Data Protection Monitor
Global Privacy & Data Protection Intelligence

Hong Kong (HK) · Module Detail

Hong Kong: AdTech & Commercial Privacy

← Full Hong Kong overview Build report with Hong Kong Request deeper dive

#

Direct marketing is green-level binding law; the remaining five sub-modules are unevidenced gaps in a jurisdiction with no dedicated ePrivacy/cookie statute.

Primary frameworkPersonal Data (Privacy) Ordinance (Cap. 486), Part VIA (Direct Marketing)
Supervisory authorityPCPD
Traffic-light rationale — AmberDirect marketing is green-level binding law; the remaining five sub-modules are unevidenced gaps in a jurisdiction with no dedicated ePrivacy/cookie statute.

Sub-modules (6)

Cookies And TrackersRed

No dedicated cookie/tracker consent statute was identified distinct from general PDPO principles.

Absence provenance: unavailable. Searched: Hong Kong cookie consent law PDPO, Hong Kong ePrivacy cookies.

Dark PatternsAmber

PCPD guidance criticizes 'bundled consent' application-form designs that force customers to choose between service and direct-marketing data use.

Claims (1):

  • PCPD guidance states it would be unfair for service application forms to force customers to choose between providing personal data for direct marketing or forgoing the service ('bundled consent'), requiring separate voluntary indications instead.

Opt Out SignalsRed

No evidence of a Global-Privacy-Control-style universal opt-out signal regime was identified.

Absence provenance: unavailable. Searched: Hong Kong Global Privacy Control opt-out signal law.

Clean Rooms And DcrRed

No clean-room/data-collaboration-room rules were identified.

Absence provenance: unavailable. Searched: Hong Kong data clean room regulation PDPO.

Cross Context AdvertisingRed

No CPRA-style 'sale'/'share' cross-context-advertising regime was identified.

Absence provenance: unavailable. Searched: Hong Kong cross-context advertising data sale law.

Direct MarketingGreen

Part VIA requires informed consent/no-objection before use of data in direct marketing, an unconditional opt-out right, and criminalises non-compliant use with fines up to HK$500,000 and up to 3 years' imprisonment.

Claims (2):

  • Part VIA of the PDPO requires a data user to inform individuals, in an easily understandable and readable manner, of an intention to use or provide their data for direct marketing, specifying the data and marketing types, and to obtain consent or no-objection via a free response channel.
  • Section 35E of the PDPO provides for a fine of up to HK$500,000 and up to three years' imprisonment where personal data is used for direct marketing purposes without the individual's informed consent.
Category narrative41 words

Direct marketing is the best-developed strand of PDPO's commercial-privacy regime (Part VIA), with binding consent/opt-out duties and criminal penalties, plus PCPD guidance against 'bundled consent' dark patterns. No dedicated cookie/tracker law, opt-out-signal regime, clean-room rules, or cross-context-advertising ('sale'/'share') regime was identified.

Sources and claims (3)
  1. ProbableIAPP — PCPD guidance states it would be unfair for service application forms to force customers to choose between providing personal data for direct marketing or forgoing the service ('bundled consent'), requiring separate voluntary indications instead.observed
  2. ProbableIAPP — Part VIA of the PDPO requires a data user to inform individuals, in an easily understandable and readable manner, of an intention to use or provide their data for direct marketing, specifying the data and marketing types, and to obtain consent or no-objection via a free response channel.observed
  3. ProbableIAPP — Section 35E of the PDPO provides for a fine of up to HK$500,000 and up to three years' imprisonment where personal data is used for direct marketing purposes without the individual's informed consent.observed