For a website aimed at New Zealand customers, no law requires a cookie banner. The Privacy Act 2020 does not mention cookies at all. What it requires is openness: if your site collects personal information, you must tell people what you collect, why, and who receives it, which is the job of a clear privacy statement. A short cookie notice that links to that statement is one reasonable way to give the notice, but it is a choice, not a legal requirement. A consent banner becomes a real requirement when you target customers in the European Union, because EU rules require consent before advertising and tracking cookies are set, and Google applies its own consent policy to visitors from the EEA, the UK and Switzerland. This is general information, not legal advice. If your business handles sensitive data or sells into Europe, talk to a lawyer.
Does New Zealand law require a cookie banner?
No. We checked the full text of the Privacy Act 2020, in the version as at 1 May 2026, and the word "cookie" does not appear in it. New Zealand has no equivalent of the European rule that made cookie pop-ups a fixture of the internet. The pop-ups you click through every day exist because of European law, and many websites show them to every visitor regardless of country.
That does not mean the Privacy Act has nothing to say about what your website does. It regulates personal information, however it is collected, and cookies are one of the ways a website collects it.
What does the Privacy Act require from a website?
The Act is built on information privacy principles. Three matter for an ordinary business website:
- Collect only what you need. The Privacy Commissioner's summary of principle 1 says organisations "must only collect personal information if it is for a lawful purpose connected with their functions or activities, and the information is necessary for that purpose." A contact form that demands a date of birth to book a lawn mowing quote fails this test.
- Tell people what you are doing. Principle 3 says that when you collect information from someone, you should make sure they know why it is being collected, who will receive it, whether giving it is compulsory or optional, and what happens if they do not. This should happen before collection, or as soon as practicable afterwards.
- Put it in a privacy statement. The Commissioner's guidance describes a privacy statement as one that "sets out what personal information a company, service provider, or other agency collects and what it will use it for." A plain-language statement linked from every page is the usual starting point. Whether that alone is enough depends on what your site collects, which the next section covers.
Notice what is missing: nothing here says "obtain consent before setting a cookie". The New Zealand approach is transparency about collection, not a permission click before every visit.
Does principle 3 mean I need a cookie notice?
It means you need to give notice. It does not say how. The wording in the Act is that an agency "must take any steps that are, in the circumstances, reasonable to ensure that the individual concerned is aware of" the collection, its purpose and the intended recipients, and that those steps "must be taken before the information is collected or, if that is not practicable, as soon as practicable after the information is collected." The Act does not prescribe a format, and we could not find Privacy Commissioner guidance that says a website must use a banner.
You will often read that a cookie banner is "the most practical way" to meet this duty. That line mostly comes from companies that sell consent tools, and it is an opinion, not the law. There is a fair point inside it, though. Analytics and advertising cookies start working the moment a page loads, before anyone has scrolled to a footer link. If those cookies collect personal information, a short notice that appears on the first visit, says the site uses analytics and advertising cookies, and links to the privacy statement is a simple way to show you took reasonable steps at the right time. The more tracking a site does, the stronger that argument gets. A brochure site with basic analytics is at one end. A site running advertising and remarketing tags that follow visitors around the web is at the other.
So it helps to separate two things that look alike on screen:
- A notice tells visitors what the site does and where to read more. Nothing is blocked. This is a reasonable, optional way to meet the New Zealand duty to be open.
- A consent banner asks permission and holds non-essential cookies back until the visitor agrees. This is what European rules require, and New Zealand law does not.
Are cookies personal information?
Sometimes. The Act covers information about an identifiable individual. The Privacy Commissioner was asked the closest available question, whether IP addresses are personal information, and the answer begins "It depends." An IP address on its own "is unlikely to be personal information but it could be when combined with other information or when used to build a profile of an individual, even if that individual's name is unknown." The Commissioner adds that "it's good privacy practice to treat an IP address as if it is personal information".
