APPI / PIPA / PDPA

Three Asia-Pacific regimes govern tracking data with different emphasis. Japan's APPI, amended in 2022, requires opt-in consent before providing personal data to third parties and treats cookie-like identifiers as personal data when the recipient can link them to a person, which brought advertising tags into scope; a 2026 amendment adds administrative fines, expected in force by 2028. Korea's PIPA is among the strictest consent laws in the world, requiring separate consent for collection, third-party provision, and marketing, and the Personal Information Protection Commission has fined Google and Meta a combined ₩100 billion for behavioral advertising without proper consent. Singapore's PDPA permits deemed consent in defined cases but requires notification and purpose limitation, with fines up to 10 percent of Singapore turnover. In each case the obligation attaches to what the tags and SDKs do, not to the banner alone.