---
title: "Hong Kong — AdTech & Commercial Privacy | Data Protection Monitor"
canonical: https://dataprotection.gi/jurisdictions/hong-kong/adtech-and-commercial-privacy/
source_html: /jurisdictions/hong-kong/adtech-and-commercial-privacy/index.html
description: "Hong Kong — AdTech & Commercial Privacy: adtech_and_commercial_privacy AdTech & Commercial Privacy 6 sub-modules 3 claims Amber ▾ # Direct marketing is green-level binding law; the remaining five sub-modules are unevidenc"
generated_at: 2026-10-25T04:46:50Z
content_sha256: 07c55445ad87e34ea56359ee58f8845b7618b8815314a1490b5bbaf0157162ad
generator: "fe-fleet/md-twin@1.0"
---
# Hong Kong — AdTech & Commercial Privacy | Data Protection Monitor

### D7AdTech & Commercial Privacy6 sub-modules3 claimsAmber▾#

Direct marketing is green-level binding law; the remaining five sub-modules are unevidenced gaps in a jurisdiction with no dedicated ePrivacy/cookie statute.

Primary framework Personal Data (Privacy) Ordinance (Cap. 486), Part VIA (Direct Marketing)

Supervisory authority [PCPD](https://www.pcpd.org.hk/)

Traffic-light rationale — Amber Direct marketing is green-level binding law; the remaining five sub-modules are unevidenced gaps in a jurisdiction with no dedicated ePrivacy/cookie statute.

#### Sub-modules (6)

#### Cookies And TrackersRed

No dedicated cookie/tracker consent statute was identified distinct from general PDPO principles.

Absence provenance: unavailable . Searched: Hong Kong cookie consent law PDPO, Hong Kong ePrivacy cookies.

#### Dark PatternsAmber

PCPD guidance criticizes 'bundled consent' application-form designs that force customers to choose between service and direct-marketing data use.

Claims (1):

- PCPD guidance states it would be unfair for service application forms to force customers to choose between providing personal data for direct marketing or forgoing the service ('bundled consent'), requiring separate voluntary indications instead.

#### Opt Out SignalsRed

No evidence of a Global-Privacy-Control-style universal opt-out signal regime was identified.

Absence provenance: unavailable . Searched: Hong Kong Global Privacy Control opt-out signal law.

#### Clean Rooms And DcrRed

No clean-room/data-collaboration-room rules were identified.

Absence provenance: unavailable . Searched: Hong Kong data clean room regulation PDPO.

#### Cross Context AdvertisingRed

No CPRA-style 'sale'/'share' cross-context-advertising regime was identified.

Absence provenance: unavailable . Searched: Hong Kong cross-context advertising data sale law.

#### Direct MarketingGreen

Part VIA requires informed consent/no-objection before use of data in direct marketing, an unconditional opt-out right, and criminalises non-compliant use with fines up to HK$500,000 and up to 3 years' imprisonment.

Claims (2):

- Part VIA of the PDPO requires a data user to inform individuals, in an easily understandable and readable manner, of an intention to use or provide their data for direct marketing, specifying the data and marketing types, and to obtain consent or no-objection via a free response channel.
- Section 35E of the PDPO provides for a fine of up to HK$500,000 and up to three years' imprisonment where personal data is used for direct marketing purposes without the individual's informed consent.

Category narrative 41 words

Direct marketing is the best-developed strand of PDPO's commercial-privacy regime (Part VIA), with binding consent/opt-out duties and criminal penalties, plus PCPD guidance against 'bundled consent' dark patterns. No dedicated cookie/tracker law, opt-out-signal regime, clean-room rules, or cross-context-advertising ('sale'/'share') regime was identified.

Evidence 3

Sources and claims (3)
- Probable[IAPP](https://iapp.org/news/a/new-privacy-requirements-for-direct-marketing-are-you-compliant-) — PCPD guidance states it would be unfair for service application forms to force customers to choose between providing personal data for direct marketing or forgoing the service ('bundled consent'), requiring separate voluntary indications instead.observed 2026-08-03
- Probable[IAPP](https://iapp.org/news/a/hong-kong-amendments-to-hong-kong-personal-data-privacy-ordinance) — Part VIA of the PDPO requires a data user to inform individuals, in an easily understandable and readable manner, of an intention to use or provide their data for direct marketing, specifying the data and marketing types, and to obtain consent or no-objection via a free response channel.observed 2026-08-03
- Probable[IAPP](https://iapp.org/news/a/hong-kongs-first-imprisonment-under-the-personal-data-privacy-ordinance) — Section 35E of the PDPO provides for a fine of up to HK$500,000 and up to three years' imprisonment where personal data is used for direct marketing purposes without the individual's informed consent.observed 2026-08-03