The same reasoning applies to cookies. A cookie that remembers a shopping cart identifies nobody. An advertising cookie that follows one person across sites to build a profile is much closer to the line, and so is any analytics data you connect to a named customer record. The safe working rule for a small business: if your site runs analytics or advertising tags, act as though the Privacy Act applies and disclose them.
How does the Privacy Commissioner handle cookies on its own website?
The regulator's own site is a useful model. Its cookie policy explains in a few short paragraphs that it uses cookies "where they are required for particular features to work", that it uses tracking cookies with the Matomo analytics tool "to analyse non-identifiable web traffic data to improve our services", that "you can opt out of the Matomo tracking cookies we use without affecting your ability to use our site", and that its analytics respects a browser's "do not track" setting. That is the whole approach: say what you use, say why, and give people a way out.
When does an NZ website need a consent banner anyway?
When another country's law reaches you. For most NZ businesses that means Europe.
If you target customers in the EU. The European Commission explains that the GDPR applies to "a company established outside the EU" that "is offering goods/services (paid or for free) or is monitoring the behaviour of individuals in the EU." The test is targeting, not the occasional visitor: "Provided your company doesn't specifically target its services at individuals in the EU, it is not subject to the rules of the GDPR." A Rotorua plumber who gets a stray visit from Germany is not targeting the EU. A Queenstown tour operator with German-language pages and prices in euros probably is, and so is an exporter or software company selling to European buyers.
If EU cookie rules apply to you, consent comes first. The EU's official business portal, Your Europe, says consent is needed before placing cookies such as "social plug-in tracking cookies" and "third party cookies used for behavioural advertising", while cookies that are strictly necessary to provide a service the person asked for are exempt. It also requires that withdrawing consent is "as easy" as giving it. This is where a proper consent banner comes from.
If you use Google's advertising or analytics products with European visitors. Google's EU user consent policy applies to "end users in the European Economic Area, the UK and Switzerland" and requires sites using its products to obtain consent for "the use of cookies or other local storage where legally required" and for "the collection, sharing, and use of personal data for personalization of ads." This is a contract condition from Google, separate from the law, and it is the reason consent tools matter to any NZ business running Google Ads at European audiences.
Other countries have their own rules, and we have not reviewed them all. If a meaningful share of your customers are overseas, get advice for those markets specifically.
What changed on 1 May 2026?
A new principle, IPP 3A, came into force. The Privacy Commissioner's IPP 3A page states that the rule "came into force on 1 May 2026". It covers indirect collection: when you collect someone's personal information from a source other than the person themselves, you must take reasonable steps to make sure they know it has been collected, the purpose, the intended recipients, your name and address, and their rights to access and correct it, "as soon as reasonably practicable after the information has been collected."
For a typical small business website, this is a smaller change than the headlines suggested. A contact form collects information directly from the person, which principle 3 already covered. IPP 3A is aimed at situations such as buying a marketing list, receiving customer details from a referral partner, or using a tool that adds information about your leads from third-party sources. There are exceptions, including where the person has already been made aware and where the information is publicly available. If any of those situations describe your business, update your privacy statement to name the sources you collect from and read the Commissioner's guidance. IPP 3A did not introduce a cookie banner requirement.
What should an NZ-only website do, with or without a notice?
- Publish a privacy statement that names your tools. Say that you use cookies, which analytics and advertising services set them (for example Google Analytics or the Meta pixel), what they are for, and that those companies receive the data.
- Give people a way out. Link to browser cookie settings and to Google's Analytics opt-out add-on if you use Google Analytics.
- Remove tags you do not use. Old tracking pixels from a campaign that ended two years ago are collection without a purpose, which is the opposite of principle 1. They also slow the site down.
- Collect less in your forms. Name, contact detail and the question are usually enough for a first enquiry.
- Use the free generator. The Privacy Commissioner's Priv-o-matic tool builds a privacy statement from your answers. Our content checklist explains where it fits in a website build.
Is a cookie banner ever a bad idea?
