--- title: Recording consent under Japan's APPI lede: Japan's privacy law asks for consent at specific moments rather than as a general legal basis. This note covers when it applies, what to show first, and what to keep. shelf: consent desk: legal edition: 1 source: Act on the Protection of Personal Information (Japanese original, e-Gov) | https://laws.e-gov.go.jp/law/415AC0000000057 | 2026-10-10 source: Act on the Protection of Personal Information (English translation, Japanese Law Translation) | https://www.japaneselawtranslation.go.jp/en/laws/view/4241 | 2026-10-10 source: Enforcement Rules for the Act on the Protection of Personal Information, Article 21 | https://laws.e-gov.go.jp/law/428M60020000003 | 2026-10-10 source: Act on Regulation of Transmission of Specified Electronic Mail, Article 3 | https://laws.e-gov.go.jp/law/414AC0100000026 | 2026-10-10 source: PPC Q&A on the APPI Guidelines (Q1-62) | https://www.ppc.go.jp/personalinfo/faq/APPI_QA/ | 2026-10-10 source: PPC, Overview of the 2026 amendments to the APPI | https://www.ppc.go.jp/files/pdf/260717_kaiseihounitsuite.pdf | 2026-10-10 source: Civil Code, Articles 4 and 5 (e-Gov) | https://laws.e-gov.go.jp/law/129AC0000000089 | 2026-10-10 --- ## Consent belongs to moments, not to processing If you come from the GDPR, the first surprise is that Japan's Act on the Protection of Personal Information (APPI) has no menu of lawful bases with consent as one option. Much of the handling of personal information needs no consent at all. The law asks you to specify the purpose of use, keep to it, and notify people of it or publish it[^1][^2]. Consent appears at particular moments instead. At those moments, the law asks for the person's consent in advance. | Moment | Article | What the law asks | |---|---|---| | Using personal information beyond the stated purpose | Art. 18 | Prior consent, with listed exceptions[^1] | | Acquiring special care-required personal information (medical history, criminal record and similar) | Art. 20(2) | Prior consent, with listed exceptions[^1] | | Providing personal data to a third party | Art. 27 | Prior consent, with exceptions for entrustment, business succession, joint use, and a notified opt-out route[^1] | | Providing personal data to a third party in a foreign country | Art. 28 | Prior consent, after giving specific information[^1] | Telling people the purpose of use is a separate duty. You notify them or publish it (Art. 21)[^1]. A "consent" checkbox under a privacy policy records that you told them; it is not what these articles ask for. ## What to keep The APPI does not prescribe the format of a consent record. What gets asked later is predictable, though: 1. Who consented 2. What they saw when they did (the version of the text) 3. When they consented 4. Whether, and when, they withdrew Keep each version of the text itself. A URL alone won't tell you, a year later, which wording someone agreed to. Two records are required by law in their own right: - **Third-party provision.** The provider must make a record of each provision (date, recipient and other items) and keep it, generally for three years, or one year when the record is made in certain ways[^1][^3]. - **Marketing email.** A sender who receives consent to send advertising email must keep a record proving that consent[^4]. ## Children Who can consent for a child is not fixed by statute under the current law. The PPC's guidance says that the age has to be judged case by case, but that in general, consent should come from a legal representative for children aged roughly 12 to 15 and under[^5]. Amendments promulgated on 17 July 2026 make the legal representative the person to ask, and to notify, when the individual is under 16. They take effect within two years of promulgation, and the detailed rules are still being written[^6]. Until then, the current guidance applies. Contract capacity is a different line: the age of majority in Japan is 18[^7]. Accepting terms of service and consenting to the handling of personal information can therefore involve different ages. ## Recording consent with a signature A consent record is only as good as the link between the person and the text. With Clavis, the product puts the version hash of the text, the purpose, and the recipient into the hash being signed. The user reads a one-line summary, then signs with their passkey. The signature ties that person's passkey to that exact version. This doesn't make the consent valid or sufficient. It shows who signed which version, and when. ## Next - [Sending personal data out of Japan](/en/notes/sending-personal-data-out-of-japan) - [Passkey signatures as evidence in Japan](/en/notes/passkey-signatures-as-evidence-in-japan) - [Signature docs](https://docs.clavis.nexus/en/signature)