Privacy policy for a website or app after Amendment 13: what must appear, and what the Authority says about cookies

Internet Law · October 21, 2026 · 11 min read

The short answer

A privacy policy for a website or app must, at the very least, satisfy section 11 of the Protection of Privacy Law, 5741-1981, as amended by Amendment 13: at every point where personal data is collected, a notice must state whether providing the data is a duty or voluntary and what the consequence of refusal is, the purpose, who the controller of the database is and how to contact it, to whom the data will be transferred and for what purpose, and that rights of access and correction exist. As for cookies – Israeli law contains no provision requiring a banner: under the Privacy Protection Authority’s opinion on consent (25 February 2026), continued browsing after an adequate notice will usually count as implied consent where there is a reasonable link between the collection and the service, while profiling unrelated to the service and direct-mailing services require a separate active opt-in. Most sites need not register a database (section 8A of the Law), but all are subject to the Protection of Privacy Regulations (Data Security), 5777-2017. Failing to give the notice through a website costs ILS 2 per person whose data is in the database, and no less than ILS 20,000.

1. The five items that must appear – section 11 of the Law

Section 11 of the Protection of Privacy Law, as in force since 14 August 2025, provides: “A request to a person for personal data for processing in a database shall be accompanied by a notice stating – (1) whether that person is under a legal duty to provide the data, or whether providing the data depends on their will and consent and what the consequence of refusal is; (2) the purpose for which the data is requested; (2A) the name of the controller of the database, and how to contact it; (3) to whom the data will be transferred and the purposes of the transfer; (4) the existence of the right of access to the personal data under section 13 and of the right to request correction of the personal data under section 14.” The words “and what the consequence of refusal is”, paragraph (2A) and paragraph (4) were added by Amendment 13, and these are where most older policies fail.

The notice is required at every collection point – sign-up form, checkout, mailing-list subscription – and not only on a page reached by a link in the footer; the accepted practice is a short notice beside the form, referring to the full policy. The Authority’s opinion on consent makes clear that compliance with section 11 does not guarantee informed consent: every type of data and every purpose must be listed, without “inter alia” or “and the like”; recipients may be described by category – a cloud provider, an advertising company. The rights in paragraph (4) must be honoured in practice: access “in Hebrew, Arabic or English” (section 13 of the Law) and correction of inaccurate data (section 14 of the Law). Whoever failed to give a section 11 notice and did not cure it within 30 days of a demand is exposed to damages without proof of harm of up to ILS 10,000 (section 15A of the Law).

2. The definitions that matter – section 3 of the Law

Amendment 13 repealed section 7 of the Law and moved the definitions to section 3. “Personal data” is “data relating to an identified person or to an identifiable person”, and an “identifiable person” is “a person who can be identified with reasonable effort, directly or indirectly, including by means of an identifying detail, such as a name, identity number, biometric identifier, location data, online identifier, or one or more data relating to their physical, health, economic, social or cultural condition”. This is the anchor for cookies and device identifiers: the Law does not mention cookies, but an “online identifier” and “location data” are now part of the definition of personal data. The common claim that “Amendment 13 provides that cookies are data” is imprecise – the route runs through the definition.

“Special-sensitivity data” comprises, under section 3 of the Law, twelve categories, among them health, genetic and biometric data, origin, criminal record, opinions and beliefs, personality assessment, location and traffic data on the conditions in paragraph (9) of the definition, and salary data and financial activity. This classification has three consequences: the security tier, the duty to notify the Authority (section 8A(b) of the Law), and the rate of the sanction. Three further definitions: a “controller” – whoever determines the purposes of processing; a “holder” – “a party external to the controller of the database that processes data on its behalf”, such as a hosting or mailing provider; and “processing” – any operation on personal data, including collecting, storing, disclosing and transferring it. A “database” excludes a collection of names, addresses and contact details only, of 100,000 persons or fewer, provided the owner has no other collection about the same persons – an exception almost no commercial site satisfies.

3. Registration or notification – section 8A of the Law

Since 14 August 2025, section 8A(a) of the Law provides that a database must be registered in two cases only: where “its main purpose is the collection of personal data for transfer to others as a business or for consideration, including direct-mailing services, and the database holds personal data on more than 10,000 persons”, or where the controller is a public body. Registration is replaced by a notification duty: the controller of a database holding special-sensitivity data on more than 100,000 persons notifies the Authority within 30 days of its identity and of the identity of the officer, and delivers a copy of the database-definitions document (section 8A(b) of the Law). The absence of a registration duty exempts from no other duty.

