Skip to content
Start free Sign in

Cookie banner rules by region

Your rule for each region.

Kukie.io reads each visitor's country and applies the consent model you set for that region: opt-in, opt-out, notice only or no banner. One installation serves every market.

Start free (opens in a new tab) See pricing

Rules for 12 regions (European Union, United Kingdom, Switzerland, United States, Canada, Brazil, Australia, New Zealand, South Africa, Japan, South Korea and India) and 14 sub-regions, plus your rest-of-world rule.

One site, three visitors. An example, not the set of rules a new site starts with.

Watch the walkthrough

One banner, the right rule everywhere.

Follow a visitor from Berlin, then California: where the country comes from, which rule applies, and what happens when the lookup fails.

1 minute 13 seconds, narrated, with captions in the player. The sites and rules in it are examples.

Read the transcript
  1. 0:00 Your visitors come from everywhere. One banner can't fit every market.
  2. 0:05 Introducing geo-targeting, from Kukie.io.
  3. 0:08 It reads where each visitor is, and applies your rule for that region, before the banner appears.
  4. 0:14 Someone opens your site in Berlin. The country comes from Cloudflare, or from a MaxMind database on our own servers.
  5. 0:22 Germany has no rule of its own, so your European Union rule applies. Opt-in. Nothing optional runs until they choose.
  6. 0:29 Same site, someone in California. Opt-out, with a Do Not Sell link. The rest of the US gets a simple notice.
  7. 0:37 Each region picks one of four models. Opt-in, opt-out, notice only, or no banner at all.
  8. 0:43 A rule is a few overrides, not a second banner. The model, the layout, the buttons, and how long consent lasts.
  9. 0:50 If the lookup fails, or takes longer than three seconds, the visitor gets your strictest rule.
  10. 0:55 And if you respect Global Privacy Control, a visitor who sends it starts as refused.
  11. 1:01 12 regions, 14 sub-regions, and a rest-of-world rule for everyone else.
  12. 1:06 One installation. Your rule for each region.

Why it matters

One banner cannot fit every market.

A site with visitors in more than one country has to pick one behaviour, and no setting is right everywhere. Whichever way you lean, you pay for it somewhere.

  • Lost measurement

    Strict everywhere

    Showing the strictest banner to every visitor is the cautious instinct, and it costs you measurement in markets that never asked for that gate. Sessions go unrecorded, conversion tracking under-reports and remarketing audiences shrink. You cannot see what you did not collect, so the loss never shows up as a problem.

  • Tracking before consent

    Permissive everywhere

    A notice that lets analytics and advertising load at once is fine in some places and not in others. Applied everywhere, it means visitors in the EU and the UK are tracked before they have agreed to anything. That is the most commonly cited finding in cookie enforcement, and anyone with a browser can check it.

The usual workaround

A consent setup for each market

The usual workaround is worse than either: a separate site, or a separate banner script, for each market. That leaves 3 or 4 consent setups to keep in step, and the one nobody remembers to update is the one that gets screenshotted. Kukie.io keeps it to one installation with a rule for each region on top.

Which model a country requires is a legal question. The rules are set out country by country on cookie consent laws by country.

Where rules apply

Rules for 12 regions and 14 sub-regions.

Write a rule for a whole region, narrow it to a state or a country inside it, and let your rest-of-world rule cover everything else.

Europe

  • European Union (GDPR)
    • Germany (TDDDG/DSGVO)
    • France (CNIL)
    • Italy (Garante)
    • Spain (AEPD)
    • Netherlands (AP)
  • United Kingdom (UK GDPR)
  • Switzerland (nFADP)

Americas

  • United States
    • California (CCPA/CPRA)
    • Virginia (VCDPA)
    • Colorado (CPA)
    • Connecticut (CTDPA)
    • Utah (UCPA)
    • Texas (TDPSA)
    • Oregon (OCPA)
    • Montana (MCDPA)
  • Canada (PIPEDA)
    • Quebec (Law 25)
  • Brazil (LGPD)

Asia-Pacific

  • Australia (Privacy Act)
  • New Zealand (Privacy Act)
  • Japan (APPI)
  • South Korea (PIPA)
  • India (DPDPA)

Africa

  • South Africa (POPIA)

The law named next to each region is the one the dashboard's region picker shows, for reference. It is not legal advice, and a rule applies whichever model you choose for it.

