The framework
Israel regulates personal data through the Protection of Privacy Law 1981, supervised by the Privacy Protection Authority.
For advertisers the consent posture matters most, and Israel sits in the opt-in bloc, where tracking and outreach need permission up front.
Key instruments
Protection of Privacy Law, Amendment 13
Overhauls definitions (personal data, sensitive data, processing), narrows database registration to large or sensitive databases, mandates privacy protection officers for significant processors, and gives the PPA administrative enforcement and substantial fines.
Communications Law Amendment 40 (Spam Law)
Opt-in consent for commercial messages by email, SMS, fax and automated dialing, with a narrow existing-customer exception; statutory damages without proof of harm fuel frequent class actions.
Marketing and advertising
Consent (informed, and often implied by conduct for non-sensitive contexts) underpins processing; the Spam Law requires opt-in for commercial email, SMS and fax. Most channel decisions here follow from that consent rule.
Cross-border transfers
Regulated by the transfer regulations; Israel holds an EU adequacy decision, reaffirmed in the EU's 2024 review.
Enforcement and penalties
Amendment 13 armed the PPA with administrative fines that scale with database sensitivity and size; its first, in July 2026, was NIS 256,000 against the health fund Meuhedet for failing to report a breach.