4. The privacy protection officer – the test for apps

Of the four groups that section 17B1(a) of the Law requires to appoint an officer, two are relevant to websites and apps: paragraph (3) – those whose principal activities “require regular and systematic monitoring of persons, including systematic tracking or tracing of a person’s behaviour, location or actions, on a significant scale”; and paragraph (4) – whoever’s principal activity includes processing special-sensitivity data on a significant scale, such as health and finance apps. The Authority’s opinion of 14 July 2026 on appointing an officer holds that paragraph (3) expressly includes apps and websites that track user activity to build profiles (paragraphs 9.4–9.6); that “significant scale” is assessed on the criteria in section 17B1(b) of the Law – the number of persons, their share of a population, the volume of data and the range of its types, the duration and frequency of processing, the retention period and the geographic scope – with no numeric threshold, and any one of them may suffice (paragraph 9.10); and that appointing an officer in a body that is obliged to do so may earn it a 10 per cent reduction of a financial sanction imposed for other breaches, under item 2(4) of the Fifth Schedule to the Law (paragraph 9.14). The officer’s contact details (section 17B2(a)(4) of the Law) are published to the public “in an accessible and simple manner” – so they belong in the privacy policy. The officer may be external, provided there is no conflict of interests (section 17B3(b)–(c) of the Law).

5. The data-security regulations – by tier

The Protection of Privacy Regulations (Data Security), 5777-2017, apply to every database, registered or not, and grade the duties by a security tier set under regulation 1 and the schedules:

Tier	Who	Main duties
Database managed by an individual	An individual or a corporation owned by an individual, with up to two further authorised users; not for a database of 10,000 persons or more	Database-definitions document (regulation 2) and a short list of duties
Basic	Every database not in another tier	Definitions document, security procedure (regulation 4), systems inventory (regulation 5), access permissions (regulation 8), documentation of security incidents (regulation 11), communications security and encryption (regulation 14), an agreement with every holder (regulation 15)
Medium	First Schedule: a database whose purpose is transferring data to others, a public body, or data of the sensitive types; but a database of the sensitive types with up to 10 authorised users, or whose sensitive data concerns only the organisation’s employees and suppliers, remains in the basic tier	In addition: physical authentication means and password rules (regulation 9(b)), access logging (regulation 10), control of entry to system sites (regulation 6(b)), periodic training (regulation 7(c)), an audit every 24 months (regulation 16)
High	Second Schedule: a medium-tier database with 100,000 persons or more, or more than 100 authorised users	In addition: a risk survey and penetration tests every 18 months (regulation 5)

Two regulations bear directly on websites and apps. Regulation 15 requires a written agreement with every “holder” – hosting, analytics, mailing – setting out the data it may process, the purposes of processing, the term and the return of the data at its end, security duties, confidentiality and sub-processors; the vendor’s standard agreement usually does not cover this. Regulation 11 requires every security incident to be documented, and a “serious security incident” – in a high-tier database any unauthorised use or breach of data integrity, in a medium-tier database a breach of a material part of the database – is reported “immediately” to the Head of the Privacy Protection Authority (regulation 11(d)). Breach of the regulations costs, under the Third Schedule to the Law and the Authority’s guide, ILS 1,000–2,000 per breach in a basic-tier database (ILS 4,000 for a breach of regulation 15), and in medium- and high-tier databases ILS 20,000–320,000 according to the gravity of the breach.

6. Cookies: what the Authority actually says

Israel has no cookie statute and no Authority guideline devoted to banners. The central document is the Privacy Protection Authority’s opinion on consent in privacy law of 25 February 2026, and two holdings in it answer the question.

The first, in paragraph 42: “a user’s continued ‘browsing’ of a website, after the information required for their informed consent to the collection of data about them was presented to them on entering the site (even if referred to further detail elsewhere on the site), will usually be regarded as implied consent to the collection of the data and its use.” The Authority qualifies this: implied consent is valid only where there is “a reasonable link between the purposes of collecting the data and the manner of its use and the characteristics of that service”, and the operator must be able to prove it, for example by preserving the screens shown to users. The second, in paragraph 74: where an agreement includes consent to the collection of data not required for the service, or to its use for materially different purposes, “it is preferable that consent under those clauses be given in the form of separate active consent (opt-in) and not passively (opt-out)”; and as to “profiling” not required for or directly related to the purpose of the service between parties of unequal power, and likewise in the context of direct-mailing services – “passive consent will not suffice, and consent must be obtained in the form of separate active consent (opt-in)”. The Authority adds that silence in itself is not consent, that “dark patterns” in the interface weigh against the freedom of consent, and that banners and layered notices should be used to highlight the key privacy points (the recommendations at the end of the opinion).

