Tech⁠⁠, IP and Telecoms Law Newsletter Vol⁠⁠.23 September 2026

On August 19, 2026, Japan’s Ministry of Internal Affairs and Communications (“MIC”) published the Second Draft Report of the Working Group on User Information (Measures to Ensure Compliance with the External Transmission Regulations for User Information) (the “Second Draft Report”) and launched a solicitation of public opinions until September 18, 2026.¹ Following the public consultation, MIC is expected to finalize and publish the report after considering the comments received.

When users access websites or mobile applications, information relating to such users—such as cookies, advertising identifiers, and browsing history stored on their devices—may be transmitted to external parties without the users being aware of it. Japan’s External Transmission Regulations are intended to ensure that users have an opportunity to understand, and make informed decisions regarding, such external transmissions.²

The regulations apply to telecommunications carriers and certain other service providers specified in Article 164, paragraph (1), item (iii) of the Telecommunications Business Act that provide “telecommunications services with a significant impact on users’ interests.” Specifically, they cover services provided through browsers or apps, such as messaging intermediary services, social networking services (SNS), online bulletin boards, video-sharing platforms, online shopping malls, online search services, and online information services such as news, weather, video streaming, and map services.³

Where a covered service provider transmits to a user's device a program or other instructions that cause information stored on the device relating to the user to be transmitted to an external party, the provider must, in principle, provide users with an opportunity to confirm or control such transmission by adopting one of the following measures: (i) notifying the user, (ii) making the relevant information readily accessible to users (public disclosure), (iii) obtaining the user’s consent, or (iv) providing an opt-out mechanism.⁴

The Second Draft Report sets out proposed measures to promote compliance by websites subject to the External Transmission Regulations, based on the current state of compliance among website operators. From the perspective of user protection, it also seeks to encourage practices that go beyond the minimum legal requirements. To this end, the Second Draft Report recommends the preparation of “guidelines” explaining the requirements of the External Transmission Regulations and desirable compliance practices, together with sample templates illustrating how such practices may be implemented.

Importantly, the Second Draft Report goes beyond merely clarifying the minimum measures required by law and instead promotes a more user-centric approach by encouraging greater user involvement in decisions regarding the external transmission of user information. While it emphasizes that service providers should first ensure compliance with the legal requirements by providing the required notices or disclosures, it also identifies, as a best practice, the adoption of measures such as obtaining users’ consent or providing opt-out mechanisms that enable users to exercise greater control over the external transmission of their information.

In this way, the Second Draft Report not only encourages businesses to comply with the statutory requirements but also promotes enhanced user participation by encouraging measures beyond those legally required. It further proposes the development of practical guidelines and sample templates to assist businesses in implementing such measures. Once finalized, these guidelines and templates are expected to serve as important practical guidance for businesses that provide websites and mobile applications when considering their compliance with the External Transmission Regulations.

In light of growing concerns in recent years regarding the wrongful use of data-only SIM cards in special fraud and similar crimes, the Act Partially Amending the Mobile Phone Wrongful Use Prevention Act (the “Amendment Act”) was enacted and promulgated in May 2026. For an overview of the Amendment Act, please see our April 28, 2026 issue of the Data Security Newsletter.

The Amendment Act delegates certain details of the new regulatory framework to orders of the Ministry of Internal Affairs and Communications (“MIC Orders”). Since July 2026, the “Study Group on the Improvement of the Usage Environment for ICT Services” and its Working Group on Countermeasures against Improper Use of ICT Services have discussed the direction of regulatory framework development, including amendments to MIC Orders. On August 3, 2026, they published “Directions for Regulatory Framework Development in Light of the Amendments to the Mobile Phone Wrongful Use Prevention Act” (the “Report”) (in Japanese only), which summarizes the outcomes of those discussions.

