{"id":25139,"date":"2026-08-05T08:00:00","date_gmt":"2026-08-05T01:00:00","guid":{"rendered":"https:\/\/fpt-is.com\/en\/?post_type=goc_nhin_so&p=25139"},"modified":"2026-08-07T14:48:36","modified_gmt":"2026-08-07T07:48:36","slug":"cookie-banners-for-show-and-four-common-misconceptions-that-make-businesses-think-they-comply-with-the-pdpl","status":"publish","type":"goc_nhin_so","link":"https:\/\/fpt-is.com\/en\/insights\/cookie-banners-for-show-and-four-common-misconceptions-that-make-businesses-think-they-comply-with-the-pdpl\/","title":{"rendered":"Cookie banners “for show” and four common misconceptions that make businesses think they comply with the PDPL"},"content":{"rendered":"

Today, most business websites already display a cookie banner. This is a positive sign\u2014it shows that awareness of personal data protection is growing among businesses in Vietnam.<\/span><\/p>\n

What is worth noting, however, is that having a cookie banner and having a legally compliant cookie banner are two different things. The gap between the two often comes down to a few specific design choices\u2014not intentional mistakes, but simply a lack of complete information about what the law actually requires.<\/span><\/p>\n

Below are the four most common misconceptions, along with practical ways to address each one.<\/span><\/p>\n

Misconception 1: “As long as we have a cookie banner, we don’t need to separate processing purposes”<\/b><\/span><\/h2>\n

Many cookie banners operate in the simplest way possible: they appear, the user clicks “Accept,” and that’s it. There is no breakdown of purposes, no options to choose from, and no explanation of what the user is actually consenting to.<\/span><\/p>\n

This is not how the PDPL defines valid consent.<\/span><\/p>\n

Why is this a problem? <\/b>The law requires consent to be specific to each purpose of data processing. Cookies used to analyze browsing behavior serve one purpose. Cookies used for personalized advertising serve another. Cookies that share behavioral data with third-party platforms represent yet another purpose. Users have the right to consent to one purpose while refusing another.<\/span><\/span><\/p>\n

A single “Accept” button that bundles everything together is not valid consent – it is simply a button.<\/span><\/p>\n

What good compliance looks like<\/b>: The cookie banner includes a “Customize” or “Manage Preferences” option, allowing users to enable or disable each category of cookies separately, such as essential cookies (which do not require consent), analytics cookies, marketing cookies, and third-party cookies. Each category includes a brief explanation of its purpose and the types of data it collects.<\/span><\/span><\/p>\n

Misconception 2: “If users close the banner or do nothing, that means they consent”<\/b><\/span><\/h2>\n

This is one of the most common misconceptions and also one of the hardest to notice because, from the user’s perspective, nothing appears unusual.<\/span><\/p>\n

In practice, the banner appears, the user clicks the “X” to close it or simply scrolls down the page without interacting with it. The system records this as consent and immediately activates all cookies.<\/span><\/p>\n

Under Law No. 91\/2025\/QH15, <\/span>silence, inaction, or continued use of a service does not constitute consent<\/b>. This requirement is explicitly stated in the law, leaving no room for interpretation.<\/span><\/span><\/p>\n

This means that if your system treats every user who closes the banner as having given consent and then activates marketing cookies accordingly, the data collected through those cookies is based on invalid consent.<\/span><\/p>\n

What good compliance looks like<\/b>: Non-essential cookies are activated only after the user takes a clear affirmative action, such as clicking “Accept All” or selecting specific cookie categories in the preference settings. No non-essential cookies should be activated simply because the user closes the banner, scrolls down the page, or continues browsing. Instead, the system should record that consent has not yet been given and display the banner again during a future visit.<\/span><\/span><\/p>\n

Misconception 3: “Once users give consent, it lasts forever”<\/b><\/span><\/h2>\n

A user clicks “Accept” in January. In June, you add a new advertising partner to receive customer data or expand your data processing to support a new feature. The user is never asked for consent again.<\/span><\/p>\n

This is one of the most common operational mistakes – and also one of the hardest to detect because, from the user’s perspective, nothing appears to have changed.<\/span><\/p>\n

Why is this a problem?<\/b> Consent is only valid for the purposes described at the time it is given. If the purpose of processing changes – for example, you add a new partner, introduce a new feature, or expand the scope of data processing – you must update your privacy notice and obtain fresh consent for those changes.<\/span><\/span><\/p>\n

In addition, users must be able to withdraw their consent at any time, and withdrawing consent should be just as easy as giving it. If giving consent takes two seconds but withdrawing it requires sending an email to customer support and waiting three days for a response, the design does not comply with the law.<\/span><\/p>\n

What good compliance looks like<\/b>: Users can access a “Cookie Preferences” page at any time – not just during their first visit to the website. Whenever there is a significant change to the privacy policy or the list of third-party partners, the cookie banner is displayed again to request updated consent instead of silently applying the changes to existing consent records.<\/span><\/span><\/p>\n

Misconception 4: “A cookie banner only needs to look good – it doesn’t need to keep records”<\/b><\/span><\/h2>\n

This is an area that IT teams are often aware of, but marketing teams tend to overlook: a cookie banner needs a <\/span>backend<\/b>, not just a frontend.<\/span><\/span><\/p>\n

Specifically, every time a user interacts with the banner – whether they accept, reject, or customize their preferences – the system should record:<\/span><\/p>\n