Cookie consent laws around the world: the 2026 field guide

If your website has visitors from more than one country — and it does — you are subject to more than one cookie law. The good news: nearly all of them fall into two families. Opt-in regimes require consent before non-essential cookies are set; opt-out regimes let you set them but require an effective way to refuse. This guide walks through the major laws, what each actually requires of a cookie banner, and how to serve all of them from one website.

European Union: GDPR + ePrivacy Directive

The strictest and most-enforced regime, and the reason cookie banners exist. The rule comes from Article 5(3) of the ePrivacy Directive: storing or reading anything on a user's device requires prior informed consent, unless it is strictly necessary for a service the user asked for. The GDPR then defines what valid consent means — freely given, specific, informed, unambiguous, and as easy to withdraw as to give.

• Consent must come before non-essential cookies are set — this is why prior-blocking is non-negotiable.
• Reject must be as accessible as Accept; regulators in France, Germany, and elsewhere have fined asymmetric banners.
• Consent must be granular per purpose (analytics vs marketing), never bundled into one button only.
• You must keep proof of each consent — GDPR Article 7(1) puts the burden of demonstration on you.
• Fines scale to €20 million or 4% of global annual turnover, and cookie fines have hit nine figures for large platforms.

United Kingdom: UK GDPR + PECR

Post-Brexit, the UK mirrors the EU model: PECR (the Privacy and Electronic Communications Regulations) carries the cookie consent rule, UK GDPR defines consent, and the ICO enforces. In practice a banner compliant for the EU is compliant for the UK. The ICO has been notably vocal that 'Reject all' must be on the first layer.

United States: opt-out, state by state

There is no federal cookie law. California's CCPA, as amended by the CPRA, anchors the model: you may set cookies, but consumers have the right to opt out of the sale or sharing of personal information — and cookie-based ad tracking counts as sharing. A compliant California experience means a clear 'Do Not Sell or Share My Personal Information' path and, crucially, honoring the Global Privacy Control browser signal automatically.

More than a dozen states have followed with their own comprehensive privacy laws — Virginia, Colorado, Connecticut, Texas, Oregon, and others — most sharing the opt-out-of-targeted-advertising shape, several (like Colorado) also mandating recognition of universal opt-out signals such as GPC. The practical answer for US traffic is one pattern: don't block, but honor GPC and offer a working opt-out.

Brazil: LGPD

The Lei Geral de Proteção de Dados is consent-based like the GDPR, with the ANPD as regulator. The ANPD's cookie guidance recommends banners with granular choices and no cookie walls. Treat Brazilian traffic like EU traffic: opt-in with prior-blocking.

Canada: PIPEDA + Quebec Law 25

Federally, PIPEDA requires knowledge and consent with flexibility on form. Quebec's Law 25 is stricter and closer to the GDPR: it requires that technologies which identify, locate, or profile a user be off by default until the person activates them — effectively opt-in for tracking cookies — and it expects privacy notices in clear language (in French for Quebec audiences).

Rest of the world, quickly

• Switzerland (revFADP): transparency-first; opt-out is generally acceptable for most cookies, but Swiss sites serving the EU usually adopt the EU banner anyway.
• South Africa (POPIA): consent or legitimate interest with an opt-out; direct electronic marketing requires opt-in.
• Japan (APPI): consent required to provide personal data to third parties, which catches third-party ad cookies; the 2022 amendments tightened rules on externally transmitted data.
• South Korea (PIPA): one of Asia's strictest consent regimes; behavioral advertising guidance expects clear notice and choice.
• China (PIPL): consent-based with 'separate consent' for sharing with third parties; combined with data-localization rules, adtech integrations need real scrutiny.
• India (DPDP Act 2023): consent must be free, specific, informed, and unambiguous — GDPR-like in shape; enforcement machinery is still ramping up.
• Australia: the Privacy Act currently has no explicit cookie-consent mandate, but reform proposals point toward EU-style requirements; most Australian sites with global traffic already show a banner.

One site, many laws: the practical setup

1. Detect the visitor's region and pick the experience: opt-in banner (EU/EEA, UK, Brazil, Quebec) or opt-out notice (US states).
2. Enforce, don't just ask: hold non-essential scripts until consent wherever opt-in applies — see what to block before consent.
3. Honor GPC everywhere; it costs nothing and several US states require it.
4. Record every decision with timestamp, banner version, and categories — the audit trail is what turns a banner into compliance.
5. Re-scan your site regularly; every new marketing tag silently changes your legal posture.

Laws will keep multiplying, but the two families are stable. Build for the opt-in superset, degrade gracefully to opt-out where that's the rule, and keep records. That posture has survived every regulation passed so far.