The Report sets out the principal directions for amendments to MIC Orders and other subordinate rules in preparation for implementation of the Amendment Act, including: (i) bringing SMS-enabled data-only SIM cards within the scope of identity verification and related obligations, while excluding (a) SIM cards without SMS functionality and (b) data-only SIM cards for IoT devices that, even if they have SMS functionality, are subject to function or usage restrictions according to their intended purposes and therefore present a low risk of improper use; (ii) setting, under Article 11, Item 6 of the Amendment Act, the threshold for refusal to provide services at five lines each for voice SIM cards and SMS-enabled data-only SIM cards, while allowing the threshold to be increased to the number of lines for which a legitimate use has been verified; and (iii) permitting certain methods for verifying the authority or status of a representative or other person acting on behalf of a subscriber, including confirmation that the person is a cohabiting family member or legal representative, while providing that a business card or employee ID card alone will not be sufficient.

The Report sets out the direction for forthcoming amendments to the relevant MIC Orders. Telecommunications carriers, including mobile network operators and mobile virtual network operators, that will be affected by those amendments may wish to consider their approach going forward, taking into account the directions set out in the Report.

On September 10, 2026, the Consumer Affairs Agency published the Interim Report of the Study Group on the Consumer Contract Act in Light of Consumer Transactions in Modern Society and the Interim Report of the Study Group on Digital Transactions and the Act on Specified Commercial Transactions, etc. (in Japanese only). The former sets out the direction of potential amendments to the Consumer Contract Act, which serves as the general law governing consumer contracts, while the latter sets out the direction of potential amendments to the Act on Specified Commercial Transactions, which serves as the special law governing online sales and other specified commercial transactions.

Following the solicitation of public opinions to be conducted going forward, final reports are expected to be prepared, and further work is expected to proceed with a view to legislative amendments from next year onward. The two reports address a broad range of issues. This article focuses on those aspects that are particularly relevant to recent regulatory trends concerning dark patterns.

The Interim Report of the Study Group on the Consumer Contract Act in Light of Consumer Transactions in Modern Society proposes introducing provisions concerning withdrawal from continuing contractual relationships as an issue particularly relevant to dark patterns.

Specifically, the report indicates the following directions: (i) prohibiting obstruction of termination, meaning conduct by a business operator that prevents a consumer from exercising a right to terminate a contract despite the consumer having such right; (ii) introducing a rule requiring business operators to endeavor to provide consumers with reasonable means of withdrawing from contracts; and (iii) introducing an obligation for business operators to endeavor to provide information regarding the method and conditions for termination.

One of the typical dark pattern issues frequently encountered in practice concerns cancellation or termination procedures: while it is easy to sign up for a service, complex procedures are required when terminating it. It is therefore noteworthy that the report indicates a direction toward strengthening regulations in this area. In addition, new rules are also expected to be introduced regarding notices to consumers before renewal of contract terms and notices to consumers before changes to contract terms.

The Interim Report of the Study Group on Digital Transactions and the Act on Specified Commercial Transactions, etc. addresses, as an issue particularly relevant to dark patterns, measures to respond to techniques that steer consumers’ decision-making in advertising contexts.

Specifically, the report focuses not only on techniques that cause consumers to misunderstand, but also on techniques that pressure consumers into making unwanted applications or similar decisions through aggressive methods, such as intimidation or methods that cause nuisance or anxiety. On this basis, the report states that consideration should be given to “a certain degree of comprehensive regulation that can flexibly respond to the rapid evolution of dark patterns and similar practices.”

At the same time, the report states that, in order to ensure predictability for business operators and avoid a chilling effect, the scope of the regulation should be clarified “by indicating unlawful patterns, such as through a blacklist, and lawful patterns in subordinate regulations or guidelines.”

Given the wide variety of techniques that exist and the lack of clear boundaries between lawful and unlawful practices in relation to dark patterns, the approach of introducing comprehensive regulation at the statutory level may be seen as going beyond the regulatory methods traditionally adopted under the Act on Specified Commercial Transactions. The specific content of the regulations to be introduced going forward will therefore warrant close attention.

In addition, with respect to dark patterns at the contract formation stage, the report proposes strengthening disclosure obligations on final confirmation screens. With respect to dark patterns in the termination stage, the report proposes introducing rules against obstruction of termination procedures.

Since August 2026, several government guidelines and documents, as well as legislative amendments, of practical importance to the development, provision and use of AI have been published in Japan. We provide below a brief overview of these developments.

