Jordan Personal Data Protection Law Cookie Consent Compliance Guide: Law No. 24 of 2023 for Publishers in 2026
Jordan became the first country in the Levant to enact a comprehensive data-protection statute with Personal Data Protection Law No. 24 of 2023, published in the Official Gazette on 17 September 2023, with a six-month grace period that brought it into binding force in March 2024. The Law is administered by the Personal Data Protection Council, an independent body the Law established under the Ministry of Digital Economy and Entrepreneurship, with day-to-day oversight responsibilities and the authority to issue executive regulations, designate adequate jurisdictions for cross-border transfer, and impose administrative penalties. By 2026 the Council is staffed, the executive regulations cover the procedural and substantive surface, and Jordanian enforcement has moved from a theoretical possibility into a documented track record. The implication for publishers is straightforward: a cookie-consent posture that worked under the pre-2023 patchwork is no longer sufficient, and a posture that satisfies the GDPR will satisfy the Jordanian PDPL only when the integration accounts for the specific points where the regimes diverge.
What the Jordanian PDPL actually requires
The Law applies to the processing of personal data of individuals located in Jordan regardless of where the controller or processor is established, and to controllers and processors located in Jordan regardless of where the data subjects are located. The territorial scope is therefore broad and catches most publishers serving Jordanian readers, with the most common edge case — a non-Jordanian publisher with no Jordanian infrastructure but with Jordanian visitors — resolved by reference to whether the controller has actively directed services into Jordan. Personal data is defined broadly as any information that identifies or makes identifiable a natural person, with sensitive personal data — including data relating to ethnic origin, political opinion, religious belief, health, sexual life, criminal records, and financial data — subject to a higher consent threshold and additional procedural protections.
The Law establishes lawful bases for processing, the standard slate of data-subject rights — access, rectification, erasure, restriction, objection, and portability — a controller-processor accountability framework with mandatory data-protection-officer appointment for higher-risk categories, breach-notification obligations to the Council within 72 hours of awareness, cross-border-transfer controls that turn on Council adequacy designations or approved safeguards, and an administrative-penalty regime with fines up to JOD 1 million per breach plus criminal sanctions for the most serious categories including unauthorised cross-border transfer and processing of sensitive data without proper basis.
How the PDPL treats cookie consent
The Jordanian PDPL does not contain a separate ePrivacy-style provision on cookies; cookies and analogous storage-and-access technologies fall within the general consent framework. The standard is explicit, voluntary, specific, and informed agreement evidenced by an affirmative act — the family of requirements that the GDPR set as the global baseline and that Jordan has imported with its own procedural overlay. The Council, in its issued guidance, has confirmed that pre-ticked boxes, implicit consent inferred from continued browsing, and bundled consent banners do not satisfy the Law's threshold. That brings Jordan firmly into line with the global trajectory and means the posture publishers already maintain for the EEA is the right starting point for Jordanian traffic.
The practical effect is that cookies and analogous technologies which are not strictly necessary to deliver the service the user has actively requested must not be set before the user has consented. Strictly-necessary cookies — session identifiers, cart contents, security tokens, load-balancing cookies — can be set on the basis that the user has actively requested the service. Everything else — analytics, advertising, personalisation, A/B testing, session replay, and any third-party tag — requires prior consent.
How the Jordanian PDPL diverges from the GDPR in practice
Three differences matter when wiring a CMP. First, the PDPL requires controllers processing the personal data of more than a Council-defined threshold of data subjects, or processing sensitive personal data, to register with the Council and obtain a processing licence — a documented authorisation that must be renewable on the Council-defined cycle and produced on request. Second, the PDPL's cross-border-transfer rules require the Council to designate destination jurisdictions; transfers to undesignated jurisdictions require either explicit data-subject consent, contractual safeguards approved by the Council, or one of the narrow statutory derogations. Third, the PDPL imposes a mandatory data-protection-officer appointment for controllers above the Council-defined threshold, with the DPO named in the controller's filings with the Council and serving as the point of contact for data-subject requests and Council queries.
