Amendment 13 to the Privacy Protection Law came into force on August 14, 2025, broadened the definition of personal information and gave the Privacy Protection Authority significant enforcement powers, including financial sanctions. For brands advertising digitally, the practical implication is to put three things in order: what is collected on the site and in the app, how the user's consent is obtained and passed on, and how conversion data reaches the advertising platforms in a complete and controlled way.
In brief
- הרגולציה התהדקה. Amendment 13 broadened the definitions, the duty to inform and enforcement powers, and some companies are required to appoint a privacy protection officer.
- הסכמה צריכה להיות אמיתית. According to the Authority's opinion on consent, published in final form in February 2026, silence is not consent, and using information for profiling unrelated to the transaction requires active consent.
- מדידה חסרה עלולה לפגוע במדיה. Google's and Meta's advertising systems learn from the conversion data they receive, so missing events or consent that isn't passed on correctly can weaken optimization.
- מתחילים במיפוי. First check what runs on the site and what is sent, and only then decide which components are needed: a consent mechanism connected to Consent Mode, server-side measurement or direct conversion integrations such as the Conversions API.
What is Amendment 13 to the Privacy Protection Law, and what does it change?
Amendment 13 to the Privacy Protection Law is the broadest update to Israel's Privacy Protection Law since it was enacted in 1981, according to the Privacy Protection Authority's professional guide. The amendment was approved in August 2024 and came into force on August 14, 2025.
The first change is in the definitions. Personal information is now defined broadly, as any data relating to an identified or identifiable person, instead of a closed list of information types. At the same time, a category of "information of special sensitivity" was established, which includes, among other things, medical, genetic and biometric information and location data. The term "processing" was also broadened, and includes collecting, storing, copying, disclosing and transferring information.
The second change is in enforcement. The Authority was given the power to impose financial sanctions for violations of the law and of the information security regulations, and the courts can award damages without proof of harm for certain violations. In addition, the duty to inform was expanded: anyone collecting information from a person must make clear whether providing it is mandatory or voluntary, the consequences of refusing, and their rights to review and correct the information.
The third change concerns the structure of responsibility. Some organizations must appoint a privacy protection officer, including public bodies, data brokers, organizations whose core business is processing sensitive information at large scale, and organizations whose main activity includes regular and systematic monitoring of people. In its opinion on appointing an officer, the Authority clarifies that such monitoring can include tracking user activity on websites and apps and building profiles for targeted advertising. Whether your company falls within this definition is a legal question that depends on its actual activity.
This article describes the amendment in general terms only and is not legal advice. For questions about your company's specific obligations, consult its legal counsel.
Why does Amendment 13 affect measurement and campaigns?
Amendment 13 affects measurement because many measurement and advertising tools on a site collect identifiers and behavioral data, and these may be considered personal information under the broad definition.
A pixel, an analytics tag or a chat tool's script can send information to a third party when a page loads. It isn't always easy to say with certainty how many such tags run on the site, what each one sends and where. This is the kind of information that should be documented and controlled in light of the amendment.
At the same time, the campaigns themselves depend on data. Google's and Meta's automated buying systems make most of the bidding and targeting decisions, and they learn from the conversion events they receive. When events are missing, when consent isn't passed on correctly or when a tag breaks after a site update, the system learns from a partial picture and allocates budget accordingly.
In other words, the same housekeeping that reduces legal exposure can also improve the quality of the data media learns from. So the topic belongs with marketing too, not just with the legal department. The following table connects the changes with what is worth checking.
| What changes | What to check in marketing measurement |
|---|---|
| A broad definition of personal information | Which identifiers are collected on the site and in the app: cookies, device IDs, email addresses and phone numbers |
| Broadening of the term "processing" | Where each tag sends data, and who in the company and at vendors has access to it |
| An expanded duty to inform | Whether the privacy policy describes what actually happens on the site, including advertising and measurement tools |
| The Authority's consent principles | Whether the consent request is clear, and whether it's possible to refuse without a design that makes it hard or misleading |
| Information of special sensitivity | Whether precise location or medical information is collected, and whether it is sent to advertising platforms |
| Financial sanctions | Whether there is orderly documentation of tags, consents and processing agreements with vendors |
| Privacy protection officer | If an officer has been appointed, whether they are involved in decisions on new measurement tools |
What do you need to know about cookies on the site and cookie consent?
