Cookie Policy (Pakistan)

A Cookie Policy in Pakistan records the organisation's position on the matter, defining what is permitted, what is prohibited and how breaches are handled.

PECA 2016, enacted as Act XL of 2016, criminalises unauthorised access to electronic data under Section 3, data interference under Section 5, and electronic fraud under Section 9. While PECA 2016 is primarily a criminal statute, its provisions on unauthorised data access create a legal basis requiring websites to obtain informed consent before setting non-essential cookies on users' devices. The Personal Data Protection Bill (PDPB), which Pakistan has been developing in alignment with international standards including the European Union General Data Protection Regulation (EU GDPR) and the California Consumer Privacy Act (CCPA), further reinforces the need for transparent cookie disclosures and consent mechanisms.

The Pakistan Telecommunication Authority (PTA), established under the Pakistan Telecommunication (Re-organisation) Act 1996, has issued directives requiring digital service providers to implement data privacy notices and obtain consent for data collection. The PTA's Digital Rights Protection Authority framework and the Removal and Blocking of Unlawful Online Content (Procedure, Oversight and Safeguards) Rules 2021 create additional compliance obligations for websites operating in or targeting Pakistani users.

A Cookie Policy for Pakistan typically distinguishes between strictly necessary cookies (required for website functionality, exempt from consent requirements), performance cookies (analytics tracking such as Google Analytics or Adobe Analytics), functional cookies (remembering user preferences and language settings), and targeting or advertising cookies (used for remarketing through platforms such as Meta Ads, Google Ads, and TikTok for Business). The policy must identify the third-party service providers operating these cookies, including the data they collect, the retention periods, and the mechanisms by which users can opt out.

E-commerce businesses registered with the Securities and Exchange Commission of Pakistan (SECP) under the Companies Act 2017 and operating through digital platforms are particularly subject to cookie compliance requirements, as their data processing activities involving Pakistani consumers must align with both PECA 2016 and the evolving PDPB framework. Financial technology companies regulated by the State Bank of Pakistan (SBP) under the Payment Systems and Electronic Fund Transfers Act 2007 face additional requirements regarding data security and user consent in digital banking applications.

The Cookie Policy (Pakistan) template from forms-legal.com provides a compliant starting point for businesses of all sizes — from sole proprietors registered under the Firms (Registration) Act 1932 to large corporations listed on the Pakistan Stock Exchange (PSX) — confirming that users are fully informed about data collection practices and that the website operator demonstrates accountability consistent with good digital governance standards.

A Cookie Policy in Pakistan is required whenever a website, mobile application, or digital platform deploys cookies or similar tracking technologies that collect, store, or transmit data about users visiting from Pakistan.

A Cookie Policy is needed when an e-commerce business registered in Pakistan under the Companies Act 2017 or operating as a sole proprietorship under the Firms (Registration) Act 1932 operates an online store that uses session cookies for shopping cart functionality, analytics cookies through Google Analytics or similar services, and advertising cookies for remarketing campaigns through Meta Ads or Google Ads.

A Cookie Policy is required when a financial services company regulated by the State Bank of Pakistan (SBP) or the Securities and Exchange Commission of Pakistan (SECP) operates a website or mobile banking application that tracks user sessions, records login activity, and uses analytics tools to monitor user behaviour within the application.

A Cookie Policy is needed when a media company, news portal, or digital publisher operating under Pakistan Electronic Media Regulatory Authority (PEMRA) rules publishes content online and monetises the site through programmatic advertising networks, which invariably deploy tracking cookies to build audience profiles for targeted advertising.

A Cookie Policy is required when a software-as-a-service (SaaS) company registered in Pakistan and exporting digital services to international clients uses cookies for user authentication, session management, and product analytics, particularly if the company's international clients are subject to GDPR in the European Union or similar data protection regimes.

A Cookie Policy is needed when a healthcare provider or telemedicine platform operating under the Pakistan Medical Commission Act 2020 deploys a patient portal or appointment booking system that uses session cookies and analytics tools, given the sensitive nature of health-related data and the heightened obligations under PECA 2016 regarding protection of sensitive personal information.

A Cookie Policy is required when any website targets Pakistani consumers and participates in affiliate marketing programmes, as affiliate tracking cookies create specific disclosure obligations to users regarding the commercial relationship between the website operator and the affiliated brands.

