Establishment of new regulation regarding user related information such as cookies in Japan

On June 17th, 2022, the amendment to the Japanese Telecommunications Business Act (TBA) was promulgated, particularly, relating to cookies and the expanded scope of telecommunications services regulated by the TBA. Although the effective date has not been announced, it is likely to come into effect no later than one year from the promulgation date (i.e. by June 16, 2023). The amended TBA imposes certain obligations such as notifying the user in advance or providing opt-out measures in relation to the external transmission of user related information (URI). This will apply, for example, to online business operators such as social networking service providers, search engine providers and so on. 

The purposes of the amendment were to: (1) ensure the provision of information and communication infrastructure, (2) obtain a secure and reliable communications service network, and (3) to develop a fair competitive environment in response to the trends in the telecommunications market.

In regard to purpose (2) above, a new provision was established regulating the transmission of URI including cookies. This will apply to those who provide telecommunications services specified in the Order of the Ministry of Internal Affairs and Communications (MIC) as having “an impact that is not minimal” on users' benefits in consideration of the contents, the scope of users, and the usage conditions, as well as telecommunications carriers that are subject to certain notification or registration requirements under the TBA at present (collectively “carriers etc”).

In the meantime, since last year (effective April 1, 2021), the MIC has changed their interpretation of a carrier etc to include one located outside Japan under the TBA. Therefore, foreign business operators may be affected by this new law, for example, if they are engaged in the business of providing telecommunications services to users in Japan, such as a short message service (SMS), social networking service (SNS), search engine, online shopping mall, or online services to provide information and electronic bulletin boards subject to certain conditions. Although it is likely limited by its scale of business, the detailed conditions are not decided yet.

Under the new provision, either of the following requirements must be fulfilled when external transmission of URI is attempted:

  • Notify, make publicly accessible or otherwise create a condition that allows users to easily be informed of the content of URI to be transmitted, telecommunications facilities to which the URI will be transmitted, and other matters specified in the Order of MIC in advance;  
  • Obtain a user’s consent for transmitting URI to telecommunications facilities; or
  • Provide opt-out measures for suspending either of the following actions when requested by a user:
      • Transmission of URI; or
      • Usage of URI;

Make publicly accessible or otherwise create a condition that allows users to easily obtain details of the opt-out measures mentioned above (including details specified in the Order of MIC) and the data for which opt-out rights have not yet been exercised by users.

However, required information for usage of telecommunications service specified in the Order of MIC (e.g. OS information, preference, etc.) and identification code (e.g. first party cookie, etc.) are not subject to the regulation.

Further subject of discussion

The following matters are being discussed to be specified in the Order of MIC.

  • The criteria for determining telecommunications services having ”an impact that is not minimal” on users' benefits in consideration of the contents, the scope of users and the usage conditions (e.g. online video platform, online search service, SNS excluding DM service, etc.)
  • Requirements when notifying, making publicly accessible or otherwise creating a condition for allowing users’ easy access to relevant information (e.g. avoidance of certain terminology, requirement for notification to be in Japanese, etc.)
  • Contents to be notified or made easily accessible to users (e.g. usage purpose of URI (including transmission to third parties), etc.)
  • Contents of details to be made easily accessible to users when providing opt-out measures (e.g. notifying opt-out procedure by pop ups, putting URL regarding opt-out on top page, etc.)
  • The specific types of information required that would be considered strictly necessary for the usage of enabling users to use the relevant telecommunications services (i.e. URI not subject to the regulation)

To ensure carriers etc conform with the regulation, carriers etc that violate the regulation may be ordered to improve the means of conducting their operations or take other necessary measures to ensure interests of users.

We will keep an eye on the further details that are expected by next year.


Authored by Hiroto Imai, Mizue Kakiuchi and Taiju Chimura.

Hiroto Imai
Mizue Kakiuchi
Senior Associate
Taiju Chimura


This website is operated by Hogan Lovells International LLP, whose registered office is at Atlantic House, Holborn Viaduct, London, EC1A 2FG. For further details of Hogan Lovells International LLP and the international legal practice that comprises Hogan Lovells International LLP, Hogan Lovells US LLP and their affiliated businesses ("Hogan Lovells"), please see our Legal Notices page. © 2022 Hogan Lovells.

Attorney advertising. Prior results do not guarantee a similar outcome.