On August 25, 2026, the Intellectual Property Strategy Headquarters published the “Principles-Code  for Protection of Intellectual Property Protection and Transparency for the Appropriate Use of Generative AI” (in Japanese only). The Code is positioned as a soft-law instrument designed to encourage generative AI providers to enhance transparency and protect intellectual property rights; it is a voluntary code of conduct with no legally binding force. Accordingly, the Code does not impose mandatory disclosure obligations on generative AI providers. However, the government has stated that it expects generative AI providers that understand and accept the purpose of the Code to take actions consistent with its principles.

By way of example, the Code calls for disclosure regarding matters such as the outline of AI models, training data, and measures to protect intellectual property rights, as well as responses to inquiries from rights holders and users. For generative AI providers that accept the Code, a “comply or explain” approach has been adopted, under which they are expected either to implement the relevant principles (i.e., comply) or to explain why they do not (i.e., explain). To make the status of acceptance more visible, generative AI providers are expected to publish certain information on their own websites, and a notification system to the Intellectual Property Strategy Promotion Secretariat of the Cabinet Office is scheduled to begin on October 26, 2026. The Code may serve as a useful reference not only for companies that develop or provide generative AI services, but also for companies that procure or use such services, particularly when considering vendor due diligence and contractual disclosure or warranty provisions.

On August 21, 2026, the Ministry of Justice published a document titled “Relationship Between the Provision of AI-Based Legal Support Services in Business Fields and Article 72 of the Attorneys Act” (in Japanese only). This document supplements and expands the guidelines on contract-related legal support services published in August 2023, and is intended to enhance predictability as to how the provision of AI-based legal support services should be assessed in relation to the regulations prohibiting the unauthorized practice of law.

For example, the document indicates that where the design of the service and its core functions are not intended to be used in matters involving legal disputes or other case-specific issues, the service does not include functions specifically designed for such use, and appropriate governance measures are in place to prevent improper use by users, the service may be characterized as the provision of a “value-neutral service” and may not violate Article 72 of the Attorneys Act. On the other hand, where the service has functions specifically designed to prepare court filings, settlement agreements, or similar documents, it may raise concerns under Article 72. Legal tech service providers should therefore carefully review the scope of services, the nature of the outputs, whether the service involves legal judgment on a case-by-case basis, and the manner in which attorneys are involved in or supervise the service, in light of the above guidelines.

The Ministry of Justice also published the “Report on Civil Liability for Unauthorized Use of Likeness, Voices and Similar Attributes — Interpretative Guidelines on Publicity Rights Infringement and Related Issues Involving Generative AI” (in Japanese only). The report does not propose new legislation, but instead provides interpretative guidance on existing law. It clarifies that “likeness and similar attributes” protected by publicity rights and related rights include a person’s “voice,” and analyzes issues involving unauthorized use of likenesses, voices, and similar attributes through generative AI, including publicity rights, the right not to have one’s likeness or similar attributes used without permission, damages, injunctive relief, and the potential application of the Unfair Competition Prevention Act in cases.

For businesses involved in advertising, games, AI voice or image generation services, and similar areas, it is becoming increasingly important to ensure that the use of another person’s likeness or voice does not infringe rights, including by obtaining authorization from the individual or relevant rights holder, clearly defining the permitted scope of use, and appropriately managing training data and generated outputs.

In addition, amendments to the Public Offices Election Act and the Information Distribution Platform Act, promulgated on July 17, 2026, will introduce, from March 1, 2027, an obligation to clearly indicate on the screen that certain online election-related materials include images or videos created or modified using AI. Large-scale specified telecommunications service providers will also be required to take measures to mitigate adverse effects caused by the distribution of illegal information, false information, or distorted information that may undermine the fairness of elections, and to publish information on the implementation status of such measures.

Businesses involved in elections or political advertising, social networking services, video-sharing platforms, advertising distribution, and related services should consider developing internal systems for labeling AI-generated or AI-modified content, content moderation, and transparency measures.

