Israel Privacy Protection Law and browser fingerprinting

What the Privacy Protection Law says about fingerprinting

Israel's Privacy Protection Law 5741-1981 (PPL) was enacted in 1981 and has been amended multiple times. The most material modernisation is Amendment 13 (Hok Haganat HaPratiut Tikun 13), signed 7 August 2024 and entering into force 14 August 2025, with transitional provisions for certain compliance obligations extending to August 2026.

The PPL defines personal data broadly as information about an individual's personality, personal status, intimate affairs, health, financial situation, opinions, beliefs, and similar attributes. The Privacy Protection Authority (PPA), which was restructured and empowered under Amendment 13 from the former Israeli Law, Information and Technology Authority (ILITA), has confirmed in published guidance that online identifiers fall within this definition. A browser fingerprint composed of device characteristics such as canvas output, GPU renderer, audio context, installed fonts, and time zone is personal data under the PPL the moment it is used to recognise the same browser across sessions.

Section 7 of the PPL designates a subset of personal data as 'sensitive information', attracting heightened obligations. The enumerated categories include health, financial circumstances, opinions, beliefs, behaviour in a private domain, genetic data, and biometric data. A fingerprint hash is not itself biometric data, but a fingerprinting deployment that is used to infer medical conditions, political beliefs, or private behaviour crosses into the sensitive-information category, triggering the stricter regime.

Section 8 database registration: Israel's unique requirement

Israel is the only major Western privacy regime with a mandatory database registration requirement. Section 8 of the PPL requires controllers to register their databases with the PPA before processing begins, when any one of the following triggers applies: the database contains data on more than 10,000 individuals; the database contains sensitive information as defined in Section 7; the database is used for direct marketing purposes; or the database is controlled by certain entity types specified in the statute.

A fingerprinting deployment that tracks more than 10,000 Israeli individuals will almost always meet the first threshold on its own. A deployment that processes data from fewer individuals but uses fingerprinting to infer sensitive attributes (health, political opinion) triggers the sensitive-data threshold. A deployment used for direct-marketing personalisation triggers the direct-marketing threshold independently of user count.

Amendment 13 modernised the registration requirements and the registry's operational framework but did not remove the registration obligation. Non-registration is an independent violation, separate from any failure of consent or transparency. The PPA has treated non-registration as an aggravating factor in enforcement proceedings.

Consent requirements under Amendment 13

Amendment 13 aligned Israel's consent standard with the GDPR framework. Consent must be explicit, informed, and freely given. For a fingerprinting deployment, this means three operational consequences that mirror the GDPR pattern but now apply under Israeli law.

First, consent must be obtained before the fingerprint signal is collected. A mechanism that fires the fingerprinting script before the user actively agrees is non-compliant by construction. The PPA has signalled in published guidance that passive or pre-ticked consent mechanisms do not satisfy the amended standard.

Second, refusing consent must be as straightforward as granting it. Designs that bury a 'reject' option behind multiple navigation steps, or that make 'Accept' the dominant and prominent choice while hiding 'Decline', are inconsistent with the 'freely given' element. Third, consent must be specific. A single 'I agree to the terms' checkbox that covers fingerprinting alongside unrelated processing activities does not satisfy the 'informed' element when the user could not reasonably know that fingerprinting was one of the purposes.

Amendment 13: what changed and why it matters for fingerprinting

Amendment 13 is the most substantial overhaul of Israeli privacy law since 1981. The headline changes most relevant to fingerprinting deployments are as follows.

Fines increased dramatically. The maximum administrative penalty rose from NIS 26,000 to NIS 320,000 per breach. For breaches classified as 'serious', a multiplier applies; for breaches classified as 'very serious' (which includes breaches involving sensitive data, large-scale processing, or non-cooperation with the PPA) the effective ceiling can reach NIS 1.6M or more. Pre-Amendment-13 fine estimates are obsolete.

Breach notification is now mandatory. Controllers must notify the PPA within 30 days of discovering a serious breach. A fingerprinting deployment that suffers a data breach exposing fingerprint hashes at scale (a breach that exposes the fingerprinting database) is likely to qualify as a serious breach, triggering the notification obligation. Internal breach-response procedures need to account for the 30-day window.

DPO obligations were introduced for designated controllers. Amendment 13 requires certain categories of controller to appoint a Data Protection Officer. Whether a specific organisation falls within the designated categories depends on factors including scale of processing, sensitivity of data, and organisational type. Controllers using fingerprinting at significant scale should assess their DPO obligation as part of Amendment 13 compliance.

