Cookie categories
The kinds of cookies and how to sort them into categories.
Privacy laws and cookie consent rules worldwide
Know the rule for each region.
Over 40 jurisdictions now regulate how websites collect data and set cookies. Kukie.io reads each visitor's country and applies the rule you set for their region.
Last reviewed on .
- Jurisdictions on this page, with a region rule you can set for each
- 40+
- Regions of the world, from the EU and the UK to Brazil, Canada and South Africa
- 6
- Consent models, opt-in, opt-out and notice only, applied by the visitor's country
- 3
How Kukie.io handles it
Three consent models, one banner.
Different regions ask for different kinds of consent. Browse by region to find the laws that apply to your visitors, the model each one uses and a guide to every law.
-
Opt-in
Prior consent required
Cookies that are not strictly necessary are blocked until the visitor gives explicit consent. It is the strictest model, used across the EU, the UK, Brazil and parts of Asia-Pacific.
- EU and EEA
- UK
- Brazil
- Switzerland
- South Korea
- South Africa
-
Opt-out
A right to opt out
Cookies may be set by default, but visitors need a clear way to opt out of the sale or sharing of their data. Used by most US state privacy laws and parts of Canada.
- California
- Virginia
- Colorado
- Texas
- Oregon
- 15+ US states
-
Notice only
Inform and disclose
Websites must tell visitors about data collection, but explicit consent may not be needed for every type of cookie. Common in parts of Asia-Pacific and the Middle East.
- India
- Thailand
- Philippines
- UAE
- Vietnam
Europe (EU, UK and EEA)
Europe pioneered the opt-in model. The GDPR, the ePrivacy Directive and their national implementations all require explicit prior consent before cookies that are not strictly necessary are set, and enforcement is active.
Opt-in required
-
Opt-in European Union
GDPR
The EU regulation at the centre of it all, requiring explicit opt-in consent for data processing and cookies that are not strictly necessary.
-
Opt-in European Union
ePrivacy Directive
The "cookie law": it covers electronic communications and requires consent before cookies are stored on a visitor's device.
-
Opt-in United Kingdom
UK GDPR
The UK's version of the GDPR after Brexit, kept alongside the Data Protection Act 2018 with small differences.
-
Opt-in Germany
DSGVO
Germany's implementation of the GDPR, enforced by 16 state data protection authorities and the BfDI at federal level.
-
Opt-in France
CNIL guidelines
France's data protection authority, the CNIL, enforces strict cookie consent rules, including equal prominence for accept and reject buttons.
-
Opt-in Switzerland
FADP
The revised Swiss Federal Act on Data Protection, closely aligned with the GDPR for cross-border data adequacy.
-
Opt-in European Union
Digital Markets Act
The DMA regulates gatekeeper platforms, which changes how the largest technology companies handle consent and data sharing.
-
Opt-in European Union
EU Omnibus Directive
Proposed changes to GDPR enforcement, including legitimate interest for direct marketing and simpler rules for small businesses.
-
Opt-in European Union
IAB TCF v2.3
The IAB Transparency and Consent Framework, an industry standard for passing consent signals through the advertising supply chain.
United States
The US has no federal privacy law. Over 20 states have passed their own, and most follow an opt-out model: data collection is allowed, but consumers can refuse the sale or sharing of their information.
Opt-out rights
-
Opt-out California, USA
CCPA and CPRA
California's consumer privacy laws: the right to know, to delete and to opt out of the sale of personal information.
-
Opt-out Virginia, USA
VCDPA
Virginia's Consumer Data Protection Act, one of the first to follow California with a comprehensive privacy law.
-
Opt-out Colorado, USA
CPA
Colorado's Privacy Act requires businesses to honour universal opt-out signals, including Global Privacy Control.
-
Opt-out Connecticut, USA
CTDPA
Connecticut's data privacy act, with broad consumer rights and a duty to process universal opt-out signals.
-
Opt-out Texas, USA
TDPSA
Texas's data privacy law covers businesses that process the data of Texas residents, with a focus on the right to opt out of data sales.
-
Opt-out Oregon, USA
OCPA
Oregon's Consumer Privacy Act uses a broad definition of personal data and requires an opt-out for targeted advertising.
Federal and cross-cutting US laws
Brazil
Brazil's Lei Geral de Proteção de Dados (LGPD) is a comprehensive data protection law modelled on the GDPR. It requires explicit consent for data processing and is enforced by the national authority, the ANPD.
Opt-in required
-
Opt-in Brazil
LGPD
Brazil's General Data Protection Law, covering consent, data subject rights, breach notification and international transfers.
Canada
Canada's PIPEDA requires meaningful consent to collect, use and disclose personal information. Provinces can pass 'substantially similar' laws, and Bill C-27 proposes replacing it with the CPPA.
Opt-in required
-
Opt-in Canada
PIPEDA
Canada's federal privacy law for how private-sector organisations collect, use and disclose personal information in commercial activity.
Asia-Pacific
Asia-Pacific mixes consent regimes. China's PIPL and South Korea's PIPA require strict opt-in consent, while India and Thailand take a lighter approach based on notice. Rules on where data is stored add to it.
Mixed models
-
Opt-in China
PIPL
China's Personal Information Protection Law requires separate consent for cross-border transfers and for processing sensitive data.
-
Opt-in Japan
APPI
Japan's Act on the Protection of Personal Information, with strict rules on handling personal data and transferring it abroad.
-
Opt-in Singapore
PDPA
Singapore's Personal Data Protection Act balances business needs and individual privacy through a framework based on consent.
