ISRAEL Law and Practice Contributed by: Dan Or-Hof, Eran Gandman, Netanel Aharon and Matan Adar, Or-Hof Law
The Israel National Cyber Directorate (INCD) The INCD is responsible for national cybersecurity and critical infrastructure protection. While the PPA addresses privacy impacts, the INCD provides techni - cal guidance and incident containment. Co-ordination is most visible during Severe Security Incidents, where reporting to both authorities may be required. Sectoral Competent Authorities Additional regulators enforce privacy-related obliga - tions within their domains: • The Bank of Israel – Banking privacy and open banking supervision. • The Ministry of Health – Confidentiality and data sharing under the Patient Rights Law and the Health Information Mobility Law (2024). • The Securities Authority – Disclosure of material privacy incidents by public companies. Recent Enforcement Trends in 2026 Key trends include: • lateral supervision – sector-wide audits focusing on systemic compliance; • board level accountability – privacy-treated as a governance risk, with potential director exposure for compliance failures under PPA guidance; • the AI enforcement drive – proactive action against unauthorised web scraping and biometric process - ing, supported by pre-rulings; and • judicial barriers to digital searches – digital search - es require narrowly tailored judicial authorisation to ensure proportionality.
Status of Identifiers as Personal Data Under the modernised PPL, personal data includes any information enabling identification with reason - able effort. This may include: • online identifiers – cookies, MAC addresses, and advertising IDs (such as IDFA or AAID); • network data – IP addresses and device finger - prints; and • geolocation – real-time and historical location data collected via software development kits (SDKs). As these identifiers may qualify as personal data, their collection requires an identifiability assessment and may trigger full PPL obligations, including notice and informed consent requirements. The Mandatory Opt-In Consent Model Although the PPL does not expressly regulate cook - ies, the 2025 PPA draft consent guidance requires informed, freely given consent for processing personal data, including common cookie-based activities such as analytics, advertising, user journey analysis, and marketing automation. The following problem areas and solutions have been identified: • Implied consent difficult to substantiate – The PPA indicates that reliance on implied consent requires substantial evidence of actual consent. • Defective consent: Pre-ticked boxes and vague descriptions are considered invalid, with the bur - den on organisations to demonstrate valid consent. Transparency and Notice Requirements (Section 11) At the point of collection, users must receive notice identifying the controller, specifying processing pur - poses, explaining consequences of refusal, indicating access and rectification rights, and disclosing third- party recipients and purposes of data sharing. 4.2 Personalised Advertising and Other Online Marketing Practices The regulation of personalised and targeted advertis - ing in Israel is governed by a framework significantly modernised through Amendment No 13 to the PPL.
4. Sectoral Topics 4.1 Use of Cookies
Following the entry into force of Amendment No 13 to the PPL, the 2025 PPA Guidelines on Informed Con - sent, the PPA’s 2021 recommendation for cookie opt- in in its guidance on Privacy in Advanced Payment Methods, and the rise in cookie-related class actions, the Israeli market has placed increased focus on cookie consent. As a result, Israeli websites increas - ingly deploy cookie banners in various formats.
192 CHAMBERS.COM
Powered by FlippingBook