our WooCommerce guide goes through this in detail.
Whatever you deploy, re-run the ten-minute test after every theme change and every new app or plugin. Tracking has a way of reappearing.
This is the practical benchmark we apply when we look at a Singapore site. It is not a statutory checklist and not a standard anyone certifies against: some items go further than the PDPA requires in terms. Meeting all of them is not a determination that you comply, and missing one is not a determination that you do not.
No law requires a banner by name. The PDPA requires notification of purpose on or before collection (s.20) and consent before collecting personal data (s.13, s.14). Where your site runs analytics or advertising trackers, a consent mechanism that blocks them until a choice is made is the practical way to meet those requirements. The banner is the means, not the obligation.
It has one, but not in the form GDPR Article 6(1)(f) practitioners expect. Part 3 of the First Schedule permits collection, use or disclosure where it is in the legitimate interests of the organisation or another person and those interests outweigh any adverse effect on the individual — but only if the organisation has carried out an assessment before collecting, identified any adverse effect, implemented reasonable measures to eliminate, reduce or mitigate it, and given the individual reasonable access to information about that reliance. It expressly does not apply where the purpose is sending a message for an applicable purpose under section 37(6), which covers direct marketing. It is therefore not a substitute for consent on advertising or remarketing tags, and treating it as a silent internal balancing test the way Article 6(1)(f) is often used would not meet the requirement.
In a default configuration, treat it as yes. GA4 sets a persistent identifier and records behaviour against it, which is personal data. It should not load before the visitor has been notified and has consented. It also transfers data overseas, which brings section 26 into play — covered here.
The PDPA governs collection, use and disclosure of personal data in Singapore. Most operators find it simpler to apply one consent standard to all visitors than to geo-segment, particularly if they also serve EU customers, where the requirements are stricter still.
Generally no. A cookie that stores only what is technically needed to deliver something the visitor asked for — keeping a cart, maintaining a login, blocking abuse — is not the target of the Consent Obligation. The moment it carries a persistent identifier used to profile behaviour, the analysis changes.