Cookies are small text files the browser stores, used to identify a user across pages and visits, for measurement and for advertising.
The Authority's guide to Amendment 13 does not deal with cookies explicitly. However, the broad definition of personal information and the Authority's opinion on consent are relevant to any mechanism in which a user is asked to approve the collection of information. According to the opinion, consent must be informed and freely given, and silence or lack of objection is not consent. The Authority also notes that a design that makes it hard to understand or to refuse, known as dark patterns, undermines the validity of consent.
The Authority further notes in its opinion that using information for profiling or direct marketing unrelated to the transaction itself requires active consent, and that a user may withdraw consent. From a brand's perspective, these are questions worth examining in the design of the cookie banner too.
In practice, cookie consent is not just a banner. It needs to connect to the tools: if a user refused advertising cookies, the advertising tags need to know it and act accordingly. A CMP (Consent Management Platform) is a platform that displays the consent request, stores the user's choice and passes it to the measurement and advertising tools.
What is Consent Mode?
Consent Mode is a Google mechanism that adjusts the behavior of Google's tags to the user's consent choice. It passes four types of consent: ad_storage for advertising storage, analytics_storage for measurement storage, ad_user_data for sending user data to Google for advertising, and ad_personalization for personalized advertising such as remarketing.
There are two ways to implement it. In basic mode, Google's tags don't load until the user makes a choice in the consent banner. A user who refused sends nothing to Google, not even the refusal itself. In advanced mode, the tags load with a default of refusal and send cookieless signals, and full information is sent only after consent. These signals allow Google to perform conversion modeling in Google Ads and GA4, subject to a minimum data threshold. The choice between the two modes is a decision worth making together with legal counsel, not just with the developer.
What are the Conversions API and server-side tracking, and why do they matter?
The Conversions API and server-side tracking are two ways to pass measurement data through a server the company controls, instead of relying only on code running in the user's browser.
The Conversions API is a Meta interface that connects the advertiser's marketing data, such as events from the site, the app and the CRM, directly from the advertiser's server to Meta's systems. According to Meta's documentation, server events are processed similarly to events sent from the pixel, and are used for measurement, reporting and optimization. Meta recommends running the Conversions API alongside the pixel and sending the same events through both channels, to cover events the pixel misses because of loading or connection problems.
Two technical details determine whether it works. The first is deduplication: each event needs to carry the same name and the same identifier (event_id) in both channels, otherwise it may be counted twice. The second is match quality: Meta shows an Event Match Quality score out of 10 for each event, and customer details such as email or phone must be hashed before sending. Sending customer details is the point where measurement meets privacy, so what is sent, and on the basis of which consent, needs to be defined in advance.
Server-side tracking is measurement on the server side: instead of each tag sending data directly from the browser to an external vendor, the data first passes through a company server. In Google Tag Manager this is called server-side tagging, and the server container runs on cloud infrastructure the company chooses. Google notes that in this model the advertiser decides which fields are sent and to which system, and that until it passes the data on, no external vendor sees it. Google recommends setting up the container on a company domain.
The advantage for marketing is twofold. Fields can be filtered before they go out to the platforms, while the completeness of the data reaching the advertising systems improves. But server-side measurement is not a way to bypass consent. If the user refused, the server must respect their choice too.
What should you check now? A measurement and privacy checklist
The practical way to put this in order is an eight-step process that starts with mapping and ends with ongoing monitoring. The mapping determines which steps a particular site needs, and not every site needs every component.
- מיפוי תגיות. A list of every tag, pixel and script on the site and in the app: what it collects, where it sends data and who is responsible for it.
- ניקוי. Removing tags of tools no longer in use and reducing fields with no clear business need.