-
Notice only Thailand
PDPA
Thailand's data protection act, modelled on the GDPR, with consent requirements and breach notification duties.
-
Notice only India
DPDPA
India's Digital Personal Data Protection Act covers digital personal data, with a framework of notice and consent.
-
Opt-in South Korea
PIPA
South Korea's Personal Information Protection Act is one of the strictest in Asia, with heavy fines and criminal penalties.
-
Notice only Australia
Privacy Act
Australia's Privacy Act covers personal information held by government agencies and by organisations above the revenue threshold.
-
Notice only New Zealand
Privacy Act 2020
New Zealand's updated privacy law, with mandatory breach reporting and controls on disclosure abroad.
Read the full guide about the Privacy Act 2020 of New Zealand
-
Notice only Philippines
Data Privacy Act
The Philippines' Data Privacy Act protects personal information, with consent requirements and a national privacy commission.
Read the full guide about the Data Privacy Act of Philippines
-
Notice only Vietnam
Decree 13/2023
Vietnam's data protection decree adds consent duties and requires some kinds of data to be stored in Vietnam.
Middle East and Africa
Data protection law in the Middle East and Africa is growing fast. South Africa's POPIA is one of the most comprehensive, and the UAE and Saudi Arabia have introduced modern frameworks for their digital economies.
Mixed models
-
Notice only United Arab Emirates
UAE PDPL
The UAE's federal Personal Data Protection Law sets principles and consent requirements for its growing digital economy.
-
Opt-in South Africa
POPIA
South Africa's Protection of Personal Information Act, inspired by the GDPR, requires lawful processing, consent and notification of data subjects.
Several regions
Cross-border and technical topics.
Some topics apply in many jurisdictions at once. These guides cover consent mechanisms, industry standards and technical requirements that span the laws above.
Google Consent Mode v2
How Google Consent Mode works with your banner to keep analytics and ad measurement.
Opt-in and opt-out
How the two consent models differ, and when each applies to your website.
Data sovereignty
Where data may be stored and processed: the rules on cross-border transfers.
Children's privacy worldwide
Age checks, parental consent and child-specific protections across the laws.
Dark patterns in cookie banners
What counts as a deceptive design and how regulators act on it.
Global Privacy Control
The browser's universal opt-out signal and which laws require you to honour it.
Cookie consent fines
Enforcement actions and fines for cookie consent failures.
One script, every region
How Kukie.io matches a region.
One script reads the visitor's country and applies the rule you set, with a fallback for when it cannot.
-
Step 1: The country is read
When the banner loads, the visitor's country comes from the country header our content delivery network, Cloudflare, adds to the request or, failing that, from a MaxMind GeoLite2 database on our EU servers. No IP address is sent to a separate geolocation service. -
Step 2: Your region rules apply
The country is matched against your site's region rules, such as an opt-in banner for visitors from the EU and the UK, an opt-out notice for California and a simple notice elsewhere, with each region's own texts and languages. -
Step 3: A safe fallback
If no rule matches the visitor's country, they get your rest-of-world rule. If the lookup fails or takes more than 3 seconds, the banner applies the strictest rule your site has.
Questions about consent laws
Which countries require a cookie consent banner?
Any website with visitors in the EU and the EEA, the UK or Switzerland needs an opt-in cookie banner: cookies that are not strictly necessary stay blocked until the visitor agrees. Several other jurisdictions, including Brazil (LGPD) and South Africa (POPIA), also require consent or clear notice for tracking. Most US state laws follow an opt-out model instead, where cookies may load by default but visitors need an easy way to refuse the sale of their data and targeted advertising.
What is the difference between opt-in and opt-out consent?
Under an opt-in model (the GDPR and ePrivacy), no cookie that is not strictly necessary may be set before the visitor actively agrees: silence or scrolling does not count as consent. Under an opt-out model (most US state laws), cookies may be set by default, but visitors must be able to refuse the sale or sharing of their data, usually through a Do Not Sell link or a universal opt-out signal such as Global Privacy Control.
Do I need a different cookie banner for every country?
No. A consent platform with geo-targeting shows each visitor the consent experience you set for their region from one script, such as an opt-in banner for EU visitors, an opt-out notice for California and a simple notice elsewhere. You set the rules once, and the banner follows them by visitor location.
Is GDPR-style consent enough for visitors from other countries?
Showing a strict opt-in banner to everyone is the cautious choice, because GDPR-style prior consent asks more than most other laws. The cost is data: opt-in banners reduce analytics and advertising data in regions that do not require them. Geo-targeting lets you apply the strict model only in the regions where you decide it is needed.
Which US states have privacy laws?
More than 20 US states have comprehensive privacy laws, starting with California (CCPA and CPRA) and followed by Virginia, Colorado, Connecticut, Texas, Oregon, Montana and others. Nearly all follow an opt-out model. The United States section on this page lists them, with a guide to each law.
What happens if a website ignores cookie consent laws?
Enforcement varies by jurisdiction. GDPR fines can reach €20 million or 4% of worldwide annual turnover, whichever is higher (Article 83(5) GDPR), and EU data protection authorities regularly fine sites for missing or manipulative cookie banners. US state attorneys general can seek civil penalties per violation, and California enforces the CCPA and CPRA. Beyond fines, a missing banner is easy for visitors, competitors and complaint-driven regulators to see.
A rule for every region you serve.
Kukie.io reads each visitor's country and applies the consent model you set for their region. Scan your website to see what it sets today.
Disclaimer
Kukie.io provides tools to collect and record consent. It is not legal advice, and using it does not by itself make a website compliant with any law.
