Cookie banners and visitor consent: Vietnamese law, the EU and how to build it

A cookie banner is often treated as last-minute decoration, yet it decides which tracking tags run before the visitor chooses. A Vietnamese website faces 2 extra questions: what domestic law requires, and what applies to EU visitors.

This article draws on Vietnam's Personal Data Protection Law 91/2025/QH15 and Decree 356/2025/NĐ-CP (read through copies), EU cookie guidance and Google's Consent Mode documentation, checked through October 22, 2026. It is not legal advice.

It asks whether Vietnamese law has a cookie provision, what the EU expects of a banner, what Consent Mode v2 does on refusal, and how to build and test it. Click Star builds websites and tracking, so it has an interest.

Key points

• Law 91/2025/QH15 does not mention "banners", but Article 9 sets rules that apply to them: consent must be voluntary, clear and per purpose, and silence is not consent.
• The word "cookies" appears only in Article 29(3) of Law 91, for social networks and online communication services. Click Star found no guidance for ordinary websites, so applying it here is inference. Article 28(8) covers any organization using data for behavioral advertising.
• Decree 356, Article 6, bans default-on consent, requires consent to be stored and puts the burden of proof on the data controller.
• For EU visitors, the EDPB says pre-ticked boxes are invalid, scrolling is not consent and a "cookie wall" gives no genuine choice.
• Consent Mode v2 has 4 main parameters. The "denied" default must come before any Google tag, and the tool does not create compliance by itself.
• DevTools test: in basic mode, before any click, the Application tab shows no advertising cookies and the Network tab no tracking requests.

What kinds of cookies and tracking technologies exist

Per Opinion 04/2012 of the Article 29 Working Party (EU, adopted June 7, 2012), the consent rule covers any information stored on or read from a user's device, not only cookies. Click Star groups practice into 3 classes: necessary, statistics, advertising (a Click Star framework).

The opinion lists cookies that can be exempt if truly needed: user-input sessions (shopping carts), authentication, security and load balancing. Third-party advertising cookies are not exempt. First-party statistics cookies are not exempt either, though the working party rates their risk as limited with safeguards.

Google Consent Mode (updated July 30, 2026) has 7 consent types, 5 of them related to storage, such as ad_storage and security_storage.

What Vietnamese law says about consent

Law 91/2025/QH15 was promulgated on June 26, 2025 and takes effect on January 1, 2026, per the Official Gazette page and Article 38(1). Click Star read the full text via a ketoananpha.vn copy, so check the original.

Article 9: consent is valid only if voluntary and the user knows the data types, purposes, controller, rights and obligations (clause 2). It must be clear and printable or copyable, including electronic or verifiable formats (clause 3).

Clause 4 sets 4 principles: consent per purpose; no forced consent to other purposes; validity until the user changes it or the law says otherwise; silence or no response is not consent. Article 11(1) requires consent before collection, unless the law provides otherwise.

Article 10 allows withdrawal of consent, requested in writing (electronic form included), without affecting earlier processing.

On cookies, Article 29(3) requires social network and online communication providers to offer a choice to refuse collecting and sharing cookies.

Article 28(8) covers any organization using data for behavioral, targeted or personalized advertising, not only advertising businesses: tracking websites or apps to collect data needs consent, plus a way to refuse sharing.

Under Decree 356/2025/NĐ-CP (issued December 31, 2025, effective January 1, 2026; read via a luatvietnam.vn copy), Article 6 requires verifiable consent methods, including a website with a technical setup for requesting consent.

Article 6 also requires storing consent, makes the controller prove it in a dispute, and bans default-on consent or instructions blurring consent and refusal.

Article 5(2) requires a reply to a withdrawal request within 2 working days and action within 15 days (20 days if a processor or third party must be told to stop), extendable 1 time by up to 15 days with reasons given.

Article 4(1)(l) of the Decree lists as sensitive data behavior tracking data and data on the use of telecom, social network, online media and other cyberspace services (paraphrased from a transcribed copy); no guidance says whether an ordinary website's cookies fall in this group.

In the copy read, Click Star found no "cookie" in the Decree, and Articles 3 and 4 do not list IP addresses or online identifiers.

Article 8(5) of Law 91 caps fines for organizations at 3 billion VND for ordinary violations. Per-conduct fines sit in Decree 330/2026/NĐ-CP; see What is not known.

Visitors from the EU: GDPR and ePrivacy

Under Article 3(2) GDPR (read via gdpr-info.eu), the rules reach controllers outside the EU when processing relates to offering goods or services to people in the EU or monitoring their behavior there. Whether a Vietnamese site is in scope needs a lawyer.

Article 4(11) defines consent as a freely given, specific, informed and unambiguous indication, by a statement or clear affirmative action. Recital 32 says silence, pre-ticked boxes or inactivity are not consent. Article 7(3) makes withdrawal as easy as giving consent.

EDPB Guidelines 05/2020 (May 4, 2020) state: access conditioned on clicking "accept cookies" is not freely given consent (paragraphs 39 to 41); pre-ticked boxes are invalid and merely continuing to use a service is not consent (paragraph 79); scrolling never suffices as an affirmative act (paragraph 86).

