Consent experience

The geo-targeted cookie banner:
one script, a rule per region

A geo-targeted cookie banner changes its behaviour according to where the visitor is. Kukie reads the visitor's country from their IP address and applies the rule you set for that region: opt-in, opt-out, notice-only, or no banner at all. One script, one configuration, and a different consent experience per market.

Start free → See the law by jurisdiction

One banner for the whole world is wrong in one of two directions

A site with visitors in more than one country has to pick a single behaviour, and there is no setting that is right everywhere. Whichever way you lean, you pay for it somewhere. That cost is the reason per-region consent rules exist.

Lean strict

You block everything, everywhere, and lose the data you were allowed to have

Showing the strictest possible banner to every visitor is the cautious instinct, and it quietly costs you measurement in markets that never asked for that gate. Sessions go unrecorded, conversion tracking under-reports, and remarketing audiences shrink, in countries where nobody ever required an opt-in. You cannot see what you did not collect, so the loss never shows up as a problem.

Lean loose

You run a permissive notice everywhere, including where prior consent is expected

A dismissible notice that lets analytics and advertising load immediately is fine in some places and not in others. Applied globally, it means European and British visitors are tracked before they have agreed to anything, which is the most commonly cited finding in cookie enforcement, and it is verifiable by anyone with a browser.

The usual workaround is worse than either: a separate site, or a separate banner script, per market. Now there are three or four consent setups to keep in step, and the one nobody remembers to update is the one that gets screenshotted. Kukie keeps it to one installation with rules layered on top. Which model a given country actually requires is a legal question, and it is set out jurisdiction by jurisdiction on cookie consent laws by country. Kukie provides the technical infrastructure; whether your site is compliant depends on how you configure it and may need additional legal measures specific to your organisation.

How does the banner know where a visitor is?

Four steps, all of them before the banner is drawn. Nothing is asked of the visitor and nothing is asked of you after the first setup.

The script your site loads already carries your region rules inside it, so switching a visitor to the correct model does not mean deploying anything different in that market.

The country comes from the IP address

Where Cloudflare sits in front of the request, its country header is used, because it is already there and costs nothing. Otherwise the country is resolved from a MaxMind GeoLite2 database held on our own servers. No separate geolocation service is called, and for some countries the same lookup resolves the state or province.
The region is matched to your rules, most specific first

If you have written a rule for exactly that region, it wins. A visitor in California matches your California rule rather than your general United States rule, and a visitor in Quebec matches your Quebec rule rather than your Canadian one.
Without an exact rule, the broader one applies

You are not obliged to write a rule per country. A visitor in Germany with no German rule falls to your European Union rule; a visitor in Texas with no Texas rule falls to your United States rule. This is why most sites run three or four rules rather than thirty.
If nothing matches, your default rule catches it

Every site has a rest-of-world rule that cannot be deleted. It covers unrecognised countries, and it covers the case where the location lookup does not answer in time, so a visitor never lands on no banner by accident.

Which consent model should a region use?

Every region rule picks one of four models, and the model is the setting that actually matters: it decides what runs on the page before the visitor has said anything. The other per-region settings are refinements on top of it.

The four consent models a Kukie region rule can apply, and what each one does before the visitor chooses
Consent model	Before the visitor chooses	What the visitor sees	Commonly applied to
Opt-in	Nothing non-essential runs. Analytics and advertising stay blocked.	A banner with accept and reject, and a preferences panel behind it	European and British traffic, and anywhere else you want prior agreement
Opt-out	Things run, and stop the moment the visitor refuses.	A banner offering a clear way to refuse, plus the opt-out link where you enable it	United States traffic, and states where you have added a narrower rule
Notice-only	Things run. Nothing is gated on the visitor.	An informational notice they can dismiss	Markets where telling people is the norm rather than asking them
Hidden	Things run. No consent interface is loaded at all.	Nothing	Only regions where you have established that no notice is needed

The last column is configuration practice, not legal advice: what a specific country requires of you is set out on cookie consent laws by country. Be deliberate about the hidden model in particular. It is the only one of the four where there is no visitor choice to record, so it removes the evidence as well as the banner. What the banner itself contains, in every model, is covered on the cookie banner page.

What you can vary from one region to the next

A region rule is a small set of overrides, not a second banner. Everything you have not overridden stays shared, so your categories, your cookie list and your styling are defined once and every region inherits them.

The consent model

Opt-in, opt-out, notice-only or hidden, as set out in the table above. This is the setting that changes what actually executes on the page.

A cookie wall, in some regions only

A cookie wall holds the page until the visitor answers. You can switch it on for specific regions and leave it off everywhere else, rather than making it a site-wide decision.

The "Do Not Sell or Share" opt-out

The CCPA "Do Not Sell or Share My Personal Information" link and the opt-out dialogue behind it can be enabled for the regions that expect it, and stay out of the way in the regions that do not.

How long the answer lasts

Consent expiry and the re-consent period are part of the rule, so one region can be re-asked sooner than another instead of every visitor being on the same clock.

