Legal Requirements for Websites and Apps: Israel

Israel changed its privacy regime on 14 August 2025, when Amendment 13 to the Privacy Protection Law came into force — bringing GDPR-style definitions, mandatory privacy and security officers for defined categories of organisation, a narrower database registration duty, and, for the first time, an enforcement authority with real administrative fines running into the millions of shekels. Around that sit three rules that have been generating lawsuits against Israeli websites for years: the spam law, with statutory damages of up to ₪1,000 per message without proving any harm; the distance-selling disclosure and 14-day cancellation rules; and web accessibility, where covered services need to assess Israeli Standard 5568, applicable statements and exemptions. Assess privacy, marketing, consumer and accessibility obligations together. Which matters most depends on the product, data and customers; this guide does not rank the likelihood of claims. One advantage worth knowing: Israel holds an EU adequacy decision, so EU customer data can flow to Israeli servers without additional transfer mechanisms — a real commercial asset for Israeli SaaS. This is the Israel chapter of our pre-launch legal checklist. Run that prompt sequence first, then layer this on.

Key takeaways

• Amendment 13 has been in force since 14 August 2025: new definitions, officer appointment duties, narrowed registration, and administrative fines.
• A privacy officer is required for public bodies, qualifying data brokers processing information on more than 10,000 people, organisations carrying out significant regular and systematic monitoring as a core activity, organisations whose core activity involves large-scale sensitive data, and banks, insurers, hospitals and health funds.
• Database registration now applies mainly to public bodies and data brokers above 10,000 people; a separate notification duty applies to databases with sensitive information on more than 100,000 people.
• The Information Security Regulations (2017) require a database definition document, access control, incident handling and periodic audits, scaled to a security level.
• Spam law: prior written consent for advertising messages, the word "advertisement" in the message, and an opt-out in the same channel. Statutory damages up to ₪1,000 per message without proof of harm.
• Distance selling: full pre-contract disclosure, written confirmation, and a 14-day cancellation right — extended to four months for seniors, new immigrants and people with disabilities in qualifying transactions.
• Accessibility: Israeli Standard 5568 at level AA is mandatory under Regulation 35, and an accessibility statement is required.

Privacy after Amendment 13

What the amendment did. It modernised the 1981 law's definitions toward international norms, restructured the registration regime, created officer-appointment duties, and — most importantly — armed the Privacy Protection Authority with administrative enforcement powers and monetary penalties that can reach millions of shekels, some without an opportunity to cure first.

Privacy officer (ממונה על הגנת הפרטיות). Required for public bodies; qualifying data brokers processing information on more than 10,000 people; organisations whose core activities involve regular and systematic monitoring on a significant scale; organisations whose core activity involves processing sensitive information on a large scale; and financial institutions, insurers, hospitals and health funds. The officer must be independent, report to management and have adequate resources. Most small products fall outside this — assess each statutory category rather than assuming that any data-based business must appoint one.

Information security officer (ממונה אבטחת מידע). Assess the separate statutory appointment duty. It is not interchangeable with the privacy-officer role.

Registration and notification. Registration is now narrower: public bodies and data brokers with databases on more than 10,000 people. A separate duty to notify the Authority applies to databases containing sensitive information on more than 100,000 people. Many small businesses that previously registered no longer need to — but check where you land rather than assuming.

Notice at collection. When you ask someone for information, you must tell them whether provision is mandatory or voluntary and the consequence of refusal, the purpose, the controller’s identity and contact details, intended recipients and purposes, and the rights to inspect and request correction. This is a statutory duty at the point of collection, not something a policy page discharges on its own.

Consent. The Authority's guidance treats consent as requiring genuine understanding and a real choice: specific, informed, and not bundled into unrelated terms. Bundled "I agree to the terms and privacy policy and to receive marketing" checkboxes are the classic failure.

Information Security Regulations 2017. Still the operative security rulebook. Classify the database and applicable security level, then determine its definition-document, access-control, logging, incident, outsourcing and audit duties. Not every basic-level database has every higher-level audit requirement.

Rights. Individuals may review information held about them and demand correction of information that is incorrect, incomplete, unclear or out of date.

EU adequacy. Israel is recognised as providing adequate protection, so personal data can move from the EEA to Israel without additional safeguards. Worth stating explicitly in your sales materials if you sell to European customers.

The spam law — the one that produces lawsuits

Amendment 40 to the Communications Law governs "advertising messages" sent by email, SMS, fax or automated dialling.

• Prior consent, in writing (including electronic), is the rule. The consent must be specific and informed.
• Narrow existing-customer exception: if you obtained the details in the course of a sale or negotiation, told the customer the details would be used for advertising, and gave a simple chance to refuse — you may send about similar goods or services.
• Every message must be marked as an advertisement, identify the sender by name and address, and explain how to opt out.
• Opt-out must be available in the same channel the message arrived in — a reply, a link, or a text message — and must be simple and free.
• Statutory damages up to ₪1,000 per message without proof of harm, and class actions are common. This is the single most litigated digital rule in Israel.

The practical build implication: a separate, unticked marketing checkbox, with the exact wording stored alongside the timestamp, and an unsubscribe that works without logging in.

Selling: distance transactions

Under the Consumer Protection Law, a distance transaction (מכר מרחוק) requires disclosure before the deal: the business name, company or ID number and address, the main characteristics of the product or service, the price and payment terms, delivery time and method, the period the offer is valid, warranty details, and the cancellation rights and how to exercise them.

After the transaction, you must supply a written document — in Hebrew, or in the language used to market — repeating that information along with the manufacturer's name, country of origin and any additional terms.

