Aratohu · Guide
Te Ture Tūmataiti 2020 me te aroturuki paetukutukuPrivacy Act 2020 and website tracking: what NZ businesses need to know
New Zealand has no cookie law, but the privacy principles still apply whenever your website collects information about people you can identify.
He whakautu poto / Short answer: New Zealand has no cookie-specific law. If your analytics, advertising pixels or forms collect information about identifiable people, the Privacy Act 2020 applies: collect only what you need for a lawful purpose (IPP 1), tell people what you collect and why (IPP 3), collect fairly (IPP 4), keep it secure (IPP 5), and take care when disclosing it, especially overseas (IPP 11 and 12).
Updated 25 September 2026 · 7 min read
This guide explains how the Privacy Act 2020 applies to website tracking for New Zealand businesses. Website tracking is any tool that records what visitors do on your site: analytics, advertising pixels, heatmaps, chat widgets and the forms people fill in. It is general information, not legal advice.
Te tureIs there a cookie law in New Zealand?
No. The UK and EU have specific rules about storing cookies on a device. New Zealand does not. Instead, the Privacy Act 2020 sets out information privacy principles (IPPs) - rules about collecting, storing, using and sharing personal information - and they apply the same way whether data arrives through a cookie, a form or a phone call.
Separately, the Unsolicited Electronic Messages Act 2007 governs commercial email and text messages. If your website signs people up for marketing, that Act's consent and unsubscribe rules apply too.
Ngā raraungaWhen does tracking data count as personal information?
Personal information is information about an identifiable individual. Aggregate page-view counts usually are not. A persistent visitor ID tied to a form submission, an email address or a logged-in account usually is. The more you join tracking data to a real person - in a CRM, an email list or an advertising audience - the more clearly the principles apply.
Ngā mātāpono tūmataitiWhich privacy principles apply to website tracking?
| Principle | What it says | What it means for your website |
|---|---|---|
| IPP 1 - purpose | Collect personal information only for a lawful purpose connected with what you do, and only if it is necessary. | Every tracking tool should have a reason. Unused tools are unnecessary collection. |
| IPP 2 - source | Collect it from the person themselves, unless an exception applies. | Forms and first-party analytics collect directly. Bought or appended data needs more thought. |
| IPP 3 - notice | Take reasonable steps to tell people what you collect, why, who will receive it, and their rights of access and correction. | A clear, current privacy statement linked from every form and from the footer. |
| IPP 3A - indirect collection | Added by the Privacy Amendment Act 2025 and in force from 1 May 2026: tell people when you collect their information from someone else, subject to exceptions. | Relevant if you receive leads or audience data from partners or platforms. Check the Commissioner's guidance. |
| IPP 4 - manner | Collect lawfully, fairly and without unreasonable intrusion, taking particular care with children and young people. | Hidden or surprising tracking is hard to call fair. Offering a choice helps. |
| IPP 5 - security | Protect information against loss, unauthorised access, use, modification or disclosure. | Strong logins, limited access, and vendors who can explain their security. |
| IPP 6 and 7 - access and correction | People can ask to see and correct information about them. | You need to be able to find a person's records across your tools. |
| IPP 9 - retention | Do not keep information longer than you need it. | Set retention periods for enquiries and tracking data. |
| IPP 10 - use | Use information only for the purpose you collected it for, unless an exception applies. | Reusing enquiry data to build ad audiences is a new use - tell people first. |
| IPP 11 - disclosure | Do not disclose personal information unless an exception applies, such as the disclosure being one of the purposes you collected it for. | Sharing visitor data with an ad platform for its own use is a disclosure people should have been told about. |
| IPP 12 - overseas disclosure | Disclose to an overseas recipient only on one of the listed grounds, such as comparable protection or the person's informed authorisation. | Most ad and analytics platforms are based overseas. See the next section. |
IPP 8 (check accuracy before use) and IPP 13 (unique identifiers - relevant to persistent visitor IDs) also apply; see the Commissioner's guidance.
Ki tāwāhiWhat about sending tracking data to platforms overseas?
It depends on what the overseas provider does with it. If a provider only stores or processes information on your behalf and does not use it for its own purposes - a typical hosting or email service - section 11 of the Act generally treats the information as still held by you. That is not a disclosure, but you stay responsible for it under IPP 5.
If the recipient uses the data for its own purposes - for example, an advertising platform that uses it to build or improve its own services - that is a disclosure. IPP 11 and IPP 12 apply. Under IPP 12 you must rely on one of the listed grounds, for example reasonably believing the recipient will protect the information in a way comparable to the Act (shown through contract terms such as the model clauses the Commissioner publishes), or the person's authorisation after telling them it may not be protected to that standard. Our guide to where your website and CRM data lives covers the questions to ask.
Te Mana Mātāpono MatatapuWhat does the Privacy Commissioner do?
The Office of the Privacy Commissioner - Te Mana Mātāpono Matatapu - is the independent regulator. It publishes guidance on each principle, handles complaints from the public, receives notifications of serious privacy breaches, and can issue compliance notices requiring an organisation to do something or stop doing something. Unresolved complaints can go to the Human Rights Review Tribunal, which can award damages. Certain offences, such as failing to notify a notifiable breach, carry fines of up to $10,000.
Me pēhea te arotake?How do you review your website tracking under the Privacy Act?
List every tool that collects data
Write down each analytics tool, advertising pixel, chat widget, embedded video and form on your site, what it collects and which organisation receives it.
Check each one has a purpose
For each tool, note the lawful purpose it serves (IPP 1). If nobody uses the data, remove the tool rather than collecting information you do not need.
Update your privacy statement
Explain in plain words what you collect, why, who receives it (including overseas providers) and how people can ask to see or correct their information (IPP 3).
Give visitors a real choice
The Act does not require a cookie banner, but letting people decline non-essential tracking is a straightforward way to keep collection fair and expected (IPP 4).
Check where the data goes
Find out which providers are overseas and whether they act only on your behalf or use the data for their own purposes. The second case brings in IPP 11 and IPP 12.
Secure it and set retention
Limit who can log in, turn on two-factor sign-in, and decide how long you keep tracking and enquiry data (IPP 5 and IPP 9).
Get professional advice
If you run advertising audiences, collect sensitive information or deal with children, talk to a privacy lawyer or adviser about your particular setup.
Te wāhi o uForgeWhere does uForge fit?
uForge is not available in New Zealand yet. In the markets where it is open, its first-party tracking and attribution, Sadang, records each visitor's consent choice, and without analytics consent it does not identify the visitor and records only anonymous session-level activity. Tools like this can support your privacy obligations, but how you configure and use them is what matters. For the broader idea, read what first-party data is, or browse all New Zealand guides.
Register your interest in uForge Aotearoa and we will tell you when it opens in New Zealand, and where New Zealand data will be hosted.