In Chile, cookies that identify or profile a person process personal data and need a lawful basis. Where that basis is consent, article 12 of Law 21.719 requires it to be free, informed, specific, prior and unambiguous, given by a statement or an affirmative act. A banner offering only "Accept" does not meet that standard.
The essentials in 30 seconds
- Cookies that identify or profile process personal data: they need a legal basis.
- Necessary cookies do not require consent; statistics and marketing cookies do —before being enabled.
- Consent must be free, informed and unambiguous, and as easy to reject as to accept.
- A banner that only says “Accept” —or that enables cookies before the choice is made— does not comply.
- You need a cookie policy + a banner organized by category + a record of consent.
It is the most common mistake we see: sites with Google Analytics, advertising pixels and heatmaps running from the very first second, without the visitor having chosen anything. Under Law 21.719 that is processing personal data without a legal basis. The good news is that complying does not mean “killing” your analytics — it means asking for permission properly. If you also want to get your legal texts in order, we cover that in the privacy policy for companies service. If you want the full picture, start with our guide to the data protection law in Chile.
Does Law 21.719 apply to cookies?
Yes, when cookies or other tracking technologies process personal data: analytics that allow identification, advertising cookies, profiling, fingerprinting. In those cases you need a legal basis, and for cookies that are not strictly necessary that basis is usually consent. Purely technical cookies (session, security) do not require prior consent, but they must still be disclosed.
What makes consent valid
The law is demanding when it comes to consent. To be valid it must be:
- Free: without making access to the site conditional on accepting non-necessary cookies.
- Informed: the person knows which cookies there are, from whom and for what purpose.
- Unambiguous: a clear affirmative action. No pre-ticked boxes or “continuing to browse means you accept”.
- Specific: it can be accepted by category, not all-or-nothing.
- Revocable: withdrawing consent must be as easy as giving it.
Types of cookies
| Category | Examples | Prior consent needed? | Typical lawful basis |
|---|---|---|---|
| Strictly necessary or technical | Session, authentication, security, load balancing | No | Performance of the contract or service requested by the data subject (article 13 letter c) |
| Preferences | Language, region, saved view | Yes, unless the data subject expressly requested it | Consent (article 12) |
| Statistics and analytics | Google Analytics, heatmaps, funnels | Yes, before they load | Consent (article 12) |
| Marketing and advertising | Remarketing pixels, audiences, attribution | Yes, before they load | Consent (article 12) |
| Profiling with legal effects | Scoring, segmentation deciding price or access | Yes, plus disclosing the logic applied | Consent (article 12) + duty under article 14 ter letter l) |
What a compliant cookie banner looks like
- It appears before enabling non-necessary cookies.
- It offers, on equal terms, “Accept all”, “Necessary only / Reject” and “Customize”.
- It lets you choose by category (preferences, statistics, marketing).
- It does not enable statistics or marketing until the person accepts.
- It links to the cookie policy with the details.
- It records the choice (what was accepted, when) as evidence.
- It lets the user change the decision later (a “cookie preferences” link).
This very site implements that pattern: a banner organized by category, with the analytics and marketing tags paused until you accept (Consent Mode). It is exactly what we leave working in our projects.
Common mistakes
- Loading Analytics and pixels from the start, before any choice.
- A “Accept” only banner, without a real option to reject.
- Pre-ticked boxes or “by continuing to browse you accept”.
- Not having a cookie policy or a record of consent.
- Forgetting the preference center for revoking consent.
How to bring your site into compliance
- Inventory which cookies and trackers your site loads (first-party and third-party).
- Classify them by category (necessary, preferences, statistics, marketing).
- Implement the banner by category so it blocks anything non-necessary until consent.
- Publish the cookie policy and link it from the banner and the footer.
- Record consents and enable revocation.
- Review whenever you add a new tool (a new pixel changes the scenario).
Is your site loading cookies without permission?
We bring your website into compliance: cookie policy, banner by category and valid consent, in line with Law 21.719. Start with a 30-minute assessment, no obligation.
See the privacy policy serviceFrequently asked questions
Does Law 21.719 require a cookie banner?
When cookies process personal data (analytics that identify, advertising, profiling) you need a legal basis. For cookies that are not strictly necessary that basis is usually consent, which must be obtained before enabling them: that is where the banner comes in.
Do necessary cookies require consent?
No. Cookies strictly necessary for the site to work (session, security) do not require prior consent; they are still disclosed in the cookie policy. Statistics, preferences and marketing cookies require consent before being enabled.
Is a banner that only says "Accept" enough?
No. Consent must be free, informed and unambiguous, and as easy to reject as to accept. A banner that only allows acceptance, or that enables cookies before the choice is made, does not comply: it must offer the option to reject and to manage preferences by category.
What happens if I enable cookies before the user accepts?
Enabling non-necessary cookies before consent is a violation: the processing takes place without a legal basis. Statistics and marketing cookies must stay paused until the person accepts them.
Does Law 21.719 mention cookies explicitly?
It does not name them. Law 21.719 regulates the processing of personal data, and a cookie that allows a person to be identified or profiled processes personal data under the definition in article 2. The applicable regime is therefore not a cookie provision but the general lawfulness rules of articles 12 and 13.
What must cookie consent meet in Chile?
Article 12 of Law 21.719 requires consent to be free, informed and specific as to its purpose, and to be given in a prior and unambiguous manner through a statement or an affirmative act that clearly shows the data subject's will. Silence and pre-ticked boxes do not qualify.
Can I load analytics before the user accepts?
No. Article 12 of Law 21.719 requires consent to be prior. If statistics or marketing cookies load before the data subject chooses, the processing has already happened without a lawful basis, and the controller bears the burden of proving consent under the final paragraph of that same article.
Must rejecting be as easy as accepting?
Yes. Article 12 of Law 21.719 requires the means to give and withdraw consent to be swift, reliable, free of charge and permanently available. A banner that accepts in one click but demands three screens to reject does not meet that equivalence standard.
Can users withdraw cookie consent later?
Yes, at any time and without stating a reason, using means similar or equivalent to those used to give it, under article 12 of Law 21.719. Withdrawal has no retroactive effect: it does not invalidate earlier processing, but it does require stopping it going forward.
What must I publish on the site besides the banner?
Article 14 ter of Law 21.719 requires keeping permanently available on the website the processing policy with its date and version, the categories of data, the purposes, the basis of legitimacy, the recipients, the retention period and the right to withdraw consent. The banner does not replace that publication.
Official sources
- Law 21.719 on the protection and processing of personal data, creating the Personal Data Protection Agency — official text, Library of the National Congress of Chile
- Articles 12 and 13 (lawfulness and consent) and article 14 ter (information and transparency duty) — consolidated text in force from 1 December 2026
This article is for information purposes only and does not constitute legal advice for a specific case.