A banner that does nothing is worse than no banner. A common pattern is a strip that says "This site uses cookies" with a single OK button, while the tracking cookies load regardless of what the visitor does. An honest notice is fine, as the section above explains. The problem is a strip dressed up as a choice. For European purposes it fails, because the EU standard is consent before the cookies are placed and a real way to refuse. And for your visitors it is one more thing to dismiss on a small screen before they can see your phone number. If you show people a choice, the site has to honour it: non-essential tags must wait until the visitor agrees.
What do we do on our own site?
Our website is aimed at New Zealand businesses and does not show a cookie banner. It uses Google Analytics and Google Ads measurement cookies, and section 4 of our privacy policy lists the types of cookies we use, what they are for, and how to opt out. We rely on that statement and do not currently show a first-visit notice.
One more disclosure. Our free website audit checks for a consent mechanism and reports it as missing when it cannot find one, because the audit measures sites against the stricter European standard. If your customers are all in New Zealand, read that finding as a prompt to check who your visitors are and whether your privacy statement covers your tracking tools, not as proof that you are breaking NZ law.
Do this today
- Open your site in a private window and note every pop-up a new visitor has to dismiss
- List the tracking tools installed on your site, and remove any you no longer use
- Check your privacy statement names those tools, why you use them and who receives the data
- Look at the countries report in Google Analytics: is a real share of your audience in Europe, and do you market to them?
- If you buy lists or receive leads from partners, read the IPP 3A guidance and update your statement
Where we come in
A privacy page is part of the build on every plan, written for the tools the site actually uses, and we would rather install two tracking tags you look at than six you do not. If you sell into Europe, we can set up a consent tool that holds non-essential tags until the visitor agrees, with Google's consent settings configured to match. If you are not sure which camp you are in, run the free audit, look at where your visitors come from, and ask us. We will tell you if the answer is "you do not need one".
Frequently Asked Questions
Is a cookie banner legally required in New Zealand?
No. The Privacy Act 2020 does not mention cookies and contains no requirement to obtain consent before setting them. It requires organisations to be open about the personal information they collect, why they collect it and who receives it, which a website normally does through a clear privacy statement. The Act asks for reasonable steps to make people aware and does not prescribe a format, so a short cookie notice linking to that statement is an optional way to give the notice, not a legal requirement. A consent banner becomes necessary when overseas rules apply, most commonly when a business targets customers in the European Union.
Are cookies personal information under NZ law?
It depends on the cookie. The Privacy Act covers information about an identifiable individual. The Privacy Commissioner says an IP address alone is unlikely to be personal information but can be when combined with other information or used to build a profile of an individual, and recommends treating it as personal information as good practice. Analytics and advertising cookies that build profiles should be treated the same way.
When does an NZ website need cookie consent?
When it targets people in places that require it. The European Commission says the GDPR applies to a company outside the EU that offers goods or services to, or monitors the behaviour of, individuals in the EU. EU rules require consent before advertising and tracking cookies are placed. Google also requires sites using its advertising and analytics products to obtain consent from users in the European Economic Area, the UK and Switzerland.
What should my privacy policy say about cookies?
It should say that the site uses cookies, name the analytics and advertising services that set them, explain what they are used for, state that those providers receive the data, and tell visitors how to opt out through browser settings or tools such as Google's Analytics opt-out add-on. The Privacy Commissioner's free Priv-o-matic tool generates a privacy statement from a short set of questions.
What is IPP 3A and does it affect my website?
IPP 3A is a new information privacy principle that came into force on 1 May 2026. It requires an organisation that collects personal information from a source other than the person concerned to take reasonable steps to tell that person, unless an exception applies. A contact form collects directly from the person, so IPP 3A mainly affects businesses that buy lists, receive leads from partners or enrich customer data from third-party sources. It does not require a cookie banner.
The bottom line
New Zealand law asks your website to be honest about what it collects, not to interrupt every visitor with a pop-up. If your customers are here, a plain-language privacy statement that names your tracking tools does the job. If you actively sell into Europe, you need a consent banner that works properly, meaning nothing non-essential loads until the visitor says yes. Work out which business you are, and build for that.