Cookie Policy (Malaysia)

A Cookie Policy in Malaysia documents the organisation's approach and the obligations placed on those it covers.

Cookies are small text files placed on a user's device by a website server. They serve a range of functions — from maintaining user sessions and remembering preferences (essential cookies) to tracking browsing behaviour across websites for advertising purposes (targeting cookies). Other tracking technologies include web beacons (pixel tags), local storage objects (LSOs), fingerprinting scripts, and software development kits (SDKs) embedded in mobile applications.

Under the Notice and Choice Principle in Section 7 of the PDPA 2010, a data user (website operator) must inform data subjects about the purposes for which their personal data is collected and processed before or at the time of collection. Where cookies collect personal data — such as IP addresses, device identifiers, browsing histories, or user account information — the Notice and Choice Principle requires disclosure. A Cookie Policy, displayed prominently on the website and linked from the Privacy Policy and footer, satisfies this obligation.

Malaysia does not yet have a specific cookie consent regulation comparable to the EU's ePrivacy Directive or the UK ICO cookie guidance that requires prior opt-in consent for non-essential cookies. However, the proposed Personal Data Protection (Amendment) Act 2024 is expected to strengthen consent requirements for online tracking. In practice, Malaysian websites frequently adopt EU-standard cookie banners with genuine opt-in consent for analytics and marketing cookies to serve European users under the GDPR, while Malaysian-only operations may implement a simpler notice-and-opt-out model.

Cookies that collect personal data must be disclosed in the Privacy Policy as well as in the Cookie Policy. The Personal Data Protection Commissioner under the Ministry of Digital Malaysia can investigate complaints about inadequate data transparency. For e-commerce websites, the Consumer Protection (Electronic Trade Transactions) Regulations 2012 require clear disclosure of how user data collected during transactions is handled.

The legal framework governing the Cookie Policy (Malaysia) in Malaysia draws on several key statutes and regulatory bodies. Under Malaysian law, the Contracts Act 1950 (Act 136) governs contractual obligations. The Companies Act 2016 (Act 777) regulates corporate entities through the Companies Commission of Malaysia (SSM). The Employment Act 1955 (Act 265) and the Department of Labour govern employment matters. The Personal Data Protection Act 2010 (Act 709) and the Personal Data Protection Department protect personal data. The Inland Revenue Board of Malaysia (LHDN) administers tax obligations. The Industrial Court adjudicates employment disputes under the Industrial Relations Act 1967 (Act 177). Parties executing a Cookie Policy (Malaysia) in Malaysia should confirm the document reflects current law, including any amendments enacted since the original drafting date. The Companies Act 2016 (Act 777) sets the foundational requirements.

A Cookie Policy is required for any Malaysian website or application that uses cookies or other tracking technologies to collect data from users.

A Cookie Policy is needed for any e-commerce website that uses session cookies for shopping carts, authentication cookies for user accounts, or analytics tools such as Google Analytics, which sets cookies that may constitute personal data under Section 4 of the PDPA 2010.

A Cookie Policy is required for any website using third-party advertising networks — such as Google AdSense, Facebook Audience Network, or programmatic advertising platforms — that set targeting or retargeting cookies to track user behaviour across the web for personalised advertising.

A Cookie Policy is needed for any website serving users in the European Union alongside Malaysian users, as the EU's General Data Protection Regulation (GDPR) and the ePrivacy Directive require prior opt-in consent for non-essential cookies from EU residents, regardless of where the website operator is based.

A Cookie Policy is required for mobile applications that use third-party analytics SDKs (such as Firebase Analytics, Mixpanel, or AppsFlyer) or advertising SDKs that collect device identifiers and usage data, as these are functionally equivalent to browser cookies and attract the same PDPA 2010 transparency obligations.

A Cookie Policy is needed when a website undergoes a privacy audit or data protection review — either internally or as part of a procurement due diligence process — and the auditor identifies the absence of a Cookie Policy as a compliance gap under the PDPA 2010.

Parties in Malaysia should prepare a Cookie Policy (Malaysia) proactively rather than waiting for a dispute to arise. Courts interpret agreements based on the written terms rather than oral representations. Under Malaysian law, the Contracts Act 1950 (Act 136) governs contractual obligations. The Companies Act 2016 (Act 777) regulates corporate entities through the Companies Commission of Malaysia (SSM). The Employment Act 1955 (Act 265) and the Department of Labour govern employment matters. The Personal Data Protection Act 2010 (Act 709) and the Personal Data Protection Department protect personal data. The Inland Revenue Board of Malaysia (LHDN) administers tax obligations. The Industrial Court adjudicates employment disputes under the Industrial Relations Act 1967 (Act 177). Where the transaction involves regulated activities, prior approval from the relevant authority may be required before execution.

A thorough Cookie Policy for a Malaysian website must include the following essential elements.

Definition of Cookies: A clear explanation of what cookies are, how they work technically, and how they differ from other tracking technologies such as web beacons, pixel tags, and local storage. Users should understand that cookies are placed on their device and may persist beyond a single browsing session.

Categories of Cookies: A structured breakdown of the cookie categories used by the website. Standard categories include: (1) Strictly necessary / essential cookies — required for the website to function (session management, security, load balancing); (2) Functional / preference cookies — remember user preferences such as language and region; (3) Analytics / performance cookies — collect anonymised data about website usage (Google Analytics, Hotjar); (4) Marketing / targeting cookies — track browsing to deliver personalised advertising (Facebook Pixel, Google Ads).

Cookie Inventory Table: A table listing specific cookies used by the website, including the cookie name, provider (first-party or third-party), purpose, type (session or persistent), and duration. This level of detail is required under GDPR and is considered best practice for PDPA 2010 compliance.

Third-Party Cookies: Disclosure of any third-party cookies set by embedded content, social sharing buttons, or advertising networks, with links to the third parties' own privacy and cookie policies. The website operator cannot control third-party cookies but must disclose their presence.

Consent Mechanism: A description of how the website obtains user consent for non-essential cookies — whether through a cookie banner with accept/reject options, a cookie preference centre, or a notice-and-opt-out model. Under PDPA 2010, disclosure before collection is required.

User Control and Opt-Out: Instructions for users to manage cookies through browser settings, third-party opt-out tools (Google Analytics opt-out, NAI opt-out), and the website's own cookie preference settings.

Updates to the Cookie Policy: A statement that the Cookie Policy may be updated as new cookies are added or tracking practices change, with the last updated date prominently displayed.

Additional compliance elements for a Cookie Policy (Malaysia) used in Malaysia include: Under Malaysian law, the Contracts Act 1950 (Act 136) governs contractual obligations. The Companies Act 2016 (Act 777) regulates corporate entities through the Companies Commission of Malaysia (SSM). The Employment Act 1955 (Act 265) and the Department of Labour govern employment matters. The Personal Data Protection Act 2010 (Act 709) and the Personal Data Protection Department protect personal data. The Inland Revenue Board of Malaysia (LHDN) administers tax obligations. The Industrial Court adjudicates employment disputes under the Industrial Relations Act 1967 (Act 177). Forms-legal.com provides this template as a starting point for Malaysia-compliant documentation.