Every country treats cookies differently. The EU and EEA, the UK, Brazil, Turkey, South Africa, India and China expect consent before non-essential cookies load, while US state laws and Switzerland let cookies run by default as long as visitors can refuse. Canada, Japan, Singapore and Australia sit in between, with notice and consent rules that tighten for sensitive or unexpected uses. If your website attracts traffic from more than one jurisdiction, a banner configured for one market will not cover the others. This guide maps the major privacy regimes by consent model, links to a country guide for each and explains what each one requires.
The short version:
- Opt-in consent before non-essential cookies is the rule in the EU and EEA, the UK, Brazil, Turkey, South Africa, India and China.
- US state laws and Switzerland use an opt-out model: cookies may load, but visitors must be able to refuse.
- Since 5 February 2026, the UK lets first-party analytics and appearance cookies run without consent if visitors are told and can object.
- The EU rules have not changed: as of October 2026, the Digital Omnibus proposal is still awaiting a committee vote in the European Parliament.
- For mixed traffic, the practical answer is a banner that changes its consent model by visitor location, with the strictest model as the fallback.
Cookie consent models around the world, October 2026
Cookie consent rules by country at a glance
The table sums up the consent model, the main law and how hard each regulator is pushing, with a link to the full guide for each country.
| Region or country | Consent model | Key law | Enforcement as of October 2026 |
|---|---|---|---|
| EU and EEA (30 countries), for example France, Germany and the Netherlands | Opt-in | ePrivacy Directive + GDPR | Heavy: 83 CNIL sanctions in 2025 |
| United Kingdom | Opt-in, with exemptions since 5 February 2026 | UK GDPR + PECR | Active: ICO review of the top 1,000 sites |
| Switzerland | Opt-out (information and a way to refuse) | Telecommunications Act Art. 45c + FADP | Guidance from the FDPIC |
| Turkey | Opt-in for tracking and advertising cookies | KVKK | Cookie guideline from the KVKK authority |
| United States (about 20 states) | Opt-out | CCPA and CPRA, other state laws | Growing: state regulators and attorneys general |
| Brazil | Opt-in | LGPD | ANPD a permanent regulatory agency since February 2026 |
| Canada | Implied or express, by sensitivity | PIPEDA + Quebec's Law 25 | Moderate, Quebec stricter |
| India | Opt-in | DPDP Act (phased to May 2027) | Emerging: Consent Manager registration from November 2026 |
| China | Consent, separate consent for some uses | PIPL | Heavy: audits by the Cyberspace Administration |
| Vietnam | Consent | Personal Data Protection Law (in force 1 January 2026) | New |
| Japan | Consent for third-party provision | APPI | Moderate |
| Singapore | Consent | PDPA | Moderate |
| Australia | Notice, no cookie-specific consent rule | Privacy Act 1988 | Growing: first civil penalty in October 2025 |
| UAE | Consent | PDPL | Growing |
| South Africa | Opt-in | POPIA | Maturing |
Opt-in and opt-out are two different starting points
Before looking at specific countries, it helps to understand the two dominant models that shape cookie consent worldwide.
Opt-in means you must get a visitor's active, informed agreement before setting any non-essential cookies. No pre-ticked boxes, no implied consent from continued browsing. The cookie does not fire until the visitor clicks Accept. This is the model used across the European Union, the UK, Brazil and several Asian jurisdictions.
Opt-out means cookies can load by default, but visitors must have a clear, accessible way to refuse. The US state privacy laws follow this approach, requiring a "Do Not Sell or Share My Personal Information" link rather than prior consent. The practical difference is significant: under opt-in regimes, your analytics data collection starts at zero until someone agrees. Under opt-out, it starts at full and shrinks as visitors decline.
European Union: the strictest opt-in regime
All 27 EU member states plus the three EEA countries (Norway, Iceland, Liechtenstein) enforce opt-in consent for non-essential cookies. The legal foundation is Article 5(3) of the ePrivacy Directive, which requires prior consent before storing or accessing information on a user's device. The GDPR then defines what counts as valid consent: freely given, specific, informed and unambiguous.
Enforcement intensity varies between member states, though the baseline requirements are identical. France's CNIL is the most active enforcer on cookie-specific violations. On 1 September 2025, the CNIL fined Google EUR 325 million and SHEIN EUR 150 million in cookie cases, the two largest amounts in its 2025 decisions. Over 2025 as a whole, the CNIL issued 83 sanctions totalling EUR 486,839,500, almost all of it from those two decisions, and 21 of the sanctioned entities were fined over cookies and trackers.