- מנגנון הסכמה. Writing a clear consent request and an option to refuse that is no more complicated than the option to agree. If a dedicated tool is needed, choose a CMP based on what the mapping revealed.
- חיבור ההסכמה לכלים. Implementing Consent Mode in Google's tags and setting appropriate firing conditions for the other tools in Tag Manager.
- מדידה בצד השרת. Where justified, setting up a server-side container on the brand's domain and routing the main events through it.
- חיבורי המרות ישירים. When Meta is a significant channel, running the Conversions API alongside the pixel, with event_id for deduplication and checking Event Match Quality.
- מסמכים והסכמים. Updating the privacy policy to reflect the actual situation, and arranging agreements with vendors and agencies about who processes which information.
- בקרה שוטפת. A regular check that measurement works after every change to the site, comparing platform data with sales data, and an alert when an event disappears.
These steps require joint work by marketing, development, information security, the legal department and the privacy protection officer, if one has been appointed. The Authority publishes opinions and guidelines interpreting Amendment 13 from time to time, so it's worth returning to this review regularly rather than treating it as a one-off project.
How we approach this at CONNECT
At CONNECT, part of the Bruckner Yaar Levi advertising group, we start every measurement project with mapping: what runs on the site, what is sent, where, and on the basis of which consent. From there we build a joint work plan with the development team and the brand's legal counsel, because decisions about consent and sending customer details are not media decisions alone.
After implementation, we treat measurement as a living system. Our AI agents for campaign monitoring monitors the accounts and flags anomalies in performance and spend pacing, and a sudden drop in conversions is often the first sign of a broken tag. This makes it possible to identify such issues earlier.
Frequently asked questions
When did Amendment 13 to the Privacy Protection Law come into force?
Amendment 13 to the Privacy Protection Law was approved in August 2024 and came into force on August 14, 2025. Since then the Privacy Protection Authority has published a professional guide to the amendment and opinions on topics such as consent and appointing a privacy protection officer. It's worth reviewing the measurement infrastructure in light of the amendment, together with the company's legal counsel.
Is a cookie banner required on a website in Israel?
The Authority's guide to Amendment 13 does not deal with cookies explicitly, so the answer depends on what the site collects and for what purposes. However, if the site uses cookies for advertising and measurement, the consent principles the Authority published are relevant: informed consent, a real option to refuse and avoiding misleading design. The decision is best made with legal counsel, based on what actually happens on the site.
What is the difference between basic and advanced Consent Mode?
In basic mode, Google's tags are blocked until the user responds to the banner, and if they refuse no information is sent, not even the consent state. In advanced mode, the tags load with a default of refusal and send cookieless signals until consent is given. Advanced mode allows Google more detailed conversion modeling, but the choice between them should also include a legal consideration.
Does the Conversions API replace the Meta pixel?
No. Meta recommends running the Conversions API in addition to the pixel and sending the same events through both channels. The pixel collects events from the browser, and the Conversions API sends events from the server, so events the pixel misses still reach Meta. To avoid an event being counted twice, it needs to be sent with the same name and the same event_id in both channels.
Does server-side tracking solve the privacy problem?
Not on its own. Server-side measurement gives the company better control over the data: it can see what is sent, filter fields and route only what is needed to the platforms. But it doesn't replace consent or exempt the company from the duty to inform. If a user refused advertising cookies, the server must respect that choice too. The goal is control and transparency over data, in line with the user's choice.
ראו גם: דאטה ואנליטיקס · Performance Campaigns · איך לקרוא דוח קמפיין · ROAS ורווח באיקומרס · הטכנולוגיה שלנו
Sources: Privacy Protection Authority: professional guide to Amendment 13 · Privacy Protection Authority: opinion on consent · Privacy Protection Authority: opinion on appointing a privacy protection officer · Google: Consent mode · Google: Server-side tagging · Meta: Conversions API · Meta: Conversions API best practices
רוצים לבחון את תשתית המדידה לאור תיקון 13? השאירו פרטים.