How it works

The rule is chosen before the banner appears.

Kukie.io finds the visitor's region and picks your rule for it before anything is shown. Nothing is asked of the visitor, and nothing is asked of you after the first setup.

  • A visitor in California gets your California rule.
  • A visitor in Texas, with no Texas rule, gets your United States rule.
  • A visitor in Kenya, with no rule for Kenya, gets your rest-of-world rule.

  1. Step 1: The country comes from the IP address

    Where Cloudflare sits in front of the request, Kukie.io uses its country header. Otherwise the country comes from a MaxMind GeoLite2 database held on our own servers, so no separate geolocation service is called. For some countries the same lookup finds the state or province.

  2. Step 2: The most specific rule wins

    If you have written a rule for that exact region, it applies. A visitor in California matches your California rule rather than your United States rule, and a visitor in Quebec matches your Quebec rule rather than your Canada rule.

  3. Step 3: Without an exact rule, the broader one applies

    You do not need a rule for every country. A visitor in Germany with no German rule falls back to your European Union rule, and a visitor in Texas with no Texas rule falls back to your United States rule, so a few rules can cover many countries.

  4. Step 4: Your rest-of-world rule catches the rest

    Every site has a rest-of-world rule that cannot be deleted, and it covers every country you have no rule for. When the lookup fails or takes longer than 3 seconds, the banner applies your strictest rule instead, so an unknown location never means a weaker banner.

Your region rules travel inside the script your site already loads, so moving a market to a different model means changing its rule, not installing anything new there. The rest-of-world rule never counts against your plan's allowance of region rules. A new site starts with one opt-in rule for every visitor. On the Agency and Unlimited plans, it starts with ready-made rules for the EU, the UK, the US and California instead.

Consent models

Four consent models to choose from.

Each region rule picks one model, and the model decides what runs on the page before the visitor has said anything. The other settings in a rule refine it.

  • Consent model: Opt-in
    Before the visitor chooses
    Nothing that is not essential runs. Analytics and advertising stay blocked.
    What the visitor sees
    A banner with Accept all, Reject all and Manage preferences
    Often used for
    Visitors in the EU and the UK, and anywhere else you want agreement first
  • Consent model: Opt-out
    Before the visitor chooses
    Scripts run, and stop when the visitor refuses.
    What the visitor sees
    A banner with a clear way to refuse, plus the Do Not Sell or Share link if you turn it on
    Often used for
    United States traffic, and states where you add a narrower rule
  • Consent model: Notice only
    Before the visitor chooses
    Scripts run. Nothing waits for the visitor.
    What the visitor sees
    A notice they can dismiss. It can also close on its own after a scroll or a set time.
    Often used for
    Markets where telling people is the norm rather than asking them
  • Consent model: Hidden
    Before the visitor chooses
    Scripts run. No banner is loaded at all.
    What the visitor sees
    Nothing
    Often used for
    Only regions where you have established that no notice is needed

"Often used for" describes how sites often set these models up, not what a country requires of you. Be deliberate about the hidden model in particular: it is the only one with no visitor choice to record, so it removes the evidence as well as the banner.

Learn more about the cookie banner

Per-region settings

A rule changes a few settings.

A region rule is a small set of overrides, not a second banner. Your categories, cookie list and styling are set once, and every region inherits them.

  1. The consent modelOpt-in, opt-out, notice only or hidden: the setting that changes what runs on the page.
  2. The Do Not Sell or Share linkThe CCPA link and the opt-out dialog behind it, shown in the regions that expect it and nowhere else.
  3. A cookie wall, in some regions onlyA cookie wall holds the page until the visitor answers. Turn it on for specific regions and leave it off everywhere else.
  1. How long the answer lastsFrom 1 to 730 days, so one region can be asked again sooner than another. A rule can also ask again when your banner changes.
  2. The wordingText for one region can replace your default banner text, when one market needs a sentence the others do not.
  3. The layout and the buttonsA bar at the bottom in one region and a centred popup in another, and which buttons show, within the buttons your site allows.

Everything else stays shared: cookie categories, the scanned cookie list, colours, your logo and your cookie policy. Adding a region does not mean looking after another banner. A rule you switch off keeps its settings, so a market can be paused without starting again.

