---
title: "Cookie Consent Compliance"
url: "https://legal.ge/en/service/technology-and-digital-law-en/cookie-consent-compliance-en"
field: "Technology & Digital Law"
description: "Cookies and consent under Georgian law: how consent is taken and withdrawn, and fines up to 2 000 GEL. Legal.ge."
reviewed: "2026-02-15"
updated: "2026-11-07"
publisher: "legal.ge"
---

# Cookie Consent Compliance

> Source: legal.ge, https://legal.ge/en/service/technology-and-digital-law-en/cookie-consent-compliance-en

## Cookies and the Georgian law: the rules for consent

Working with cookie files has no stand-alone legislative regime in Georgia: the Law of Georgia on Personal Data Protection contains no cookie-specific article. That does not mean the area is unregulated — collecting and using data through cookies falls fully under the same law's general consent regime, applied to the identifiers of terminal equipment. Below we explain how the law defines consent, what duties a website owner has when consent is taken and when it is withdrawn, and what fines are established for breaching those duties.

## Why a cookie file is personal data

Under the law's definitions, personal data is any information relating to an identified or identifiable natural person. A person is identifiable where identification is possible directly or indirectly, including by name, surname, identification number, geolocation data, identifiers of electronic communications or other characteristics. A cookie identifier is precisely such identifying data — it ties the visitor to a device and a pattern of behaviour. The definition of processing is equally broad: it covers the collection of data, access to them, organisation, storage, use, disclosure by transfer, making available, dissemination and any other action towards the data. Accordingly, writing a cookie, reading it and building a profile is processing, and where it runs through information technologies the full statutory regime applies. Automated processing is expressly defined as processing by means of information technologies, and profiling — any form of automated processing that evaluates or predicts characteristics connected with a person — falls within the same frame.

## What consent is and when it serves as a basis

Under the law, consent is the data subject's freely and clearly expressed will, given by an active action, in writing or orally, after receiving the relevant information, to the processing of data concerning him or her for a specific purpose. Three features stand out. Informedness: consent must rest on information provided beforehand. Activity: it must be expressed by an action, not by silence. Specificity: it relates to a defined purpose. Processing is permissible only where one of the statutory bases exists, and the subject's consent is the first among them. The allocation of responsibility is unambiguous: the obligation to justify the legal basis of processing rests on the controller itself. A written consent — including an electronic one — is a consent signed by the subject or otherwise expressed in writing for a specific purpose after receiving the relevant information; the mechanics of a cookie banner must measure up to this standard.

The full text is available on legal.ge after signing in: https://legal.ge/en/service/technology-and-digital-law-en/cookie-consent-compliance-en

### Is consent required for cookie files?

Where a cookie relates to the visitor's identification and no other statutory basis applies, the processing rests on the subject's consent. The law defines consent as a freely and clearly expressed will, given by an active action for a specific purpose after receiving the relevant information.

### Can consent be embedded in another document?

Including written consent in a broader document is allowed, but the consent text must be in clear, simple and understandable language and separated from the rest of the document. It is also assessed whether consent is an essential condition of the service and whether the service can be received without it.

### How should the withdrawal mechanism work?

Withdrawal must be free of charge, simple and accessible, including in the same form in which consent was given. After withdrawal, processing stops immediately and the data are deleted or destroyed, unless the law provides otherwise.

### What fine threatens for breaching the consent rules?

The breach results in a warning or a fine: up to 1 000 lari for subjects with annual turnover up to 500 000 lari, up to 2 000 lari above that threshold, and with an aggravating circumstance 2 000 and 4 000 lari respectively.