POPIA compliance for websites
In South Africa, an objection ends the tracking.
POPIA doesn’t always demand consent before you profile someone for marketing. It does demand that you can justify it, and that anyone who objects is taken off, for good. ConsentBit asks before anything optional runs, and lets a visitor change that answer at any time.
Google-certified CMP · IAB Europe registered CMP (ID 502) · 9 languages · Webflow, Framer, WordPress and any website builder
First visit to your site
We value your privacy
We use necessary cookies to run this site. With your permission, we’d also like to measure traffic and show relevant ads.
Until they choose, only necessary cookies run. The floating icon reopens their settings any time.
Object at any time, and the trackers stop.
Every objection logged, with the date and time.
The Protection of Personal Information Act, enforced by the Information Regulator.
POPIA sets eight conditions for the lawful processing of personal information in South Africa. The Information Regulator enforces it, and has already issued fines. Compliance has been required since 1 July 2021.
Maximum administrative fine
R10 million
per infringement notice. Serious offences can also carry up to 10 years in prison.
Eight conditions for lawful processing, from accountability to data subject participation
Already enforced
in December 2024 the Regulator fined a government department R5 million for ignoring an enforcement notice
Five things POPIA expects from your website
Each requirement in plain terms, next to how ConsentBit covers it.
What POPIA requires
Tell people what you collect and why, when you collect it (s. 18)
How ConsentBit handles it
The banner names each category and its purpose, as soon as a visitor lands.
What POPIA requires
A lawful basis for profiling, which you can show
How ConsentBit handles it
Each category is separate, so you can justify one and drop another.
What POPIA requires
An objection that can be made at any time (s. 11(3))
How ConsentBit handles it
Reject all and the preferences panel both work as the objection.
What POPIA requires
Processing that stops once someone objects (s. 11(4))
How ConsentBit handles it
The objection is saved at once, marketing cookies are deleted, and the refused scripts are blocked from there on.
What POPIA requires
Proof of consent where you rely on it (s. 11(2)(a))
How ConsentBit handles it
Every choice is logged with the date and time, ready to export.
Section 11(2)(a) puts the burden of proof on you, the responsible party, not on the person who complains.
What a visitor sees, step by step
The choice is on the page, and acting on it is immediate.
They land on your site
The banner explains what is collected and why, with the categories named.
They choose
Accept all, Reject all, or set each category in the preferences panel.
The choice takes effect
The choice is saved at once, with no page reload: marketing cookies are deleted and Google and Microsoft tags switch to denied. A script already running on that page finishes there, and is blocked from the next page on.
They can object later
A floating button on every page reopens the panel at any time, which is what section 11(3) asks for.
CONSENT OR LEGITIMATE INTEREST
Consent isn’t the only route, but the alternative has homework.
The Information Regulator’s guidance on direct marketing says profiling people to target marketing can rest on legitimate interest under section 11(1)(f) rather than consent. That is a real option, and it comes with a documented assessment and an objection right you cannot refuse.
The Regulator lists “profiling data subjects to target direct marketing” as an example of a legitimate interest, so the route is real. The assessment behind it has to exist before you use it.
Asked first, and stopped on request
By default ConsentBit asks before anything optional runs. Here is what that looks like.
Asked first, or opt-out if you prefer
Asking first is stricter than POPIA requires, and it is what the banner does by default. If you would rather run the opt-out model the Act allows, set your banner to CCPA only. Every visitor then gets the opt-out banner, on any plan.
The Regulator does act
In December 2024 the Information Regulator issued an infringement notice with a R5 million administrative fine to a government department that failed to comply with an enforcement notice.
Selling into Europe as well? See what GDPR requires →
Add a POPIA-ready banner to your site, free.
Records
A record of every choice, ready if the Regulator asks
Every choice is recorded with when it was made and which categories the visitor accepted or rejected. You can export the log as a CSV file whenever you need it.
The visitor opted out, so advertising scripts were blocked.
The visitor didn’t opt out, so scripts ran as normal.
Consent log
Because the burden of proof sits with you, the log is the part that matters when someone says they never agreed.
FAQ
South African privacy questions, answered
Can't find what you need? Talk to our team at web@consentbit.com.
It applies to anyone who processes personal information in South Africa, whatever their size, including businesses based elsewhere that process information using means in the country. Compliance has been required since 1 July 2021.
POPIA doesn’t mention cookies. It does require you to tell people what you are collecting and why, to have a lawful basis, and to let them object. A banner is the usual way to do all three on a website.
Not necessarily. The Information Regulator’s guidance says profiling to target direct marketing can rely on legitimate interest under section 11(1)(f). You need a legitimate interest assessment on file, and you have to honour objections.
A three-part test the Regulator sets out: a purpose test that identifies the interest, a necessity test that asks whether the processing is proportionate and whether less data would do, and a balancing test against the person’s rights.
Section 11(4) says that once a person objects under section 11(3), you may no longer process their personal information for that purpose. The objection can be made at any time.
The Information Regulator can issue an enforcement notice and then an infringement notice with an administrative fine of up to R10 million. Some offences also carry imprisonment of up to 10 years, or a fine, or both.
They share a structure, and both allow legitimate interest. POPIA makes the objection route central, requires opt-in consent for unsolicited marketing emails and SMS through a prescribed form, and sets fines in rands rather than as a share of global turnover.
See what GDPR requires →
Yes. ConsentBit has a free plan, and every paid plan comes with a 14-day free trial. See pricing for what each plan includes. See pricing →
Give people the objection POPIA promises them
ConsentBit puts the choice on the page, saves an objection at once, blocks the refused scripts from there on, and keeps the record.
This page is a general overview of the Protection of Personal Information Act, not legal advice. POPIA covers far more than website tracking, including the information officer’s duties, security compromises, special personal information and transfers outside South Africa, which sit outside what a consent banner handles.