Cookie Consent in Singapore: Do You Need a Banner?

There is no simple yes or no that fits every site. In Singapore, the PDPA focuses on how organisations collect, use and disclose personal data, and cookies matter when they are used to collect it. Whether you need a banner depends on what your site actually does, so start by finding out, then check the current guidance at the PDPC.

What cookies actually are

A cookie is a small file your browser stores for a site. Some are needed for the site to work, like keeping a shopping cart. Others measure visits, remember preferences or help advertisers recognise people across sites.

Cookies are one of several tools, along with tracking pixels, scripts and local storage, that can identify or follow a visitor. The legal question is rarely about the cookie itself. It is about whether personal data is involved and how you handle it.

How the PDPA looks at this

The PDPA, which the PDPC administers, sets out obligations about personal data. In plain terms, organisations are expected to tell people why they collect data, get appropriate consent where needed, use the data only for stated purposes, protect it, and let people ask about it.

Consent

Consent generally means the person knows what they are agreeing to. A hidden tick box or a vague "by using this site" line may not be enough where you need real consent.

Notification

Notification means telling visitors what you collect and why. This is where a clear, readable privacy notice does most of the work for a small site.

Purpose and retention

Collect what you need, use it for the reason you gave, and do not keep it forever. An enquiry from three years ago does not need to sit in a spreadsheet.

If you collect names and numbers through forms and chat, read PDPA for website owners and PDPA and WhatsApp marketing as well.

Step 1: audit what your site really does

Many owners are surprised by what their site loads. Plugins, themes and embeds can quietly add trackers. Work through this list.

Step 2: decide what you really need

A plain brochure site with no analytics, no ad pixels and a basic contact form needs very little beyond a clear privacy notice. A site with ad pixels, remarketing and several third-party tools has more to explain and more to control.

Do you need a banner?

A cookie banner is a tool, not a legal magic wand. It makes sense when you use non-essential trackers and want a way to ask visitors before they run. It does less good when it just sits on top of a site that has already loaded everything.

Banners are worth considering if you:

• run advertising or remarketing pixels,
• use several third-party analytics or marketing tools,
• serve visitors from other regions with their own cookie rules,
• want to give visitors a clear choice about non-essential tracking.

If your visitors are overseas, such as European customers, other countries' laws may apply on top of Singapore's. That is a question for a qualified adviser.

Write a privacy notice people can read

For a small Singapore site, a short notice covering these points is a sensible starting place.

A worked scenario: a tuition centre

A small tuition centre in Bishan runs a site with a trial-lesson form, a Google Maps embed, GA4 and a Meta pixel for ads. The owner audits the site and finds the pixel, the maps cookies and the analytics.

She keeps analytics but removes an old heatmap tool she no longer uses. She adds a clear privacy notice to the footer, mentions the trial form's purpose next to the submit button, and adds a consent tool because she runs ads. She tests it by opening the site in a fresh browser window and checking that the ad pixel does not fire before she clicks Accept. Then she puts a quarterly reminder in her calendar to re-check after any site change.

Another scenario: a home bakery with online ordering

Mei runs a home bakery in Tampines. Her site has an order form, a payment link supplied by a payment provider, an embedded Instagram feed and GA4. She has no ad pixels. After her audit she realises the order form collects names, addresses and phone numbers, which is the most important item on the list, far more than the cookies.

She writes a short notice that says the details are used to fulfil the order and arrange delivery, adds a line near the submit button, and decides how long she will keep old orders. She also removes the Instagram feed because it was loading third-party scripts on every page and adding little value. Since she runs no ads, she decides with her adviser that a simple notice and a contact route suit her setup, rather than a full consent tool. Your own decision may differ, which is why the audit comes first.

Words to put next to your forms

The place where a small business collects the most personal data is usually a form or a chat, not a cookie. A short line beside the button does a lot of the notification work.

Troubleshooting: how to test what loads

A banner is only honest if the site behaves the way it says. Here is a simple way to check without technical skills.

• Banner shows but pixels fire early: the scripts were added directly to the theme, not through the consent tool. Ask your provider to route them through it.
• Reject does nothing: the banner may only remember the choice and never block anything. Test again after a fix.
• Banner disappears after a theme update: re-test after every update or redesign.
• An old tool keeps appearing in the scan: find where it was installed and remove it completely, not just from the dashboard.

Mistakes to avoid

• Banner without control: the banner looks fine, but the scripts ignore it.
• Forgetting WhatsApp and chat: messages carry personal data, even though no cookie is involved.
• No contact route: visitors should know how to ask about their data.
• Treating it as one-off: every new plugin or pixel changes your position.
• Assuming a template is compliant: a copied notice may describe a different business.

Your next step

Run the tracking audit this week and write down every tool you find. Then read the current guidance at pdpc.gov.sg and decide what to notify and what to ask consent for. If you want a site where chat, forms and follow-up are set up in one place, see what Website.sg includes. Related reading: PDPA for website owners, website analytics setup and website security basics.