Data subject rights were modernised. The rights of access, rectification, and deletion (in specific circumstances) were aligned with the GDPR baseline. A controller running a fingerprinting deployment must be able to respond to a data subject access request that asks 'what data do you hold about me?' including fingerprint-derived identifiers, and must have a process for responding to deletion requests.

EU adequacy and cross-border transfer obligations

Israel has held an EU adequacy decision since 2011. The European Commission renewed the decision in 2024 following its review of the post-Amendment-13 legal framework. Israeli controllers can freely transfer personal data to and from EU/EEA member states without additional safeguards. For an Israeli publisher or SaaS that uses a fingerprinting SDK hosted in an EU data centre, the Israeli-to-EU data flow is covered by adequacy.

The reverse direction is also covered: EU controllers sending fingerprint data to an Israeli processor receive the benefit of the adequacy decision. This is a meaningful differentiator for Israeli data processors competing for EU business.

Transfers to non-adequate jurisdictions require a separate legal basis under Section 36 of the Privacy Protection Regulations (2001). India is not on Israel's adequacy list. A controller routing fingerprint data through an India-hosted processor must rely on contractual safeguards (typically standard contractual clauses or a binding data processing agreement with equivalent protections), explicit data subject consent, or a specific statutory exemption. This obligation applies to Benny the Doorman's infrastructure specifically, as Benny processes in Chennai, India.

Direct marketing: Section 30A and the Atrr Atzmi registry

Section 30A of the PPL gives individuals an explicit opt-out right from direct marketing. Israel operates a national do-not-marketing registry called Atrr Atzmi ('My List'). A fingerprinting deployment used to identify returning users for direct-marketing personalisation must check the Atrr Atzmi registry and honour opt-outs recorded there, in addition to meeting the database registration requirement and obtaining valid consent under Amendment 13.

The direct-marketing trigger for Section 8 registration is independent of individual count. Even a small deployment targeting only 500 individuals triggers the registration obligation if the purpose includes direct marketing. This is a common compliance gap for smaller e-commerce operators using fingerprinting purely for retargeting.

Enforcement context

PPA enforcement under the pre-Amendment-13 regime was limited by the modest fine ceiling of NIS 26,000 per breach. Several enforcement actions established the PPA's willingness to use its powers, including in technology and data-handling contexts, and are relevant background for understanding how the PPA approaches violations.

In 2020, the PPA (then operating as ILITA) took enforcement action against Boeing Israel in connection with a data breach affecting employees and job applicants. The enforcement highlighted the authority's focus on both the breach-response obligation and the adequacy of security measures for databases containing personal data, including data collected through online channels.

In 2023, the PPA issued enforcement findings against Shufersal, Israel's largest supermarket chain, in connection with customer data handling. The enforcement focused on data retention practices and the scope of data processing relative to disclosed purposes, a framework directly applicable to fingerprinting deployments where the retention period and purpose scope are not clearly bounded.

Since Amendment 13 entered into force in August 2025, the PPA has published a series of enforcement notices and compliance guidance documents indicating priority focus areas for the new regime. The authority has flagged consent mechanism design, breach notification readiness, and database registration completeness as the three areas where it expects to concentrate early enforcement efforts. Controllers with fingerprinting deployments that have not been updated to reflect Amendment 13 should treat these as the primary risk vectors.

How Benny the Doorman fits into an Israel PPL-aware deployment

Benny is a fingerprinting SDK and hosted API, not a consent management platform and not a database registration service. The Israel PPL compliance obligations described on this page sit with the controller deploying Benny, not with Benny as a processor. That said, the integration architecture requires specific attention to two Israel-specific requirements that differ from the GDPR or CCPA patterns.

First, the Section 36 transfer obligation. Benny's processing infrastructure is located in Chennai, India. India is not on Israel's adequacy list. Before an Israeli controller routes fingerprint data through Benny's API, that controller must put in place contractual safeguards that provide equivalent protections to those available under Israeli law. Benny's standard data processing agreement (DPA) is the contractual instrument for this purpose; Israeli controllers should review it specifically against the Section 36 requirements and, where necessary, supplement it with additional clauses.

Second, the Section 8 registration obligation. If the Benny deployment will process fingerprint data on more than 10,000 Israeli individuals, or if the purpose includes sensitive data processing or direct marketing, the controller must register the database with the PPA before going live. The registration record should describe the database, its controller, the categories of data, the processing purposes, and the recipients to whom data is disclosed, including processors such as Benny.

For the consent-gating integration pattern, Benny's fingerprint API call should be deferred behind the consent signal from the controller's consent management platform for the relevant purpose category. The fingerprint collection must not fire before the user has given affirmative consent, in line with Amendment 13's explicit-consent requirement.