Vietnam's Cookie Law: Businesses Face Up to 100M VND Fines — Free Solution from Widget.vn
Since January 1, 2026, Vietnam's Personal Data Protection Law (Law 91/2025) is in full effect, expanding on Decree 13/2023. Many Vietnamese businesses still don't realize their websites are breaking the law — simply because their cookie banner only shows "Accept" and "Reject".
Are You Non-Compliant?
If your website uses Google Analytics, Facebook Pixel, Hotjar, TikTok Pixel, or any tracking script — and you don't have granular, purpose-specific consent — you're violating the law.
Under Article 4 of Decree 13/2023, consent must be:
- Specific per processing purpose — bundled "Accept All" doesn't count
- Documented and stored — localStorage alone is insufficient for audit
- Withdrawable at any time — "Withdrawal must be as easy as giving consent"
- Transparent — users must know which cookies, by whom, for what, how long
Fines: More Serious Than You Think
Many businesses think "nobody's been fined yet" so they don't need to worry. Here are the actual penalties:
| Violation | Fine | Legal Basis |
|---|---|---|
| Collecting personal data without consent | 50–100M VND (~$2,000–4,000) | Decree 13/2023, Art. 84 |
| Not disclosing processing purposes | 30–50M VND (~$1,200–2,000) | Decree 13/2023, Art. 84 |
| No mechanism to withdraw consent | 30–50M VND (~$1,200–2,000) | Decree 13/2023, Art. 84 |
| No consent records for audit | 20–40M VND (~$800–1,600) | Decree 13/2023, Art. 85 |
Under Law 91/2025, fines can reach up to 5% of annual revenue for serious violations — similar to the EU's GDPR.
Most Cookie Banners in Vietnam Are Wrong
Open any 10 Vietnamese e-commerce sites and you'll see:
- ❌ Banner with only "Accept" and "Reject" — non-compliant: no category selection
- ❌ No cookie detail table — violates transparency obligations
- ❌ Consent stored in localStorage only — insufficient for audit
- ❌ No "Cookie Settings" button after consent — violates right to withdraw
- ❌ Google Analytics, Facebook Pixel run before consent — the most serious violation
The Solution: Widget.vn Cookie Consent — Free, 5-Minute Integration
Widget.vn provides a Cookie Consent widget that is fully compliant with Decree 13/2023 and Law 91/2025, completely free:
✅ Per-Purpose Consent
Separate toggles for Essential, Analytics, Marketing. Users choose exactly which cookie types they allow.
✅ Script Blocking Before Consent
Google Analytics, Facebook Pixel, Hotjar... only run AFTER user consent. No more "collect first, ask later".
✅ Server-Side Consent Records
Every consent decision is recorded server-side: who, when, what categories, IP, User Agent. Audit-ready.
✅ Persistent "Cookie Settings" Button
After consent, a small button stays visible on the page corner. Users change their mind anytime.
✅ Cookie Detail Table
Shows cookie name, provider, purpose, and retention period — organized by category.
✅ Auto Cookie Scanner
Detects 50+ common cookies (GA, Hotjar, Clarity, FB, Google Ads, TikTok...) and auto-categorizes them.
Integrate in 5 Minutes
Paste one snippet into your website:
<script src="https://cdn.widget.vn/v1/loader.js"
data-widget-id="YOUR_WIDGET_ID"
data-api-base="https://api.widget.vn">
</script>Or use MCP to configure via AI assistant (Claude, ChatGPT). Widget.vn is the first widget platform in Vietnam to support MCP.
Vietnam Preset — One Click Compliance
Select regulationPreset: "vietnam" to auto-configure:
- Full Vietnamese UI text
- 3 categories: Essential, Analytics, Marketing
- References to Decree 13/2023 and Law 91/2025
- Auto server-side consent recording
- GPC (Global Privacy Control) signal support
- 365-day consent expiry with automatic re-prompt
Also available: GDPR (EU), PDPA (Thailand), PIPL (China) presets — perfect for export-focused businesses.
Don't Wait to Get Fined
With Law 91/2025, enforcement will increase. Non-compliant businesses face not just fines but reputation damage as Vietnamese consumers become more privacy-aware.
Widget.vn Cookie Consent is free, open-source, and fully compliant with Vietnamese law.