Beyond the country

A country is not the only input.

Some countries do not behave as one unit, and some visitors arrive having already said what they want.

  • Rules narrower than a country

    Where a country is not uniform, you can add a rule below the country level and let everyone else in that country fall back to the broader one. Kukie.io supports 14 sub-regions, listed under the map above.

    A German visitor with no German rule is still handled as a European Union visitor, so a narrower rule is an option, not a requirement.

    Learn more about privacy laws by region

  • Browser signals that speak for the visitor

    Some browsers and extensions send a standing preference with every visit. Kukie.io detects Global Privacy Control and the older Do Not Track signal, and when your site is set to respect them, the visitor starts as refused, whichever model their region uses.

    Unless the region uses the hidden model, the banner still appears, so a visitor who wants to allow something can still do it. This matters most in opt-out and notice-only regions, where the starting position would otherwise be to allow.

When it matters most

Where region rules help most.

If all your visitors come from one country, a single rule is the honest answer and you should use it. These are the situations where one rule stops being enough.

You sell into Europe and the United States

Those 2 markets pull in opposite directions: one expects to be asked first, the other expects a way to refuse afterwards. Region rules were built for this case.

Your analytics dropped after you added a banner

Some of that drop is unavoidable, and some comes from a consent gate in markets that never needed one. Keeping the strict model to the regions that expect it can win part of it back.

You are launching in a new market

Adding a market means adding a rule, not rebuilding the consent setup or installing a second script. The banner already on your site picks up the new region shortly after you save the rule.

You look after sites that are not yours

A client with an unexpectedly international audience should not become a bespoke project. Region rules are set per site, so each client site gets its own, managed with the rest from one dashboard.

Learn more about Kukie.io for agencies

Questions about geo-targeting

What is a geo-targeted cookie banner?
One consent banner that follows a different rule depending on where the visitor is. Kukie.io works out the visitor's region, looks up the rule you set for that region and applies it before the banner appears. You keep one installation and one set of settings, rather than one website per market.
How does a cookie banner know which country a visitor is in?
From the IP address the browser connects with. Kukie.io reads the country from Cloudflare's country header where it is available, and otherwise from a MaxMind GeoLite2 database held on our own servers, so no separate geolocation service is called. For some countries the lookup also finds the state or province, which is what makes rules narrower than a whole country possible.
What happens when a visitor's region cannot be determined?
The banner applies the strictest rule your site has. When the location lookup fails or takes longer than 3 seconds, a visitor whose region is unknown is treated like your most careful region. A lookup that works but matches none of your rules gets your rest-of-world rule, which every site has and cannot delete, so every visitor gets a rule you chose.
Can I turn the cookie banner off completely in some regions?
The hidden consent model shows no banner at all in the regions you apply it to. Use it only where you have established that no notice is needed, because with no banner there is also no visitor choice to record. Which regions need nothing is a legal question, not a technical one.
Does Global Privacy Control override the rule for a region?
When your site is set to respect it, a Global Privacy Control or Do Not Track signal from the browser puts that visitor into a refused state, whichever consent model their region uses. Scripts that are not essential stay blocked. Unless their region uses the hidden model, the banner still appears, so the visitor can choose differently.
Can consent last a different length of time in different regions?
How long consent lasts is part of each region rule, from 1 to 730 days, so one region can ask again after 6 months while another keeps the answer for a year. Each rule can also ask again when your banner changes. The right period is a decision for whoever owns privacy compliance at your organisation, not a setting with one correct value.

Give each region the rule you choose.

Every Kukie.io site starts with a rest-of-world rule that covers every visitor. Your plan sets how many regions you can add on top of it.

Start free (opens in a new tab) See pricing

Related features

Region rules sit on top of the rest of the consent setup. These are the parts they change and the parts they inherit.

See all features

More on consent across borders

Background reading on where your obligations reach, and what different regions expect.

See all articles

Disclaimer

Kukie.io provides tools to collect and record consent. It is not legal advice, and using it does not by itself make a website compliant with any law.

Listed on

Kukie.io on Trustpilot (opens in a new tab) Kukie.io on G2 (opens in a new tab) Kukie.io on SaaSHub (opens in a new tab) Kukie.io on AlternativeTo (opens in a new tab)