On the Horizon — Not Yet Law
Amendments to the Act on the Protection of Personal Information introducing protections for individuals under 16
Once in force, the amendments require that where the APPI calls for consent and the data subject is under 16, consent comes from the legal representative, and that notices which would otherwise go to the individual go to the representative instead; they also give minors enhanced standing to request cessation of use or of third-party provision, and impose a duty on businesses to make efforts to prioritise the best interests of the minor. Reporting also indicates a parental-approval requirement for collecting biometrics from an under-16, which sits alongside the package's new 'specific biometric personal information' category. For a business serving Japanese users this is a material change from the current position, where children's protection rests on interpretive guidance rather than on a statutory age line — and the lead time is real: the obligations attach on a Cabinet Order date that has not been set, so age-assurance and guardian-consent flows should be designed now rather than scheduled against a known deadline.
Status: Enacted but not yet operative — the status ambiguity noted in earlier passes is now resolved. Japan currently has no statutory children's consent age: the PPC's Q&A guidance treats children aged roughly 12 to 15 or younger as generally lacking decision-making capacity, assessed case by case, which is guidance rather than a rule. The 2026 amendment package puts an under-16 threshold into the Act itself. It cleared the House of Representatives on May 26, 2026, passed the House of Councillors on July 10, 2026, and was promulgated on July 17, 2026 as Act No. 56 of 2026 — confirmed against the PPC's own page for the Reiwa 8 amendment. Commencement is split: a subset of provisions, principally penalty-related, takes effect January 17, 2027 (six months after promulgation), while the main body — including the under-16 provisions — commences on a date to be fixed by Cabinet Order within two years of promulgation, so no later than July 16, 2028. That Cabinet Order had not been made, and much of the operative detail depends on PPC regulations and guidelines still to be issued.
Main body: a date to be fixed by Cabinet Order, no later than July 16, 2028 (a subset of penalty provisions commences January 17, 2027)
This is a general reference, not legal advice or a determination that this law applies to your specific business. Run the full questionnaire to check against your actual presence, activities, and data types.