The practical conclusion: a clear notice on entering the site, referring to the cookie chapter in the policy, is the basis for implied consent to cookies serving the site itself; cookies and pixels that feed profiling unrelated to the service – targeted advertising, remarketing – and direct-mailing services require separate active consent, and without it they must not run. Many businesses choose, as a conservative position, to require active consent for both kinds alike; the law does not require this, nor does it require a “cookie wall” that blocks browsing. The Authority’s recommendations for online-shopping sites (updated 8 May 2025) add what the cookie chapter should say: whether the site operates tracking means and for what purpose, whether third-party advertisers track the visitor and how to avoid it, and what is collected in the course of browsing – the IP address and the pages viewed.

7. Newsletter, mailing list and direct mailing – three tiers

Amendment 13 repealed sections 17C and 17G of the Law and moved the definitions to section 3: “direct mailing” is “a personal approach to a person, based on their belonging to a population group determined by one or more characteristics of persons whose names are included in a database”, and “direct-mailing services” are the provision of such services to others by way of transferring lists or data. The Authority’s Guideline 2/2017, republished in an “updated version following Amendment 13”, distinguishes three tiers, each with its own law:

Tier	What it is	The law that applies
A. An ordinary newsletter	A business’s mailing to its own customers and subscribers, segmented at most by data they themselves supplied, without a new profile – not “direct mailing” (Guideline 2/2017, paragraphs 13.1–13.2)	Section 30A of the Communications (Telecommunications and Broadcasting) Law, 5742-1982, only: prior express consent or the existing-customer exception (section 30A(c)), an unsubscribe option (section 30A(d)), the word “advertisement” and the advertiser’s details (section 30A(e)); damages without proof of harm of up to ILS 1,000 per message (section 30A(j))
B. Segmentation that creates a profile	A mailing by a characteristic that did not arise from the person simply being a customer – age, religion, inferred consumption habits; the Guideline’s example (paragraph 14.1): a food chain mailing customers of a given religion before their holiday	In addition: advance notice of the intended use, and a right to demand deletion under section 17F(b) of the Protection of Privacy Law, to be honoured and confirmed in writing (section 17F(d) of the Law). Every direct mailing – the business’s own included – must state that it is direct mailing, the right of deletion and the address for it, and the controller’s identity and the sources from which it obtained the data (section 17F(a) of the Law); under paragraph 19.1.5 of Guideline 2/2017 the Authority will generally not enforce the statement of sources towards active customers. Under the opinion on consent, separate active consent is preferable
C. Transferring the list to others	Providing the list, or using it, for the benefit of others – “direct-mailing services”	Registration of the database for the purpose of direct-mailing services (section 17D of the Protection of Privacy Law), a record of the source of every data set and to whom it was given (section 17E of the Law), the database’s registration number in every mailing – the only element of section 17F(a) of the Law reserved for direct-mailing services (section 17F(a)(1) of the Law), and a privacy protection officer for a database of more than 10,000 persons (section 17B1(a)(2) of the Law)

Section 30A of the Communications Law applies to all three tiers in parallel. On the anti-spam law, the existing-customer exception and the case law.

8. Financial sanctions – the 2026 amounts

Chapter D3 of the Protection of Privacy Law empowers the Authority to impose financial sanctions. The amounts set in section 23כו of the Law, alongside the amounts updated for 2026 (Yalkut HaPirsumim 5787, 654):

