Consenti

APPI Compliance Guide (Japan)

Supported
ℹ️Compliance group: Japan auto-resolves to general-privacy-consentby default, which applies APPI's own mixed model within it — opt-in for sensitive data and cross-border transfers, opt-out for general third-party sharing (see below). For blanket opt-in on everything instead — the same model as GDPR, no mixed treatment — configure compliance: { type: 'opt-in' } explicitly in your ConsentiSetup config.

Japan's Act on the Protection of Personal Information (APPI) was significantly revised in 2022 (enforced from April 2022) and is administered by the Personal Information Protection Commission (PPC). Unlike GDPR, APPI uses a mixed model: opt-in for sensitive data and cross-border transfers to foreign companies without adequate protection, but opt-out is permitted for certain third-party sharing of general data. Consenti supports APPI via regulation: 'appi'.

⚠️Consenti provides Partial coverage for APPI. The opt-in consent widget covers sensitive data and foreign transfer scenarios. The opt-out third-party sharing model (for general personal information under Art. 27) differs from a standard consent banner and requires additional implementation on your site.

Official references

Compliance Group breakdown

ScenarioRequired model
Sensitive personal information (health, race, religion, criminal record, disability, etc.)Opt-in consent (Art. 20)
Third-party transfer to foreign entity without adequate protectionOpt-in consent (Art. 28)
Third-party transfer of general personal information (domestic)Opt-out permitted — notify and allow objection (Art. 27)
Analytics / functional cookies (non-sensitive)Consent recommended; legitimate interest available

Key requirements

RequirementDetail
Purpose notificationMust notify data subjects of the purpose of use before or at the time of collection
Sensitive dataExplicit opt-in required (Art. 20)
Third-party transferConsent required unless within same enterprise group or an exception applies
Overseas transferOpt-in if destination country lacks adequate protection; provide information on protection level
Access and correctionData subjects may request disclosure, correction, and deletion
RecordsControllers must maintain records of third-party provisions and receipts
EnforcerPersonal Information Protection Commission (PPC)

Enabling APPI mode

Frontend widget

ts
new ConsentiSetup({
  compliance: { type: 'general-privacy-consent' },
})

In APPI mode, Consenti renders an opt-in banner for cookies classified as sensitive or involving overseas data transfer. Cookies without sensitive classification receive a lightweight notice with an opt-out link (the Art. 27 opt-out model).

Profile configuration

json
{
  "regulation": "appi"
}
ℹ️Unlike DPDPA (which has a dedicated dpdpa profile block rendered automatically), APPI has no dedicated metadata field yet. For vendors (analytics, ads, CDN) that store data outside Japan, put them in their own category with legalBasis: 'consent' so they're opt-in regardless of sensitivity classification, and disclose the overseas transfer directly in that category's htmlText.

What Consenti does — and what it doesn't

Everything above is the consent-collection UX layer: the mixed opt-in/opt-out model, per-category records, withdrawal, and erasure. APPI imposes recordkeeping and process obligations beyond what a consent widget can satisfy on its own. Consenti does not:

  • Build or run the Art. 27 opt-out mechanism for domestic general-data third-party sharing — Consenti's banner models opt-in consent; the notify-and-allow-objection flow for non-sensitive domestic sharing needs separate implementation on your site (see the Partial-coverage callout above)
  • Assess whether a destination country has "adequate protection" for an overseas transfer under Art. 28 — that's a legal determination, not something the widget verifies
  • Maintain the Art. 25 records of third-party provisions and receipts APPI requires controllers to keep — that's an internal recordkeeping obligation separate from Consenti's consent-event audit log
  • Handle breach notification to the PPC or affected individuals — that's a separate incident-response process

Operator checklist

Beyond configuring Consenti's general-privacy-consent profile, an operator with APPI exposure still needs to:

  1. Classify which vendors constitute a third-party transfer to a foreign entity, and put them in their own opt-in category per the disclosure guidance above — don't rely on the mixed-model default to catch every foreign vendor automatically
  2. Build the Art. 27 opt-out mechanism (notice + objection channel) for domestic general-data sharing separately from the consent banner
  3. Maintain Art. 25 records of third-party data provisions and receipts outside Consenti
  4. Have a breach-notification process ready for the PPC and affected individuals
  5. Keep overseas-transfer disclosures in each category's htmlText current as your actual vendor list changes

Erasure

http
DELETE /consenti/api/v1/consent/:visitorId

For the widget-side "Forget me" button and the events both sides fire, see the Right to Erasure guide.