"Our website uses analytics and ad tracking tags, but I recently heard about the 'External Transmission Regulations.' Do we need to add something to our privacy policy? For that matter, does this even apply to us?"—This was a question we recently received from a corporate website manager at an SMB.
Google Analytics tags, ad conversion tags, social sharing buttons, embedded maps—these features taken for granted on corporate websites actually send user information to external third-party servers. Under the External Transmission Regulations of Japan's amended Telecommunications Business Act enacted in June 2023, businesses are obligated to inform users about such transmissions. However, very few SMBs know whether their sites comply. In this article, we clarify what is required and what corporate websites should do, broken down to a level easily understood by project commissioners.
Cookie consent and external transmission regulations are distinct concepts
First, let us distinguish between two things that are frequently conflated. When "Cookie regulations" appear in the news, two distinct regulatory concepts are often mixed together.
The first is opt-in Cookie regulation represented by the EU's GDPR and ePrivacy Directive. While this applies when offering services to Europe, an EU-style prior consent banner is not uniformly mandatory for corporate websites targeted at the domestic Japanese market.
The second is Japan's External Transmission Regulations under the amended Telecommunications Business Act. This does not mandate "obtaining consent"; rather, it requires that when sending user information to external destinations, you must make that fact readily understandable to the user. In short, what Japanese corporate websites must address first is not an EU-style consent banner, but the visualization of external transmissions. Confusing this and assuming that "adding a consent banner is enough" leaves out the essential disclosures.
What external transmission regulations require of corporate websites
The External Transmission Regulations apply to actions that cause information stored on a user's device (such as Cookies) to be sent to external operators. Most websites—using analytics, ad distribution, social media integration, or embedded content—fall under this scope. The required response broadly comes down to one of the following:
The standard requirement is notification or public disclosure. You must present what information is sent, to which party, and for what purpose in a format accessible to users. In practice, this generally involves compiling and publishing an "External Transmission Disclosures" section within the privacy policy or on a dedicated page linked continuously from the footer. If you use Google Analytics or GTM, you need to inventory what they transmit (see our Introduction to GTM article for tag management overview and our Introduction to GA4 article for analytics basics).
In addition, options include providing an opt-out mechanism allowing users to refuse transmission, or obtaining explicit consent, with the ideal combination depending on the data handled and nature of the business. For SMB corporate websites, the practical first step is to identify what data is sent and organize the public disclosure items.
| Discussion point | Common misconception | What is actually needed |
|---|---|---|
| Cookie consent banner | Adding one completes compliance | Public disclosure of external transmissions is separately required |
| Applicable websites | Only large enterprises and e-commerce | Applies to SMBs as well if analytics or ad tags are present |
| Required action | Leaving privacy policy unchanged | Auditing and explicitly disclosing destinations and purposes |
Accurate disclosure is impossible without an inventory of tags
The biggest obstacle in complying is that no one knows what their site is actually transmitting externally. Leaving the website to a production agency for several years, changing administrators, and quietly accumulating tags across multiple analytics, advertising, and chat tools is a common story on SMB corporate sites.
Accurate disclosure requires an initial tag inventory. While management is straightforward if everything is organized in Google Tag Manager (GTM), hardcoded tags often linger directly in the HTML, making it essential to verify actual transmission destinations using browser developer tools. Formulating disclosure items based on inventory findings and removing obsolete tags are critical steps. Skipping this diligent verification and simply pasting a boilerplate privacy policy risks discrepancies between stated terms and actual transmissions, creating legal risks.
Case study: A company that audited legacy tags and aligned disclosures with actual practice
Here is a concrete example. A company (name withheld) that had operated its corporate site without changes since its launch several years prior consulted us, stating: "We want to comply with the External Transmission Regulations, but we do not know where to begin." Upon investigation, we found tags from discontinued analytics tools, a heatmap tool added personally by a past staff member, and social embeds all coexisting, directly conflicting with their privacy policy.
We began by identifying every tag currently sending data and removing the unused ones. For the remaining tools, we documented what information was sent to which provider for what purpose, created a new external transmission disclosure page, and linked it permanently in the site footer. In addition, we summarized a one-page approval rule for adding tags going forward to prevent uncontrolled proliferation. What worked was not pouring over legal texts, but first visualizing what was actually being transmitted and aligning the disclosures with reality.
Do not rush to add consent banners; start with an inventory and disclosure
A word of caution on sequencing: hearing "Cookie compliance" often makes companies want to install a consent banner immediately, but for Japanese corporate websites, the priority is inventorying externally transmitting tags and establishing disclosure items. Adding a consent banner without this in place leaves the required disclosures empty. First audit tags, remove unnecessary ones, and create a public disclosure page. Then, evaluate consent mechanisms if you serve EU markets or require stricter compliance—this order makes the most sense both cost-effectively and practically. While final legal interpretations should be confirmed with legal counsel where necessary, web production and operations teams are best suited to handle the visualization and display of actual site behavior.
If you are unsure whether your site falls under external transmission regulations, have unorganized legacy tags, or worry that your privacy policy does not match reality, please feel free to reach out through GleamHub's free web production and maintenance consultation. From tag auditing and disclosure drafting to removing obsolete tags and establishing future addition rules, we will partner with you to achieve compliance tailored to your situation.
