All notes · Consent

Recording consent under Japan's APPI

Japan's privacy law asks for consent at specific moments rather than as a general legal basis. This note covers when it applies, what to show first, and what to keep.

Consent belongs to moments, not to processing

If you come from the GDPR, the first surprise is that Japan's Act on the Protection of Personal Information (APPI) has no menu of lawful bases with consent as one option. Much of the handling of personal information needs no consent at all. The law asks you to specify the purpose of use, keep to it, and notify people of it or publish it^1,2.

Consent appears at particular moments instead. At those moments, the law asks for the person's consent in advance.

Telling people the purpose of use is a separate duty. You notify them or publish it (Art. 21)¹. A "consent" checkbox under a privacy policy records that you told them; it is not what these articles ask for.

What to keep

The APPI does not prescribe the format of a consent record. What gets asked later is predictable, though:

1. Who consented
2. What they saw when they did (the version of the text)
3. When they consented
4. Whether, and when, they withdrew

Keep each version of the text itself. A URL alone won't tell you, a year later, which wording someone agreed to.

Two records are required by law in their own right:

• Third-party provision. The provider must make a record of each provision (date, recipient and other items) and keep it, generally for three years, or one year when the record is made in certain ways^1,3.
• Marketing email. A sender who receives consent to send advertising email must keep a record proving that consent⁴.

Children

Who can consent for a child is not fixed by statute under the current law. The PPC's guidance says that the age has to be judged case by case, but that in general, consent should come from a legal representative for children aged roughly 12 to 15 and under⁵.

Amendments promulgated on 17 July 2026 make the legal representative the person to ask, and to notify, when the individual is under 16. They take effect within two years of promulgation, and the detailed rules are still being written⁶. Until then, the current guidance applies.

Contract capacity is a different line: the age of majority in Japan is 18⁷. Accepting terms of service and consenting to the handling of personal information can therefore involve different ages.

Recording consent with a signature

A consent record is only as good as the link between the person and the text. With Clavis, the product puts the version hash of the text, the purpose, and the recipient into the hash being signed. The user reads a one-line summary, then signs with their passkey. The signature ties that person's passkey to that exact version.

This doesn't make the consent valid or sufficient. It shows who signed which version, and when.

Next

• Sending personal data out of Japan
• Passkey signatures as evidence in Japan
• Signature docs