1. General understanding of click-wrap and browse-wrap methods
Data subject consent is a mandatory and paramount requirement in most personal data protection legal systems worldwide. In Vietnam, data protection regulations have an approach that is relatively similar to the standards of the European Union’s General Data Protection Regulation (GDPR). Decree 13/2023/ND-CP on Personal Data Protection (Decree 13) requires that “consent” must be a clear, voluntary, and specific expression of the data subject’s permission for data processing.
In practice, due to practical operational barriers and the need to apply technological solutions to the personal data processing workflow, many businesses prioritize using electronic methods to obtain data subject consent when processing personal data. Among these, obtaining consent via “click-wrap” (consent through clicking a button and/or checkbox) or “browse-wrap” (consent through continued browsing) are two methods that businesses prioritize for their convenience and automation.
“Click-wrap” consent refers to obtaining agreement through an explicit user action – typically clicking an “I Agree” button or ticking a checkbox – indicating acceptance of the terms or personal data processing policies. In contrast, “browse-wrap” consent collects agreement based only on the implied understanding that the data subject continues to use a website. Essentially, the “click-wrap” method fundamentally differs from the “browse-wrap” method in the factor of demonstrating active and explicit consent from the data subject.
Regarding this issue, we should refer to the approach of the GDPR as the leading and highly influential law on personal data protection globally. According to the GDPR, any consent for processing personal data must meet strict criteria. The GDPR defines consent as a freely given, specific, informed, and unambiguous indication of the user’s wishes, given by a clear affirmative act. Thus, simply continuing to browse a site or burying consent in a footer link is not sufficient to be considered valid consent from the user (data subject). In practical terms, the GDPR requires that the user must take a clear opt-in action – for example, clicking an “I Accept” button or ticking an unchecked box – to signify agreement. The GDPR also explicitly notes that valid consent can be given by ticking a box when visiting an internet website, whereas silence, pre-ticked boxes or inactivity do not constitute consent.
Therefore, it can be understood that, as a general principle, consent through the “click-wrap” method will be recognized as legally valid, while the validity of the “browse-wrap” method is the opposite. Of course, the final determination of whether consent in a specific situation is valid will still depend on the detailed content and practical implementation of the “click-wrap” method.
2. Regulations of Vietnam’s personal data protection laws
In 2023, the Vietnamese government issued Decree No. 13/2023/ND-CP on Personal Data Protection (Decree 13), which was the first comprehensive legal document (at the Decree level) on personal data protection in Vietnam. Currently, the Law on Personal Data Protection (PDPL) was passed on June 26, 2025, and will take effect on January 1, 2026, serving as the first comprehensive legal document at the law level regulating personal data protection.
Decree 13 defines “consent” as a clear, voluntary, and specific expression. Notably, Decree 13 stipulates that valid consent methods include a written statement, voice confirmation, ticking a consent checkbox, sending a consent-confirming message, selecting technical settings to consent, or other actions that clearly indicate consent. In other words, clicking an “I agree” button in a click-wrap format is a valid method of obtaining consent under Decree 13, provided that all requisite information is given to the user and the action is truly voluntary. Conversely, silence as demonstrated in the “browse-wrap” method will be unlikely to be recognized as valid.
The data subject’s consent is only valid when the data subject voluntarily and clearly knows the following content: (i) the type of personal data being processed; (ii) the purpose of processing the personal data; (iii) the organization or individual processing the personal data; and (iv) the rights and obligations of the data subject. Only when the user has this full information and still voluntarily consents is that consent considered valid. Furthermore, similar to the principles of the GDPR, Vietnamese law stipulates that consent must be tied to a single specific purpose – it cannot be grouped for multiple purposes at once.
However, the provision on consent under the PDPL no longer contains specific content regarding ticking a consent checkbox, as in the click-wrap method. Detailed regulations on specific consent methods under the PDPL will require a new guiding Decree from the Government. Pending a new Decree, we believe that the approach under Decree 13 remains a valid reference and is applicable.
3. Recommended actions for Click-wrap method
User awareness is crucial in this matter. In our view, the key lies in how the website or data processing notice is designed. Below are some best practices for implementing a suitable “I Agree” (click-wrap) button:
(i) Require users to actively tick the consent box – No pre-ticked boxes: Ensure that the default state is that no consent has been given; the user must take an action (click or tick) to consent. Do not display pre-ticked boxes or assume consent from inaction. The user’s choice should be deliberate and unambiguous.
(ii) Avoid coercive or misleading design: The consent interface should be neutral and clear, not designed to “nudge” users into consenting. Do not hide important information in hard-to-find links or fine print, and avoid using design tricks (such as a bright, enticing “Agree” button versus a faded “Decline” link) that pressure users into one choice.
(iii) Separate consent from other terms: It is a best practice to keep privacy consent separate from general terms and conditions. Users should not be forced to consent to data processing simply to accept non-privacy related terms. For example, instead of a single “I accept the Terms and Privacy Policy” checkbox, consider having a distinct consent checkbox for personal data use.
(iv) Make consent granular and purpose-specific: Wherever applicable, divide consent into categories or purposes so that the user can consent to some types of data processing and not others.
4. Summary
In the EU, regulatory actions and court decisions have clarified what constitutes valid consent in practice. The situation in Vietnam is different, as the personal data protection regime is still very new (effective July 2023 under the framework of Decree 13), so specific enforcement cases have not yet been publicly disclosed.
However, it can be expected that both the legal frameworks of the EU and Vietnam recognize the click-wrap method as a viable way to obtain consent – but only when implemented with respect for user autonomy and transparency.
Written date: 20/08/2025
Related posts:
1/ Notification of personal data protection violation
2/ Consent of personal data subjects in cyberspace
3/ New legal framework for data management in Vietnam
Disclaimers:
This article is for general information purposes only and is not intended to provide any legal advice for any particular case. The legal provisions referenced in the content are in effect at the time of publication but may have expired at the time you read the content. We therefore advise that you always consult a professional consultant before applying any content.
For issues related to the content or intellectual property rights of the article, please email cs@apolatlegal.vn.
Apolat Legal is a law firm in Vietnam with experience and capacity to provide consulting services related to Data and contact our team of lawyers in Vietnam via email info@apolatlegal.com.
