Cookies and tracking: consent and privacy duties

Service page: Digital commerce and AI lawyer: terms, privacy and direct mailing.

What a cookie is, and why the law cares about it

Cookies are small files that a website stores on the user’s computer. Some are strictly necessary: keeping you logged in, a shopping cart. These do not require special consent, and nobody will complain about them. The problem starts with the rest: analytics cookies that track every click you make, and marketing cookies that build a behavioral profile that is passed to Google, Facebook and advertising platforms.

Besides cookies, there are also pixels (such as the Meta Pixel, which reports actions on the website back to Facebook), fingerprinting (identification by the browser’s characteristics) and local storage. All of these are subject to the same consent requirements.

Israeli law: what is required and what is recommended

Israel has no dedicated law on cookies, and the framework is the Protection of Privacy Law, 5741-1981: “personal information” is data about an identified or identifiable person, including by means of an “online identifier” (section 3), and an invasion of privacy requires informed consent (sections 1 and 3). In the Attorney General’s position, which the Privacy Protection Authority adopted in an opinion (גילוי דעת) of 25 February 2026, using information for profiling that is not related to the purpose of the transaction requires active consent. A cookie that creates a personal profile, whether it is called “analytics” or “marketing”, is processing of personal information in every respect.

The Privacy Protection Authority (PPA), the regulator in Israel in this field, already recommended in November 2020, in a draft for public comment on “privacy in advanced means of payment”, that consent to the use of cookies in these means be requested separately, with an explanation, and by an active action of the user (opt-in), not by default. The amount of the monetary sanctions the Authority may impose rose significantly with Amendment No. 13 to the Protection of Privacy Law, which came into force on 14 August 2025.

The GDPR applies to you too, even if the company is in Israel

If you offer goods or services to people who are in the European Union, or track their behavior there (for example with profiling cookies), the GDPR applies to you even if the company is in Israel (Article 3(2)). The GDPR (Regulation 2016/679) is among the strictest frameworks in the world on consent: under Article 4(11), consent must be “freely given, specific, informed and unambiguous”, by an affirmative action of the user. Israel is recognized by the European Union as a country with an adequate level of data protection, but this does not exempt you from complying with the GDPR when it applies.

GDPR fines are huge: up to 20 million euros or 4% of global annual turnover, whichever is higher. European authorities have fined Google, Meta and small websites alike.

Example: an online store that installs tracking tools before getting consent

Suppose an Israeli online store that also sells to visitors from Europe installs Google Analytics and Meta Pixel tags that load automatically from the moment someone enters the website, before the user has given any consent. In such a case the store is exposed twice: to the Privacy Protection Authority in Israel, as a business that collected behavioral information without informed consent; and to European regulators, since it tracks visitors who are in the European Union, under the stricter requirements of the GDPR. The practical solution: block the tags in the website’s code itself until consent is actually given, and not settle for a banner that is shown but does not block the loading in real time.

Cookie banner: what makes it lawful, and what makes it invalid

For the banner to be valid, it must meet these conditions: an “Accept” button and a “Reject” button that are equally accessible, with no visual manipulation; clicking “X” does not count as consent; scrolling the website does not count as consent; setting all cookies to “on” by default is not lawful.

The common dark patterns that regulators have already fined: a green, prominent “Accept” button and a small, grey “Reject” button; a path of 5 clicks to reject cookies compared with one click to accept; and a “Help us improve” message that puts psychological pressure on the user to accept.

Managing consents: why records are your protection

When a regulator knocks on the door, the first question is “Prove that the user consented.” A website that runs a Consent Management Platform (CMP) such as Cookiebot, OneTrust or Axeptio keeps an encrypted log of every consent: the time, the version of the banner, and which categories were accepted. That is your protection.

In addition: if the user asked to withhold consent, both Google Analytics and Meta Pixel must be blocked. Websites that run them “anyway” after a refusal breach the requirements of the GDPR and the ePrivacy Directive, and in Israel they operate without consent.

Practical steps for immediate compliance

Check manually that every third-party script on the website (Analytics, Pixel, HotJar, LinkedIn Insight) does not load before consent is given. Use Google Tag Manager with Consent Mode v2: it lets you manage consents in an orderly way from one place. Update your privacy policy to include a list of all the third-party cookies the website runs.

Frequently asked questions

Which cookies require the user’s explicit consent?

Cookies that are necessary for the website to function, such as keeping you logged in or a shopping cart, are exempt from consent. Analytics and marketing cookies, which create a behavioral profile of the user, require, under European law, clear prior consent by an affirmative action; in Israel this is also the consent that the Privacy Protection Authority prefers for uses that are not needed for the service.

What makes a cookie banner illegal?

A banner does not meet the requirements when the reject button is small or hidden compared with the accept button, when scrolling the website or clicking “X” counts as consent, and when the default is that all cookies are active in advance.

Does the GDPR apply to an Israeli business?

Yes, when the business offers goods or services to people who are in the European Union or tracks their behavior there, even without a branch in Europe (Article 3(2) of the GDPR). The test is where the user is, not their citizenship.

A cookie consent plugin: is it enough to meet the requirements?

A plugin or a consent management platform (CMP) is a tool, and does not guarantee compliance by itself. Check three things: that the plugin actually blocks the analytics and advertising tags until “Accept” is clicked, and does not only show a banner; that the reject button is as accessible and prominent as the accept button; and that a record of every consent is kept. On a website to which the GDPR applies, whoever relies on consent must be able to prove that it was given (Article 7(1)), and withdrawing consent must be as easy as giving it (Article 7(3)). It is also recommended to list in the privacy policy the cookies the website runs.