What a compliant cookie banner looks like under the PDPL
The technical requirements converge with what every modern CMP already produces, but the labelling, the documentation, and the consent log must reflect Jordanian specifics. The first-layer banner must present the user with a real choice — accept, reject, manage — where the reject option is at least as prominent as the accept option. Bundled consent is prohibited, so the second layer must allow per-category opt-in covering at minimum analytics, advertising, and any cross-border-transfer-dependent processing. Categories must default to off; the banner must not load tags until the user has affirmatively flipped them on.
The privacy notice surfaced from the banner must identify the controller, the controller's Council registration number where applicable, the categories of personal data collected, the lawful basis for each processing purpose, the data-retention period, the categories of recipients including any sub-processors located outside Jordan, the data subject's rights under the Law, the DPO's contact details where the DPO appointment is mandatory, and the Council's contact details for complaints. A notice that meets the GDPR's Article 13 standard substantially overlaps but the Council-registration and DPO-contact lines must be added explicitly.
The integration pattern that passes a Council review
The reference implementation has four moving parts. The first is a CMP that supports per-category, default-off opt-in and exposes the user's choice via a structured consent string the publisher can persist. The second is a tag-loading layer — a server-side tag manager or a CMP-native gate — that strictly enforces consent state before any non-essential cookie is set. The third is a consent log, stored server-side, that records for every consent event the user's choice per category, the timestamp, the banner version, and a truncated or hashed IP identifier such that the controller can produce the record on Council request. The fourth is a withdrawal path at least as easy as the original grant — typically a persistent banner re-open link in the footer.
- Analytics tags — Google Analytics 4, Adobe Analytics, Matomo, Amplitude, Mixpanel, PostHog, Heap — must load only after the analytics category is granted. Each platform supports a consent-gated configuration that prevents any cookie write before the gate flips.
- Advertising tags — Google Ads, Meta Pixel, TikTok Pixel, LinkedIn Insight, programmatic header bidders — must be similarly gated, and where the advertising partner transfers data outside Jordan to a jurisdiction the Council has not designated the recipient jurisdiction and the basis for transfer must appear in the privacy notice.
- Session-replay and heatmap tools — Hotjar, Microsoft Clarity, FullStory, Contentsquare — must sit behind a separate, stricter gate because the Council has aligned with international guidance flagging the rendering of input fields as a category requiring explicit and granular consent.
- Cross-border-transfer disclosures must be specific to each recipient jurisdiction and reference the Council adequacy designation, an approved safeguard, or explicit data-subject consent as the legal basis.
Validation, registration, and audit posture for 2026
A defensible Jordanian deployment in 2026 must pass four technical checks. First, a clean browser session served from a Jordanian IP address must produce zero non-essential cookies before the banner has been actioned. Second, the reject-all path must result in the same posture as a no-action session — no analytics tags, no advertising tags, no session-replay scripts. Third, an accept-all flow must produce only the tags the user has consented to, and the consent log must contain a matching record. Fourth, a withdrawal flow must immediately stop further tag fires, expire the cookies set during the consented session, and trigger any downstream deletion or opt-out signals the recipient partners require.
Beyond the technical checks, the registration and audit posture is what makes a deployment defensible. Controllers processing the personal data of Jordanian residents above the Council-defined thresholds must hold the relevant Council registration and processing licence, and the registration record — together with the consent log, the privacy notice, the data-protection-impact-assessment results for higher-risk processing, the DPO appointment paperwork, and the cross-border-transfer authorisations — forms the documentation the Council may request during a compliance review. A correctly configured CMP with a server-side log, a tag-loading layer that enforces consent state, a privacy notice that names each cross-border-transfer destination, the DPO and Council contact lines, and the registration paperwork on file is what turns the Jordanian PDPL from a regulatory unknown into a defensible part of a publisher's Levant-region consent posture.