Visit most Singapore SME websites and you’ll see a cookie banner in the corner — “This site uses cookies” with an OK button. Check the network traffic behind the scenes, and you’ll often find Google Analytics, Meta Pixel, and two or three ad-retargeting scripts had already fired before the visitor clicked anything. The banner is decorative. The tracking already happened. This is the single most common PDPA gap we find when auditing a client’s existing website, and it’s rarely deliberate — it’s just how most website builders and plugins ship by default.<\/p>\n
Singapore’s PDPA doesn’t specifically legislate “cookies” the way the EU’s ePrivacy rules do, but it does regulate the collection of personal data, and tracking cookies that build a profile of a visitor’s behaviour, device, or identity fall within that scope. The PDPA relies heavily on the concept of consent, with a narrower carve-out called deemed consent<\/strong> for situations where collection is reasonably necessary to provide something the visitor asked for. Strictly necessary cookies — the ones that keep a shopping cart working or remember a login — generally fall under deemed consent. Analytics, advertising, and retargeting cookies almost always don’t, because the site would function perfectly well without them from the visitor’s point of view.<\/p>\n A properly built consent flow blocks non-essential scripts by default, only firing analytics and advertising tags after a genuine opt-in, and gives visitors an equally easy way to say no as to say yes. This usually means a consent management platform sitting in front of your tag manager, rather than a cookie banner bolted on as a separate plugin that has no actual control over what fires. It also means someone periodically auditing what scripts are actually running on the site — because tracking tags accumulate quietly over years and rarely get removed.<\/p>\n PDPC enforcement against SMEs for cookie-specific breaches is still relatively rare compared to enforcement for data breaches, but the exposure is real: an aggrieved customer complaint, a due diligence check ahead of a partnership or acquisition, or a platform like Google or Meta tightening its own consent requirements can all surface this gap suddenly. Fixing it properly, once, is far cheaper than fixing it under pressure.<\/p>\n Every website we build for a Singapore client ships with consent-gated tracking by default — scripts stay off until a visitor genuinely opts in, categorised clearly between necessary, analytics, and marketing. If you’re not sure what’s actually firing on your current site, we can run a quick tracking audit and show you exactly what’s collecting data before a visitor has said yes to anything. Get in touch with our team if you’d like that audit done.<\/p>\n","protected":false},"excerpt":{"rendered":" Most Singapore business websites run tracking scripts before a visitor has agreed to anything. Here’s what the PDPA actually requires, and how to fix it properly.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[20],"tags":[],"class_list":["post-255","post","type-post","status-publish","format-standard","hentry","category-data-privacy-pdpa"],"_links":{"self":[{"href":"https:\/\/www.oasiswebasia.com\/blog\/wp-json\/wp\/v2\/posts\/255","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.oasiswebasia.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.oasiswebasia.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.oasiswebasia.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.oasiswebasia.com\/blog\/wp-json\/wp\/v2\/comments?post=255"}],"version-history":[{"count":1,"href":"https:\/\/www.oasiswebasia.com\/blog\/wp-json\/wp\/v2\/posts\/255\/revisions"}],"predecessor-version":[{"id":278,"href":"https:\/\/www.oasiswebasia.com\/blog\/wp-json\/wp\/v2\/posts\/255\/revisions\/278"}],"wp:attachment":[{"href":"https:\/\/www.oasiswebasia.com\/blog\/wp-json\/wp\/v2\/media?parent=255"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.oasiswebasia.com\/blog\/wp-json\/wp\/v2\/categories?post=255"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.oasiswebasia.com\/blog\/wp-json\/wp\/v2\/tags?post=255"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}The Mistakes We See Most Often<\/h2>\n
\n
What a Compliant Setup Actually Looks Like<\/h2>\n
Why This Is Worth Fixing Proactively<\/h2>\n
How Oasis Web Asia Handles This<\/h2>\n