Cancellation: generally within 14 days of receiving the product or the disclosure document, whichever is later; for services, check the later of the transaction and disclosure document and the service-specific notice and timing rules. For qualifying transactions involving people with disabilities, senior citizens and new immigrants, the window extends to four months. For eligible change-of-mind cancellations, fees are generally capped at the lower of 5% or ₪100; defects, non-conformity or non-delivery can require cancellation without that fee. Certain categories — perishables, made-to-order goods, some digital content — are excluded.

Prices must be shown in shekels including VAT, and consumer-facing information should be in Hebrew.

Accessibility — mandatory, and litigated

Assess whether the service is covered by Regulation 35 and which version of Israeli Standard 5568 applies. Exemptions depend on facts including business status, turnover and the age of the site; a blanket ₪100,000 threshold is not reliable.

The Commission’s current guidance lists a full technical exemption for an exempt dealer or turnover below ₪120,000, and further conditional arrangements for other turnover bands. Confirm your specific position against the official accessibility guidance; a general statement that everyone under ₪1 million is exempt would also be wrong.

Provide an accessible contact route and accurately describe the actual service and any exemption. Do not invent an accessibility coordinator or claim that a widget or automated audit proves compliance.

What's not regulated yet

Israel has no binding AI statute. Policy work exists — a national AI policy and sectoral guidance — and the Privacy Protection Authority has published positions on AI and personal data, but there is no equivalent of the EU AI Act. If your AI activities fall within EU AI Act scope, its relevant duties can apply; if you sell only in Israel, disclosure of AI is good practice and, where an AI answer could mislead a consumer, arguably required by consumer law rather than by AI law.

There is also no cookie-specific statute. The Authority's position is that cookies collecting personal information require consent, and Israeli practice has converged on EU-style banners — assess EU targeting and the actual tracking rather than relying only on a visitor’s location.

The Israel-specific prompt

Run this after the ten prompts in the main checklist:

Add Israeli compliance mechanics to this app. All user-facing text must be in Hebrew, with correct right-to-left layout. Implement each item and report exactly what changed:

1. A notice at every point of collection stating: whether provision is required or voluntary and the consequence of refusal, the purpose, the controller identity and contact details, recipients and purposes, and inspection/correction rights. Not a link to the policy — a visible line on the form. List every form and confirm each has one.
2. Separate contract acceptance, privacy information and optional marketing permission. Do not require a blanket privacy-consent checkbox simply to acknowledge the notice. Where a specific processing purpose requires consent, provide a separate informed choice. Keep marketing optional and unticked, and record wording, time and version.
3. Marketing messages: mark every advertising email or SMS as an advertisement, include the sender name and address, and provide an opt-out in the same channel that works without logging in and takes effect immediately. Log every opt-out with its timestamp.
4. A privacy policy in Hebrew stating what is collected, the purpose of each collection, who receives it, retention periods, security measures in general terms, the right to review and correct information, and a contact channel. Use placeholders [[LEGAL ENTITY]], [[COMPANY NUMBER]], [[ADDRESS]], [[CONTACT EMAIL]] where you cannot know the fact.
5. A database inventory: list every store of personal information in this app, what it contains, who can access it, and whether any of it is sensitive information — health, financial, biometric, political or religious views, sexual orientation, or data about minors. I need this for the database definition document.
6. Access control review: confirm each user account can only reach its own records, that admin actions are enforced server-side, that access is logged, and that no shared credentials exist.
7. If we sell: pre-contract disclosure showing business name, company number, address, main characteristics, total price in shekels including VAT, delivery time and method, warranty and cancellation rights; an automatic Hebrew confirmation document sent after purchase containing the same details; and a cancellation flow in the account area that works in at most two clicks.
8. An accessibility pass against WCAG 2.1 Level AA, plus a Hebrew accessibility statement page linked from the footer of every page with placeholders for the accessibility coordinator's name and contact.

For each item report PASS or explain what blocked it. Do not invent legal citations in user-facing text.
Copy prompt

Pre-launch checklist — Israel

• Notice at collection on every form: mandatory or voluntary, purpose, recipients
• Contract acceptance, privacy notice and optional marketing distinguished; required consents documented by purpose
• Hebrew privacy policy with purposes, recipients, retention and a correction route
• Marketing messages marked as advertisements with same-channel opt-out
• Database inventory compiled; database definition document prepared under the Security Regulations
• Officer appointment duties checked (privacy officer / information security officer)
• Registration or notification duty checked against the Amendment 13 thresholds
• Access control verified: no cross-user reads, server-side admin enforcement, logging
• Selling: full pre-contract disclosure, Hebrew confirmation document, 14-day cancellation, fee cap respected
• Accessibility to Standard 5568 AA (or documented exemption) plus a published accessibility statement

What the build checks establish

The prompts are implementation requests, not a legal certification. Two-click controls and consent-first defaults are practical design choices, not universal statutory requirements. Confirm jurisdiction, exceptions, retention and provider contracts separately. Verify controls with test accounts and actual browser/network behaviour; a builder’s PASS based only on code inspection is incomplete evidence.

Official sources and review scope

Updated September 14, 2026. The linked sources support the scope and corrections discussed here; this is an editorial review, not an exhaustive legal opinion or a certification of your product. Check the operative rule when acting.

• PPA Amendment 13 questions and answers
• PPA Amendment 13 professional guide
• Commission accessibility exemptions

In Israel, privacy, marketing and accessibility need separate scope checks. Run the pre-launch checklist, then the Israel prompt above. Selling abroad too? See the United States, the European Union, the United Kingdom, Canada, Australia and Brazil. You can build this.