Breach	Amount in the Law	As of 2026
Processing in a registrable database that was not registered (section 8A of the Law), or in a database used for direct-mailing services without registration (section 17D of the Law)	ILS 150,000; doubled for a database of 1,000,000 persons or more	ILS 153,540
Failing to give the section 11 notice to a specific person; a direct mailing without the details in section 17F(a) of the Law	ILS 50 per person (ILS 100 for special-sensitivity data), and no less than ILS 30,000	ILS 51.18 / ILS 102.36; no less than ILS 30,710
Failing to give the section 11 notice to an indeterminate group – for example through a link on a website; failing to appoint an officer under section 17B1(a)(1)–(2) of the Law	ILS 2 per person whose data is in the database (ILS 4 for sensitive data), and no less than ILS 20,000 (ILS 40,000)	ILS 2.05 / ILS 4.09; no less than ILS 20,470 (ILS 40,940)
Breach of the rights of access, correction and deletion (sections 13, 14 and 17F(b)–(c) of the Law)	ILS 15,000	ILS 15,350

An example from the Authority’s guide: a breach of section 11 through a website, in a database of 500,000 persons holding sensitive data – a sanction of ILS 2,000,000. The Fifth Schedule to the Law allows a cumulative reduction of up to 70% – including 10% for appointing an officer – and on the infringer’s request the sanction is reduced so as not to exceed 5% of annual turnover. Alongside the sanctions: an instruction to cease a breach (section 23כה of the Law) and damages without proof of harm of up to ILS 10,000 (section 15A of the Law).

9. Beyond the law: a policy people can read

A policy that satisfies every section but cannot be read misses its purpose – and under the opinion on consent, long and inaccessible terms may fail to ground consent at all. Three working rules: plain language – every data type and purpose in words a non-lawyer understands; accessibility – the policy is content on the site, and regulation 35A of the Equal Rights for Persons with Disabilities Regulations (Service Accessibility Adjustments), 5773-2013, applies to it as to any other page; and version control – an update date, retention of earlier versions and of the screens shown to users, and renewed consent when a change is material. The firm’s own privacy policy is built on these rules. On the terms of use, and on the service as a whole – legal documents for a website or app; a site that also serves users in the European Union needs a further layer – an Israeli company and the GDPR.

Frequently asked questions

Is a privacy policy required by law?

The Law does not use the term “privacy policy”. The duty is under section 11 of the Protection of Privacy Law: every request to a person for personal data for processing in a database must be accompanied by a five-item notice. A privacy policy meets this duty only if it is presented at the collection point itself and contains all five items.

Is an IP address or a device identifier “personal data”?

Under section 3 of the Protection of Privacy Law, “personal data” is data relating to an identified person or to a person identifiable “with reasonable effort, directly or indirectly”, including through an “online identifier” or “location data”. An IP address, a device identifier or an identifier stored in a cookie are online identifiers, and the data accumulated against them is personal data.

Does the law require a cookie banner?

Israeli law contains no provision requiring a cookie banner as such. Under the Privacy Protection Authority’s opinion on consent (25 February 2026), continued browsing after the user has been shown the required information will usually count as implied consent, where there is a reasonable link between the collection and the service; profiling unrelated to the service and direct-mailing services require a separate active opt-in. Many businesses choose, as a conservative position, active consent for both kinds.

Is our newsletter “direct mailing”?

Under the Authority’s Guideline 2/2017, in its version updated after Amendment 13 (paragraphs 13.1–13.2), a business’s mailing to its own customers and subscribers, based only on data they themselves supplied and without creating a new profile, is not “direct mailing”, and only section 30A of the Communications (Telecommunications and Broadcasting) Law, 5742-1982, applies to it. Segmentation that creates a new profile makes the mailing direct mailing; transferring the list to others is “direct-mailing services” (section 17D of the Protection of Privacy Law).

What must we do if there is a data breach?

Regulation 11 of the Protection of Privacy Regulations (Data Security), 5777-2017, requires every security incident to be documented. A “serious security incident” is reported “immediately” to the Head of the Privacy Protection Authority (regulation 11(d)). Self-reporting earns a reduction of the sanction under the Fifth Schedule to the Law.

When must an app appoint a privacy protection officer?

When its principal activities require “regular and systematic monitoring of persons … on a significant scale” (section 17B1(a)(3) of the Protection of Privacy Law), or when it processes special-sensitivity data on a significant scale (paragraph (4)). The Authority’s opinion of 14 July 2026 holds that paragraph (3) includes apps and websites that track user activity to build profiles, and that “significant scale” is assessed with no numeric threshold.

The above is general information on Israeli law only, current as of the date of publication, and does not constitute legal advice or a substitute for advice on your specific circumstances. Sanction and damages figures are those set in the legislation and in the authorities’ publications at the date of publication and are updated from time to time. Consult a lawyer before acting.

← All articles