The Dutch Data Protection Authority (Autoriteit Persoonsgegevens) has also stepped up. On 15 April 2025, it warned 50 organisations, among them online retailers, media companies and insurers, about misleading cookie banners or tracking cookies placed without consent. Those were the first 50 of 500 organisations it plans to warn each year, picked from the 10,000 Dutch websites it monitors.
| EU requirement | What it means in practice |
|---|---|
| Prior opt-in consent | No non-essential cookies fire until the visitor actively agrees |
| Granular choice | Visitors must be able to accept or reject cookie categories separately |
| Equal prominence | The Reject button must be as visible and accessible as Accept |
| No dark patterns | Manipulative design that nudges visitors toward acceptance invalidates consent |
| Revocable consent | Withdrawing consent must be as easy as giving it |
As of October 2026, none of this has changed. The European Commission's Digital Omnibus proposal of November 2025 would move the cookie rules into the GDPR, but it is still at committee stage in the European Parliament, where a draft report was published on 22 June 2026 and no vote has been held.
United Kingdom: PECR as amended by the Data (Use and Access) Act
The UK GDPR and the Privacy and Electronic Communications Regulations (PECR) require opt-in consent for non-essential cookies, with a growing list of exceptions. In its April 2026 update, the ICO said 992 of the UK's top 1,000 websites met its cookie compliance checks. Websites that failed earlier checks received warning letters, and 17 cases were escalated to preliminary enforcement notices in 2025.
The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025, and its cookie changes have applied since 5 February 2026. The new Schedule A1 to PECR lets a site set cookies without consent when they only collect statistics to improve the service, or only adapt the site's appearance or functions to the visitor's preferences. Both exemptions require clear information and a simple, free way to object. Advertising cookies still need consent. PECR fines also rose to UK GDPR levels: up to GBP 17.5 million or 4% of global turnover.
Businesses operating in both the EU and the UK now face rules that have diverged: an analytics cookie that runs on notice in London needs consent in Dublin.
United States: opt-out with a patchwork of state laws
The US has no federal cookie law. Instead, a growing patchwork of state privacy laws governs how websites handle tracking data. About 20 states have comprehensive privacy statutes, with Indiana, Kentucky and Rhode Island joining the list on 1 January 2026.
The dominant model is opt-out. Cookies can load by default, but visitors must have a clear mechanism to refuse data sales or sharing. California's CCPA, as amended by the CPRA, requires a "Do Not Sell or Share My Personal Information" link and requires websites to honour Global Privacy Control (GPC) browser signals.
California remains the strictest US jurisdiction. The California Privacy Protection Agency (CPPA) can impose fines of up to USD 2,663 per violation and USD 7,988 per intentional violation or one involving a consumer under 16, amounts in force since 1 January 2025. Sensitive data, such as health, financial, precise location and minors' data, requires opt-in consent in most state laws, even where the general model is opt-out.
Brazil: the LGPD and the ANPD's cookie guide
Brazil's LGPD follows an opt-in consent model for non-essential cookies, borrowing heavily from the GDPR's structure. Consent must be free, informed and unambiguous, and can be revoked at any time. The LGPD also recognises legitimate interest as a legal basis, though the ANPD's cookie guide of October 2022 does not treat it as a basis for advertising and profiling cookies.
The ANPD (Brazil's data protection authority) gained more weight in 2026. Law 15.352 of 25 February 2026 made it a permanent regulatory agency, and on 26 January 2026 the EU adopted an adequacy decision for Brazil, matched by an ANPD decision recognising the EU. A Portuguese banner is not a written LGPD requirement, but the law's transparency duty and the ANPD's guidance make it the practical choice for sites aimed at Brazilian visitors.
Canada: PIPEDA, Quebec and what CASL does not cover
PIPEDA governs most of Canada's private-sector data handling. It allows implied consent for low-risk, well-explained purposes but requires express consent for anything sensitive or unexpected. Canada's anti-spam law, CASL, does not add a cookie banner duty: under section 10(8) of CASL, a person is considered to consent to cookies, HTML and JavaScript when their conduct makes that reasonable. Cookie consent in Canada therefore comes from PIPEDA and Quebec's Law 25.
Quebec's Law 25 adds a stricter layer: the province's regulator reads it as requiring technology that identifies, locates or profiles a person to stay off until the person turns it on. The safest approach for websites serving Canadian visitors is to treat non-essential cookies as requiring opt-in, especially in Quebec.
Asia-Pacific has the fastest-moving rules
Several major economies in the region have introduced or tightened cookie-related rules in the last two years.
India's Digital Personal Data Protection Act (DPDPA) is phased in by the DPDP Rules notified in November 2025: Consent Manager registration is due from November 2026, and most duties apply from May 2027. Only companies incorporated in India that meet a minimum net worth qualify as registered Consent Managers, which rules out most foreign consent management platforms for that role. Notices must be available in English or any of the 22 languages listed in the Eighth Schedule to the Constitution, and consent must be as easy to withdraw as to give.