These developments do not immediately impose uniform new regulations on all AI use. However, they reflect a broader trend toward requiring companies to enhance transparency, rights clearance, accountability, and internal governance in relation to the development, provision and use of AI. Companies should therefore consider reviewing their AI usage policies, vendor contracts, content production and advertising review processes, rights clearance procedures, log management, and complaint-handling processes in light of these government documents and legislative amendments.

On July 17, 2026, the “Act Partially Amending the Act on the Protection of Personal Information and Other Related Acts” (the “Amendment Act of the APPI”) (in Japanese only) was promulgated. The Amendment Act of the APPI was submitted to the 221st session of the Diet on April 7, 2026, and enacted on July 10, 2026.

The Amendment Act of the APPI is intended to address both the promotion of the appropriate use of personal information and other data, and the strengthening of the protection of data subjects and enforcement measures in a manner proportionate to the relevant risks. The key amendments include, among others, the introduction of exceptions to facilitate data utilization in connection with the creation of statistical information and AI development; the review of consent requirements where it is clear, in light of the circumstances of acquisition and other factors, that the relevant processing will not harm the rights and interests of the data subject; rules regarding the handling of children’s personal information; rules concerning facial feature data and similar data; the review of rules regarding the outsourcing of the handling of personal data; the streamlining of data breach reporting and notification to data subjects; rules regarding contactable personal-related information; confirmation obligations in connection with third-party provision under the opt-out mechanism; measures to enhance the effectiveness of recommendations and orders; the review of criminal penalties; and the introduction of an administrative monetary penalty system.

For further details on each amendment item and points to note for practical implementation, please also see our “Special Feature: Practical Responses in Light of the 2026 Amendments to the Act on the Protection of Personal Information” (in Japanese only).

The Amendment Act of the APPI will, in principle, come into effect on the date specified by Cabinet Order within a period not exceeding two years from the date of promulgation. Following the enactment of the Amendment Act of the APPI, the Personal Information Protection Commission (“PPC”) has been gradually clarifying the process for preparing for its implementation.

First, on July 31, 2026, in its “Future Initiatives of the Personal Information Protection Commission Following the Enactment of the Act Partially Amending the Act on the Protection of Personal Information and Other Related Acts” (in Japanese only), the PPC set out its policy to proceed with the preparation of relevant Cabinet Orders, PPC Rules, Guidelines and other instruments, to actively publicize the Amendment Act of the APPI and the related Cabinet Orders and Rules, and to develop its enforcement and technical review framework, including with respect to the administrative monetary penalty system and the exceptions for the creation of statistical information. The PPC also presented a roadmap with a view toward implementation around spring to July 2028. According to that roadmap, the PPC expects to consider and deliberate on Cabinet Orders, PPC Rules, Guidelines and Q&As during 2026, conduct the solicitation of public comments on the Cabinet Orders and PPC Rules around the beginning of 2027, and promulgate them around the first half of 2027. The Guidelines and Q&As are expected to be subject to public consultation and then published around mid- to late 2027.

Second, on August 26, 2026, in its “Overall Picture of Matters to Be Prescribed by Cabinet Orders, Rules, etc. under the Act Partially Amending the Act on the Protection of Personal Information and Other Related Acts” (in Japanese only), the PPC presented an overall picture of the matters to be developed through Cabinet Orders, PPC Rules, Guidelines and Q&As. These matters include the exceptions for the creation of statistical information, the review of consent requirements, the handling of children’s personal information, rules concerning facial feature data and similar data, the handling of personal data and other data by service providers, data breach reporting and notification to data subjects, contactable personal-related information, the opt-out mechanism, measures to ensure the effectiveness of recommendations and orders, and administrative monetary penalties.

Third, on September 9, 2026, in its “Future Process for Developing Cabinet Orders, Rules, Guidelines, etc. under the Act Partially Amending the Act on the Protection of Personal Information and Other Related Acts” (in Japanese only), the PPC indicated that, from September 2026 onward, it would present and discuss its basic approach for each category and theme of the Amendment Act of the APPI, followed by exchanges of views with organizations representing the perspectives of individuals and businesses, secretariat hearings, the presentation and discussion of draft Cabinet Orders and Rules, and public consultation. This process is described as a multi-stakeholder collaboration process.