Skip to content

Something urgent? Call us now! (852) 3416 1711

Cookies and what you need to know

By Allison Lee

Hong Kong, 12 January 2021: Cookies, also known as HTTP Cookies, are text files which are stored on a user’s computer to enable website owners to identity the user’s computer or electronic device. They are generally used by website owners to track a user’s online behaviour or interaction with websites.

These text files typically store information such as the user’s username, language preference and browsing habits. For example, it is a way how website owners serve targeted advertisements which match a user’s browsing preferences.

The widespread use of cookies increasingly raises privacy concerns since a user’s browsing activities are often collected and might also be transferred to third parties without the user’s knowledge and the information might also be used for marketing purposes.

In Hong Kong, personal data covers information which relates to a living individual and can be used to ascertain that individual’s identity. It must also exist in a form in which access to or processing of it is practicable. When determining whether a piece of data is personal data, the totality of the circumstances should be taken into account (see Note 1 below).

In light of the above, when deciding whether cookies in a specific case are personal data, it depends on whether the cookies contain any data that can uniquely identify an individual. Website owners who deploy online tracking that involves the collection of personal data should consider the requirements under the Personal Data (Privacy) Ordinance, including the six Data Protection Principles. 

Website owners intending to use cookies to collect information from users are recommended to:

  1. Inform website users about the kind of information being stored in the cookies, the purpose of collecting the information and how the information is collected;
  2. State whether the websites allow access by users who do not accept the use of cookies and whether there would be any loss of functionality resulting from not accepting cookies.

If the website deploys third-party cookies, the website owner should also set out the type of information being collected and/or transferred and the purposes of collecting the information (Notes 2 & 3).

When cookies are used to collect behavioural information, it is recommended that website owners should:

  1. Set up an appropriate expiry date for the cookies;
  2. Encrypt the contents of the cookies whenever appropriate; and 
  3. Not deploy techniques that disregard browser settings on cookies unless they can provide an alternative to website users to disable the cookies or decline the use of cookies (Note 4).

It is also important for the website owners to offer an option to website users to disable or reject the cookies.

Many countries have recently expanded their regulations to cover cookies in their scope of personal data for better protection of data privacy. For more information, website owners or website users should observe the Guidance on Online Behavioural Tracking issued by the Office of the Privacy Commissioner for Personal Data.


An Associate with Boase Cohen & Collins since 2015, Allison Lee is experienced in the fields of data protection, intellectual property, matrimonial and family matters, and general civil litigation. In addition to her law qualifications, she holds a Master degree in Science specialising in electronic commerce and internet computing. She can be contacted at

35+ years of legal experience is just a click away.

Friendly and approachable, we are ready to answer your questions and offer you sound advice.

Contact us now


News & Knowledge

Learn more about what we do and what we say. Subscribe to our newsletter to ensure you receive our updates.

  • This field is for validation purposes and should be left unchanged.

Harbouring doubts about our exit plan

Hong Kong, 20 October 2021: Having lived in Hong Kong for 40 years, I’m sometimes guilty of being blasé about this wonderful city’s unique appeal. Boasting an exotic blend of ancient and modern, East meets West, downtown bustle versus country park tranquility, there is nowhere quite like it. And it appears many people agree, given […]

Read more

Delaying tactics draw judge’s ire

By Insurance and Personal Injury Team Hong Kong, 19 October 2021: Parties involved in long-running personal injury cases have been warned that the courts will no longer tolerate unacceptable delays that result in even straightforward claims taking years to resolve. In particular, the courts will be prepared to impose sanctions on costs against anyone who […]

Read more

Law & More: Episode 6 – Steve Vickers

Hong Kong, 15 October 2021: Steve Vickers is our guest in the latest episode of our Law & More podcast. After serving as a senior officer in the Royal Hong Kong Police Force, when he led anti-triad operations and resolved numerous kidnapping incidents, Steve transitioned to the world of business. He is founder and CEO […]

Read more

Logical thinking is being blown away

Hong Kong, 13 October 2021: Just four days after Hong Kong endured its first typhoon of the year, our city is being doused by a second one. Last Saturday, Tropical Storm Lionrock brought typically violent winds and torrential rain, causing the No.8 signal (the third-highest level of alert) to be in force for 22 hours, […]

Read more

Mediterranean meet-up a tonic for Ally Law

Hong Kong, 12 October 2021: After a two-year wait due to the global pandemic, Boase Cohen & Collins was delighted to attend an in-person gathering of Ally Law firms last week. Partner Susan Cheung (pictured, second from left) represented the firm at the meet-up on the Greek island of Crete, joining attendees from Ally Law […]

Read more