China's Personal Information Protection Law (PIPL) requires separate consent for some uses, such as sharing personal information with another company or sending it abroad. Cross-border data transfers need a security assessment, a certification or standard contract, and the Cyberspace Administration of China audits high-profile platforms.
Japan's APPI requires consent before providing personal data to third parties and restricts cross-border transfers, though its cookie requirements are less prescriptive than the EU model. Singapore's PDPA requires consent for the collection, use and disclosure of personal data, and the Personal Data Protection Commission has published practical guidance on cookies. Vietnam's Personal Data Protection Law has applied since 1 January 2026 and makes consent the main basis for processing. Australia's Privacy Act 1988 has no cookie-specific consent rule, but the reform Act passed in 2024 and the first civil penalty in October 2025 have raised the stakes.
Switzerland, Turkey, the Middle East and Africa
Switzerland and Turkey take opposite routes. Switzerland is outside the EU and follows its own rule. Article 45c of the Telecommunications Act requires sites to tell visitors about cookies and their purposes and to explain how to refuse them, which is an opt-out model. The Federal Data Protection and Information Commissioner (FDPIC) published cookie guidance in 2025 and revised it in October 2025. It explains how the Federal Act on Data Protection (FADP) applies to tracking, but it is guidance, not a new statute.
Turkey goes the other way. The Turkish data protection authority's cookie guideline treats tracking, advertising and social media cookies as needing explicit consent under the KVKK, while cookies needed to run the site are exempt.
The UAE's PDPL (Federal Decree-Law No. 45 of 2021) has been in force since 2 January 2022 and broadly requires consent for processing personal data, including data collected through cookies. South Africa's POPIA follows an opt-in model similar to the GDPR, with the Information Regulator progressively increasing enforcement. Other African and Middle Eastern countries have adopted privacy laws, though most lack cookie-specific rules. The global compliance hub collects the laws by region, with a guide for each.
How to handle visitors from many countries
A banner that works for US opt-out requirements will not meet EU opt-in rules. The practical solution is geo-targeted consent: a consent management platform that detects visitor location and serves the correct consent model per jurisdiction. If geolocation fails, default to the strictest applicable standard, typically EU opt-in.
In Kukie.io, this is what region rules do: each region gets an opt-in, opt-out or notice-only consent model, and visitors from anywhere else get the default rule you set.
Three essentials: run a cookie scan to identify every cookie your site sets, configure your banner to block non-essential cookies until consent is granted in opt-in jurisdictions, and keep auditable consent records that show when and how consent was collected.
Short answers on cookie laws around the world
Do US websites need a cookie banner?
There is no federal US law requiring a cookie banner, but about 20 state privacy laws require opt-out mechanisms when cookies are used to sell or share personal information. If your site uses advertising or analytics cookies that share data with third parties, you likely need at least a "Do Not Sell or Share My Personal Information" link plus GPC signal recognition.
Which countries require opt-in cookie consent?
All EU and EEA member states, the UK, Brazil, Turkey, South Africa, India (under the DPDPA) and China (under the PIPL) require some form of opt-in consent for non-essential cookies. Quebec's regulator also expects profiling technology to be off until the person turns it on. Since 5 February 2026, the UK exempts some analytics and appearance cookies if visitors are told and can object.
Can I use a single cookie banner for all countries?
Technically yes, but it would need to meet the strictest standard: EU opt-in with granular category controls. That means visitors from opt-out regions also see a consent request and your analytics start at zero for them too. Geo-targeted banners apply each region's own model instead.
Does Switzerland require cookie consent?
Not as a general rule. Article 45c of the Swiss Telecommunications Act requires information about cookies and a way to refuse them, which is an opt-out model. Swiss sites that also target EU visitors follow the EU's opt-in rules for those visitors.
What happens if my website does not comply with another country's cookie law?
Most privacy laws apply based on where the visitor is located, not where the website is hosted. The GDPR, LGPD and PIPL all have extraterritorial scope, meaning they can apply to foreign websites that process data of their residents. Penalties vary but can reach 4% of global annual turnover under the GDPR and UK GDPR.
Are analytics cookies treated differently from marketing cookies?
Under most opt-in regimes, both analytics and marketing cookies require consent. Since 5 February 2026, the UK lets first-party cookies that only collect statistics to improve a service run without consent, provided visitors get clear information and a simple way to object. In the EU, analytics still needs prior consent unless it meets a regulator's narrow exemption, such as the CNIL's conditions for consent-exempt audience measurement.
Which service applies consent rules by country?
A consent management platform with geolocation does it: it looks up the visitor's country and applies the consent model you set for that region, with a default rule for everyone else. Region rules in Kukie.io work this way.
Set your banner's rules per region
If your website attracts visitors from several countries, one consent setup will be too strict for some and too loose for others. Region rules detect visitor location, apply the consent model you set for each region and blocks non-essential cookies until consent is granted where your rules require it. The Free plan covers up to 5 websites.