The Cookie Banner Taskforce report (EDPB, adopted January 17, 2023) records that most authorities see a missing first-layer reject button as an infringement, a few disagree; easy withdrawal is expected.

CNIL (France, consolidated version of January 16, 2026) recommends a reject button on the same screen and in the same format as accept. It treats keeping choices about 6 months as good practice. Article 83(5) GDPR allows fines up to 20 million EUR or 4% of worldwide turnover, whichever is higher.

Placing cookies also falls under Article 5(3) of the ePrivacy Directive 2002/58/EC; sanctions are set by each country's law.

Vietnam and the EU: where they match and differ

They match on 3 points: silence is not consent, no default-on consent, withdrawal must be possible. They differ in detail: the EU has cookie-specific guidance on refusal buttons, while the Vietnamese texts read have none for ordinary websites.

Google Consent Mode v2: code order and behavior on refusal

According to Google's guide (updated October 13, 2026), Consent Mode moved to v2 in November 2023, adding ad_user_data and ad_personalization to ad_storage and analytics_storage. The default command must run on every page, before any command that sends measurement data.

Basic mode blocks Google tags until the user interacts with the banner, so nothing reaches Google on refusal. Advanced mode loads tags at once with "denied" defaults, sends cookieless pings and models gaps (Google, July 30, 2026 update).

When analytics_storage is denied, the tag neither reads nor writes analytics cookies. When ad_storage is denied, it writes no new advertising cookies. Google notes that Consent Mode does not save the choice, so the site must store it and call the update command on later pages.

Technical approach: block first, keep proof, allow withdrawal

Principle: tags needing consent run only after a choice. For Google, set the "denied" default before the tags; for other tags (ad pixels, chat, maps), load through a tag manager and trigger by consent state.

Proof of consent: Decree 356 Article 6 requires storage, and CNIL suggests timestamped screenshots per banner version. Click Star reference framework: store time, banner version, per-purpose choices and a pseudonymous ID, without extra identifying data.

Withdrawal: keep a "Manage cookies" link or icon always reachable. After withdrawal, call the update command and stop reading and writing those cookies.

Testing with DevTools

Per Chrome DevTools documentation (updated December 5, 2023), Application > Storage > Cookies lists each cookie's name, domain, expiry and flags, with a clear-all button.

Click Star's framework: clear cookies, reload, click nothing, note cookies and requests. Repeat after refusing, consenting and withdrawing. For Google, the gcs and gcd parameters in requests show the consent state, and Tag Assistant shows the defaults.

Click Star's view. A banner should be the gate for the whole tag stack, not an interface element. If tags run first and the banner follows, even correct wording leaves no consent before collection.

A business can do the list below in-house, without outside help.

7-day plan (a Click Star reference framework)

• Day 1: list every cookie and tag running, using DevTools and the tag manager.
• Day 2: classify by purpose and decide which groups need consent.
• Day 3: design a banner with 2 equal buttons and per-purpose choices, none pre-ticked.
• Day 4: block tags before consent and set Consent Mode "denied" defaults before Google tags.
• Day 5: store proof of consent and build the manage and withdraw link.
• Day 6: retest with DevTools in 4 states: not chosen, refused, consented, withdrawn.
• Day 7: update the privacy policy, set the next review date, have a lawyer look.

Common mistakes

1. The banner appears but GA and the Pixel loaded before the choice.
2. A prominent accept button, while refusing is a small link or sits behind several steps.
3. Pre-ticked boxes, or treating scrolling and continued browsing as consent.
4. Keeping no proof, or missing the banner version and timestamp.
5. Withdrawing is harder than consenting, or tags still run after withdrawal.
6. Remembering choices for the wrong period: asking on every page, or never refreshing. The EDPB says the GDPR sets no fixed limit, CNIL suggests about 6 months, and Law 91 Article 9(4)(c) keeps consent valid until the user changes it.

What is not known

• Whether Law 91 and Decree 356 have a cookie provision for ordinary websites: none found. "Cookies" appears only in Article 29(3) of Law 91, for social networks and online communication services.
• Whether cookie IDs and IP addresses are personal data under Law 91: no specific guidance found.
• Whether necessary cookies fall under Article 19's no-consent cases: not found.
• Decree 330/2026/NĐ-CP (August 19, 2026), read via an English translation (english.luatvietnam.vn) and a Việt An law firm summary, not checked against the Gazette. Article 43 fines 30 to 50 million VND for default-on consent and 50 to 70 million VND for treating silence as consent.
• Article 65 of Decree 330 fines 50 to 70 million VND, but only social network, online media and digital content providers that do not allow refusing cookies; it does not target ordinary websites.
• Article 63 of Decree 330, per one English translation, not checked against the Vietnamese text: fines 50 to 70 million VND for collecting data by tracking websites or apps for behavioral advertising without consent.
• No measurement of Vietnamese websites penalized over cookies or of visitor consent rates.
• The Digital Omnibus proposal (European Commission, November 19, 2025) could change EU cookie rules; per news site PPC Land (September 13, 2026), it is not adopted. Click Star has not read the original on EUR-Lex.