The wording itself

Per-region text can override your default banner copy, which is useful when one market needs a sentence the others do not, or when the local phrasing has settled on different words.

Everything else stays shared

Cookie categories, the scanned cookie list, colours and your logo are configured once. Adding a fourth region does not mean maintaining a fourth banner, and your cookie policy is not duplicated either.

Two things a country code does not tell you

Geography is the first input, not the only one. Some countries do not behave as a single unit, and some visitors arrive having already said what they want.

Rules narrower than a country

Where a country is not uniform, you can write a rule below the country level and let everyone else in that country fall back to the broader one. Kukie supports sub-region rules for the German TTDSG, for French CNIL expectations, for individual United States states under CCPA and CPRA, and for Quebec under Law 25.

In practice that means you add a narrower rule only where you have a reason to. A German visitor with no German rule is still handled as a European Union visitor, so the specific rule is an upgrade rather than a prerequisite.

What each of those regimes asks for is on the jurisdiction guide.

Browser signals that speak for the visitor

Some browsers and extensions send a standing preference with every request. Kukie detects Global Privacy Control and the older Do Not Track header, and when your site is set to respect them the visitor is treated as having refused, whichever model their region uses.

The banner still appears. The signal decides the starting position, not the ending one, so a visitor who wants to allow something can still open the banner and do it. It is the one case where a visitor overrules the region.

This matters most on opt-out and notice-only regions, where the default would otherwise have been to allow.

When per-region rules earn their keep

If every visitor you have ever had came from one country, a single rule is the honest answer and you should use it. These are the situations where one rule stops being enough.

You sell into Europe and the United States

The two markets pull in opposite directions: one expects to be asked first, the other expects to be able to refuse afterwards. This is the case per-region rules were built for, and it is the most common reason people go looking for them.

Your analytics dropped after you added a banner

Some of that drop is unavoidable and some of it is self-inflicted, because you applied a consent gate in markets that never needed one. Narrowing the strict model to the regions that expect it is usually the largest single recovery available.

You are launching in a new market

Adding a market means adding a rule, not rebuilding the consent layer or shipping a second script. The banner that is already live picks up the new region the next time your configuration is published.

You look after sites that are not yours

A client with an unexpectedly international audience should not turn into a bespoke project. Region rules are per site, so each client gets its own, managed alongside the rest from one agency dashboard.

Every site starts with a default rest-of-world rule that never counts against your allowance. How many custom regions you can add on top of it depends on your plan, so check the pricing page if you know you need several.

Related features

Region rules sit on top of the rest of the consent layer. These are the parts they change and the parts they inherit.

Cookie banner

Layouts, categories and consent modes

Legal documents

Cookie and privacy policies

Agencies & teams

Many sites, scoped access

See the full feature set

Geo-targeting questions

What site owners ask before they set up their first region rule.

What is a geo-targeted cookie banner?

A geo-targeted cookie banner is a single consent banner that behaves differently depending on where the visitor is. The script works out the visitor region, looks up the rule you set for that region, and applies it before the banner is drawn. The visitor sees one banner; you maintain one configuration rather than one website per market.

How does a cookie banner know which country a visitor is in?

From the IP address the browser connects with. Kukie reads the country from the Cloudflare country header where it is available, and otherwise from a MaxMind GeoLite2 database held on our own servers, so no separate geolocation service is called. For some countries the lookup also resolves the state or province, which is what makes rules narrower than a whole country possible.

What happens when a visitor region cannot be determined?

Nothing breaks. When the region cannot be resolved, or the lookup does not answer in time, the banner falls back to the default rule you configured for the rest of the world. Every site has that default rule and it cannot be deleted, so there is always something to fall back to and no visitor is left without a banner you chose.

Can I turn the cookie banner off completely in some regions?

Yes. The hidden consent model shows no banner at all in the regions you apply it to. It is the right answer only where you have established that no notice is needed, because with no banner there is also no visitor choice to record. Which regions genuinely need nothing is a legal question rather than a technical one.

Does Global Privacy Control override the rule for a region?

When your site is set to respect it, yes in effect. A Global Privacy Control or Do Not Track signal from the browser puts that visitor into a refused state whichever consent model their region uses, so non-essential scripts stay blocked. The banner is still shown, so the visitor can choose differently if they want to.

Can consent last a different length of time in different regions?

Yes. The consent duration and the re-consent period are part of the region rule, so one region can re-ask after six months while another keeps the answer for a year. The right period is a decision for whoever owns privacy compliance at your organisation rather than a setting with one correct value.

Serve the right banner in every market

One script, rules per region, no second deployment. Free plan, no card required.

Start Free → View pricing

The geo-targeted cookie banner:
one script, a rule per region

One banner for the whole world is wrong in one of two directions

How does the banner know where a visitor is?

The country comes from the IP address

The region is matched to your rules, most specific first

Without an exact rule, the broader one applies

If nothing matches, your default rule catches it

Which consent model should a region use?