Last review date: 1 January 2025
Yes
Personal information controllers must include information about the installation, operation, and rejection of devices that automatically collect personal information (e.g., cookies) in their privacy policy (if applicable) (PIPA, Article 30(1)(vii)).
Beyond this, PIPA does not specify detailed requirements for behavioral information. However, PIPA Article 2(i)(b) defines personal information to include information that, while not identifying a specific individual alone, can be easily combined with other information to identify an individual. In this case, whether information can be easily combined should be reasonably determined considering the time, cost, and technology required for identification and the availability of other information.
Therefore, if cookies or other online tracking technologies are used with the data subject identified, or if the behavioral information is personally identifiable to the extent that the data subject can be identified, it is considered as personal information under PIPA. In such cases, PIPA compliance obligations arise for the processing of personal information through the use of cookies and other online tracking technologies.
In January 2024, the PIPC announced a policy plan for protecting online behavioral information used in targeted advertising. Key points include:
- Clarifying roles and responsibilities of key stakeholders in targeted advertising
- Enhancing data subjects' understanding and protection capabilities regarding behavioral information
- Conducting surveys and evaluating privacy policies
- Revising guidelines on online targeted advertising through public-private cooperation
Last review date: 1 January 2025
Yes
☒ email marketing
☒ prior opt-in consent
☒ prior existing business relationship (and subject to other requirements) with opt-out consent
☒ telephone marketing
☒ prior opt-in consent
☒ opt-out or implied consent
Applies when telemarketers (those engaged in the business of selling certain goods through telephone solicitation or inducing telephone responses) make voice calls to recipients and notify them of the source of personal information collection and conduct telemarketing (Network Act, Article 50(1)(ii)).
☒ prior existing business relationship (and subject to other requirements) with opt-out consent
☒ SMS/text message marketing
☒ prior opt-in consent
☒ prior existing business relationship (and subject to other requirements) with opt-out consent
☒ postal marketing
☒ prior opt-in consent
☒ online behavioral advertising targeting/ social media targeting/ad personalization marketing
☒ prior opt-in consent