Vietnam’s consent rules for marketing come down to one idea: ask first, make it easy to say no, and keep proof. Three sets of rules apply. The Personal Data Protection Law, in force since 1 January 2026, covers cookies and tracking. Decree 91/2020/ND-CP covers advertising emails, texts and calls. The 2023 consumer protection law requires an opt-out whenever personal data is used for advertising.
What changed this year is enforcement. Decree 330/2026/ND-CP, effective 19 August 2026, attached specific fines to consent failures, and the Vietnam Competition Commission has already sanctioned a company for missing ad opt-outs.
In short
In Vietnam, a cookie banner that loads trackers before the visitor clicks accept is no longer a design choice: it is a finable offence.
Cookies and tracking: consent before anything fires
Consent under the Personal Data Protection Law has to be an active choice. According to One Asia Lawyers' summary of Decree 330, treating silence or inaction as consent can cost an organisation up to VND 70 million. Behavioural tracking without consent, cookie failures and missing opt-out mechanisms are fined at VND 50 to 70 million.
This matters more than it sounds. DLA Piper notes that data tracking online behaviour through telecoms services, social networks and online communication services counts as sensitive personal data under the law. A "by continuing to browse you accept" banner does not meet that standard. Strictly necessary cookies, such as a login session or shopping cart, do not need consent.
The practical fix is a consent management platform that blocks analytics and ad tags until the visitor clicks accept, then records that choice. Most popular WordPress consent plugins can do this once they are configured properly.
Email, SMS and calls: the Decree 91 rules
Decree 91/2020/ND-CP is Vietnam's anti-spam regulation, and it is stricter than many foreign marketers expect. DLA Piper summarises the main requirements:
- You need the recipient's agreement before sending advertising. The rules allow one initial message asking whether the person wants to receive advertising from you.
- Every advertising message must identify the advertiser, include an opt-out, and carry a "QC" or "ADV" label.
- No more than three advertising messages, three advertising emails or one advertising call per person per day.
- Advertising messages may only be sent between 7 a.m. and 10 p.m., and advertising calls between 8 a.m. and 5 p.m.
- Once someone opts out, you must stop sending them advertising.
These rules sit on top of the Personal Data Protection Law, not instead of it. A phone number or email address is personal data, so your sign-up form still needs clear consent and a privacy notice behind it.
Ad audiences: the opt-out that gets companies fined
The 2023 Law on Protection of Consumer Rights requires businesses to give consumers a way to allow or refuse the use of their personal information for advertising. According to an HLC briefing from July 2026, the Vietnam Competition Commission announced sanctions against a foreign-invested company on 2 June 2026, and failing to provide that opt-out was one of the three violations.
For small businesses, the risk is uploading a customer list to Meta or Google Ads as a custom audience. Only upload people who agreed to advertising, and make sure anyone who opts out is taken off those lists as well as your email list.
Frequently asked questions
Do I need a cookie banner if I only use Google Analytics?
Yes. Analytics tracks behaviour, so it needs consent before it loads. Only strictly necessary cookies are exempt.
Does the QC label rule apply to English-language emails?
Decree 91 requires a QC or ADV label on advertising messages, and ADV works for English content. Using it on every promotional send to Vietnamese recipients is the safe default.
I collected my email list under the old rules. Do I have to start again?
Not necessarily. Tilleke & Gibbins notes that consent validly obtained before 1 January 2026 can continue without collecting it again. Lists with no record of consent are the problem.
Sources
- One Asia Lawyers, "Vietnam: Decree No. 330/2026/ND-CP, Personal Data Protection Enters Its Enforcement Era", accessed September 2026.
- DLA Piper, Data Protection Laws of the World, "Electronic marketing in Vietnam", accessed September 2026.
- HLC, "Heightened enforcement of consumer protection laws in Vietnam: digital platforms and influencer marketing in focus", 13 July 2026.
- Tilleke & Gibbins, "Vietnam's New Personal Data Protection Law: A Closer Look", accessed September 2026.
Related guides in this series
- Vietnam's new data protection fines: what marketers must fix now
- Vietnam's 2026 advertising rules: an influencer and online ad checklist
- Measuring your search visibility in 2026, a quick guide
This article is general information for marketers, not legal advice. For decisions with real legal exposure, check with a Vietnam-qualified lawyer.
Not sure your cookie banner or email setup would pass?
I can audit your consent flow, tags and email lists and give you a prioritised fix list for the Vietnamese market. Book a free consultation →
Published: September 2026 | Author: Minh Pham
Leave a Reply
You must be logged in to post a comment.