Parties in Pakistan should prepare a Cookie Policy (Pakistan) proactively rather than waiting for a dispute to arise. Courts interpret agreements based on the written terms rather than oral representations. Under the Companies Act 2017, the Securities and Exchange Commission of Pakistan (SECP) maintains the register of Pakistani companies. Section 16 of the Companies Act 2017 governs company incorporation. The Contract Act 1872 governs general contractual obligations. The Federal Board of Revenue (FBR) administers corporate tax under the Income Tax Ordinance 2001. The High Courts (Lahore, Sindh, Peshawar, Balochistan, Islamabad) have original and appellate jurisdiction. Where the transaction involves regulated activities, prior approval from the relevant authority may be required before execution.

A compliant Cookie Policy in Pakistan under the Prevention of Electronic Crimes Act 2016 and the Pakistan Telecommunication Authority's data privacy framework must contain the following essential elements.

Website Identification: The policy must identify the full legal name of the website operator, its SECP registration number or business registration details where applicable, the registered business address in Pakistan, and the contact email address for privacy enquiries. This information establishes accountability and enables users to exercise their data rights.

Definition of Cookies: The policy must explain clearly what cookies are — small text files stored on the user's device by the website — and distinguish cookies from other tracking technologies such as web beacons, pixel tags, local storage objects (LSOs), and software development kit (SDK) trackers used in mobile applications. The Prevention of Electronic Crimes Act 2016 under Section 2(f) defines 'data' broadly to include any form of representation of information, which encompasses cookies and tracking identifiers.

Categorisation of Cookies: The policy must classify cookies by purpose — (1) Strictly Necessary cookies required for basic website functionality; (2) Performance/Analytics cookies measuring website usage through tools such as Google Analytics 4 (GA4) or Hotjar; (3) Functional cookies storing user preferences such as language settings and location; and (4) Targeting/Advertising cookies used for remarketing through platforms including Meta Pixel, Google Ads, TikTok Pixel, and programmatic advertising exchanges.

Third-Party Cookie Disclosure: The policy must list all material third-party services that set cookies on the website, including the service provider name, the data collected, the retention period, the location of data processing (including any cross-border data transfers), and a link to the third party's own privacy and cookie policy. Under PTA's data localisation guidance, cross-border transfers of Pakistani users' data require transparency and, where applicable, safeguards.

ConsentMechanism: The policy must describe the consent mechanism deployed — typically a cookie banner or consent management platform (CMP) compliant with PECA 2016 Section 3's requirement for authorised access — explaining how users accept all cookies, accept only necessary cookies, or customise their preferences. The consent record must be stored to demonstrate compliance.

User Rights and Opt-Out: The policy must inform users of their right to withdraw consent at any time, instructions for disabling cookies through browser settings (Chrome, Firefox, Safari, Edge, and Opera all have native cookie management interfaces), links to industry opt-out tools such as the Digital Advertising Alliance opt-out and the Network Advertising Initiative opt-out, and the effect of disabling cookies on website functionality.

Retention Periods: The policy must state the retention period for each category of cookie — session cookies expire when the browser is closed; persistent cookies may be retained for periods ranging from 30 days (standard for analytics) to 24 months (for advertising frequency capping). Retention periods must be proportionate to the purpose of the cookie under the principles consistent with the Personal Data Protection Bill framework.

Cookie List Table: Best practice under international standards referenced by PTA requires a detailed cookie inventory table listing each cookie by name, the provider, the purpose, the type (session or persistent), and the expiry period. This level of disclosure is increasingly expected by major e-commerce platforms and enterprise clients doing business with Pakistani operators.

Policy Updates: The policy must state that it will be updated as new technologies are deployed or legal requirements change, the date of the last update, and whether users will be notified of material changes. The Pakistan Electronic Crimes Act 2016 Section 5 on data interference creates liability for unauthorised modification of data — a well-maintained cookie policy demonstrates that data collection is authorised and transparent.

Contact Information: The policy must provide the name and contact details of the data privacy officer or designated privacy contact, the address for written correspondence, and a commitment to respond to privacy enquiries within a reasonable period (typically 30 days, consistent with international standards referenced in PDPB consultations).

Forms-legal.com provides this Cookie Policy (Pakistan) template to help businesses of all sizes — from technology startups to established enterprises listed on the Pakistan Stock Exchange — implement transparent data practices that meet PECA 2016 requirements and align with the forthcoming Personal Data Protection Bill regime.

Under the Companies Act 2017, the Securities and Exchange Commission of Pakistan (SECP) maintains the register of Pakistani companies. Section 16 of the Companies Act 2017 governs company incorporation. The Contract Act 1872 governs general contractual obligations. The Federal Board of Revenue (FBR) administers corporate tax under the Income Tax Ordinance 2001. The High Courts (Lahore, Sindh, Peshawar, Balochistan, Islamabad) have original and appellate jurisdiction.