Cookies and Vietnam's Personal Data Protection Law 91/2025: What Consent Requires, What the Fines Are — and How Widget.vn Helps
Since January 1, 2026, Vietnam's Personal Data Protection Law, No. 91/2025/QH15, is in force, together with its implementing Decree 356/2025/ND-CP. Together they replace Decree 13/2023/ND-CP. If your website runs Google Analytics, Facebook Pixel, TikTok Pixel or any other tracking script, here is what you need to know.
This article is for information only and is not legal advice. Check the primary text, or ask a lawyer about your specific case.
Why tracking cookies involve personal data
Analytics and advertising scripts typically set device identifiers, read IP addresses and record browsing behaviour — information that can be linked to a specific person. Processing it needs a legal basis, and for an ordinary website that basis is usually the data subject's consent.
Valid consent under Article 9 of Law 91/2025
- Voluntary and informed — the user knows the type of data, the purpose, the controller, and their own rights (clause 2)
- Clear, specific and verifiable — expressible in writing, including electronic or verifiable formats (clause 3)
- Separate for each purpose — and users may not be forced to accept purposes beyond what was agreed (clause 4 a, b)
- Silence is not consent — no response does not count as consent (clause 4 d)
Article 4 also gives users the right to withdraw consent, and requires those processing data to make exercising that right convenient and not obstruct it.
Maximum fines under Article 8 of Law 91/2025
| Violation | Maximum fine (organisations) | Legal basis |
|---|---|---|
| Other personal-data-protection violations (incl. processing without a legal basis) | VND 3 billion | Art. 8(5) |
| Violating the rules on cross-border transfer of personal data | 5% of the previous year's revenue (at least the VND 3 billion cap) | Art. 8(4) |
| Buying or selling personal data | 10× the revenue earned (at least the VND 3 billion cap) | Art. 8(3) |
Individuals face at most half the organisational cap (clause 6). These are ceilings; the fine for each specific violation is set by Government decree. Depending on severity, violations can also lead to criminal liability, and to compensation for any damage caused (clause 1). The Ministry of Public Security is the specialised data-protection authority.
Common cookie banner mistakes
- Only an "Accept all" button, with no choice per purpose
- No information about which cookies, from whom, for what, and for how long
- Analytics and ad scripts that run before the user answers — although silence is not consent
- No way to change the choice after clicking accept
- No record of what the user agreed to, and when
How Widget.vn's Cookie Banner helps
Widget.vn's cookie banner is free and helps with each point above. No tool makes a website "compliant" on its own — you still need a privacy policy that matches how you handle data — but it takes care of the technical side:
✅ Per-Purpose Consent
Separate toggles for Essential, Analytics, Marketing. Users choose exactly which cookie types they allow.
✅ Script Blocking Before Consent
Google Analytics, Facebook Pixel, Hotjar… run only after the user consents. Or use Google Consent Mode v2.
✅ Consent Records
Every choice is recorded server-side: time, categories, browser. IP addresses are shortened after 30 days.
✅ Persistent "Cookie Settings" Button
After choosing, a small button in the page corner lets users change their mind or withdraw consent at any time.
✅ Cookie Detail Table
Shows cookie name, provider, purpose, and retention period — organised by category.
✅ Known-Cookie Detection
Recognises 80+ common cookies (GA, Hotjar, Clarity, Facebook, Google Ads, TikTok, Zalo…) and suggests a category.
Integrate in Minutes
Paste one snippet into your website:
<script src="https://cdn.widget.vn/v1/loader.js"
data-widget-id="YOUR_WIDGET_ID"
data-api-base="https://api.widget.vn">
</script>Or use MCP to configure it through an AI assistant (Claude, ChatGPT).
The Vietnam Preset
Select regulationPreset: "vietnam" to pre-configure:
- Full Vietnamese UI text
- 3 categories: Essential, Analytics, Marketing
- Copy that references Law 91/2025/QH15 and Decree 356/2025/ND-CP
- Automatic server-side consent records
- Respects the GPC (Global Privacy Control) signal
- 365-day consent expiry with automatic re-prompt
GDPR (EU), PDPA (Thailand) and PIPL (China) presets are also available for businesses with customers abroad.
Get Started
Widget.vn's cookie banner and terms-consent widget are free. Try them on the demo page before adding them to your site.
Sources: Personal Data Protection Law No. 91/2025/QH15 (Articles 4, 8, 9); Decree 356/2025/ND-CP. Updated October 13, 2026 — the previous version cited the replaced Decree 13/2023.