Opt-In
European Union
GDPR
The cornerstone EU regulation requiring explicit opt-in consent for all non-essential data processing and cookies.
Global Compliance
Privacy Laws and Cookie Consent Rules Worldwide
Over 40 jurisdictions now regulate how websites collect data and set cookies. Kukie auto-detects visitor location and applies the right rules.
Last reviewed: 14 July 2026
40+ jurisdictions
Auto geo-detection
No coding required
This page is your comprehensive guide to global privacy regulations and cookie consent requirements. Browse by region to find the laws that apply to your visitors, understand the consent model each jurisdiction requires, and read our in-depth guides for every regulation.
40+
Jurisdictions covered with region-specific consent rules out of the box.
6
Regions worldwide - EU/UK, US, Brazil, Canada, South Africa, and more.
3
Consent models (opt-in, opt-out, notice-only) auto-applied via geo-detection.
How Kukie handles it
Three Consent Models, One Banner
Different regions require different consent approaches. Kukie detects each visitor's location and automatically applies the correct model.
Opt-In
Prior Consent Required
Non-essential cookies are blocked until the visitor gives explicit consent. This is the strictest model and is required across the EU, UK, Brazil, and parts of Asia-Pacific.
EU/EEA
UK
Brazil
Switzerland
South Korea
South Africa
Opt-Out
Right to Opt Out
Cookies may be set by default, but visitors must have a clear way to opt out of data sale or sharing. Used by most US state privacy laws and parts of Canada.
California
Virginia
Colorado
Texas
Oregon
15+ US states
Notice-Only
Inform and Disclose
Websites must inform visitors about data collection, but explicit consent may not be required for all cookie types. Common in parts of Asia-Pacific and the Middle East.
India
Thailand
Philippines
UAE
Vietnam
Region
Europe (EU, UK & EEA)
Europe pioneered the opt-in consent model. The GDPR, ePrivacy Directive, and national implementations all require explicit prior consent before setting non-essential cookies. Enforcement is active, with significant fines issued regularly.
Opt-In
European Union
ePrivacy Directive
The "Cookie Law" - specifically targets electronic communications and requires consent for storing cookies on user devices.
Opt-In
United Kingdom
UK GDPR
The UK's post-Brexit version of the GDPR, maintained alongside the Data Protection Act 2018 with minor divergences.
Opt-In
Germany
DSGVO
Germany's implementation of the GDPR, enforced by 16 state-level data protection authorities plus the BfDI at federal level.
Opt-In
France
CNIL Guidelines
France's data protection authority CNIL enforces strict cookie consent rules, including equal prominence for accept and reject buttons.
Opt-In
Switzerland
FADP
The revised Swiss Federal Act on Data Protection, aligned closely with GDPR standards for cross-border data adequacy.
Opt-In
European Union
Digital Markets Act
The DMA regulates gatekeeper platforms, impacting how Big Tech handles consent and data sharing across the digital ecosystem.
Opt-In
European Union
EU Omnibus Directive
Proposed changes to GDPR enforcement, including a framework for legitimate interest in direct marketing and streamlined compliance for SMEs.
Opt-In
European Union
IAB TCF v2.3
The IAB Transparency and Consent Framework - an industry standard for communicating consent signals across the ad tech supply chain.
Region
United States
The US has no federal privacy law. Instead, over 20 states have passed their own data privacy legislation, most following an opt-out model where data collection is allowed but consumers can refuse the sale or sharing of their information.
Opt-Out
California, USA
CCPA / CPRA
California's landmark consumer privacy laws granting the right to know, delete, and opt out of the sale of personal information.
Opt-Out
Virginia, USA
VCDPA
Virginia's Consumer Data Protection Act - one of the first states to follow California with a comprehensive privacy framework.
Opt-Out
Colorado, USA
CPA
Colorado's Privacy Act requires data controllers to honour universal opt-out mechanisms including Global Privacy Control.
Opt-Out
Connecticut, USA
CTDPA
Connecticut's data privacy act with broad consumer rights and a requirement to process universal opt-out signals.
Opt-Out
Texas, USA
TDPSA
Texas's data privacy law applies to businesses processing data of Texas residents, with a focus on data sale opt-out rights.
Opt-Out
Oregon, USA
OCPA
Oregon's Consumer Privacy Act includes broad definitions of personal data and requires opt-out mechanisms for targeted advertising.
Federal & Cross-Cutting US Laws
COPPA
Read guide →CAN-SPAM Act
Read guide →CalOPPA
Read guide →Global Privacy Control
Read guide →
Region
Brazil
Brazil's Lei Geral de Proteção de Dados (LGPD) is a comprehensive data protection law modelled on the GDPR. It requires explicit consent for data processing, with enforcement by the ANPD national authority.
Opt-In
Brazil
LGPD
Brazil's General Data Protection Law - a comprehensive framework covering consent, data subject rights, breach notification, and international transfers.
Opt-In
Brazil
LGPD Data Subject Rights
Read the full guide →
Opt-In
Brazil
LGPD Enforcement & Fines
Read the full guide →
Opt-In
Brazil
ANPD
Read the full guide →
Region
Canada
Canada's PIPEDA requires meaningful consent for the collection, use, and disclosure of personal information. Provinces can enact "substantially similar" legislation, and Bill C-27 proposes a complete overhaul via the CPPA.
Opt-In
Canada
PIPEDA
Canada's federal privacy law governing how private-sector organisations collect, use, and disclose personal information in the course of commercial activities.
Opt-In
Canada
PIPEDA Breach Notification
Read the full guide →
Opt-In
Canada
Bill C-27 / CPPA
Read the full guide →
Opt-In
Canada
Provincial Privacy Laws
Read the full guide →
Region
Asia-Pacific
Asia-Pacific is a patchwork of consent regimes. China's PIPL and South Korea's PIPA require strict opt-in consent, while India and Thailand take a lighter notice-based approach. Data localisation requirements add additional complexity.
Opt-In
China
PIPL
China's comprehensive Personal Information Protection Law - requires separate consent for cross-border transfers and sensitive data processing.
Read the full guide →
Opt-In
Japan
APPI
Japan's Act on Protection of Personal Information, with strict rules on personal data handling and cross-border transfers.
Read the full guide →
Opt-In
Singapore
PDPA
Singapore's Personal Data Protection Act balances business needs with individual privacy through a consent-based framework.
Read the full guide →
Notice-Only
Thailand
PDPA
Thailand's data protection act modelled on the GDPR, with consent requirements and breach notification obligations.
Read the full guide →
Notice-Only
India
DPDPA
India's Digital Personal Data Protection Act - applies to digital personal data with a notice-and-consent framework.
Read the full guide →
Opt-In
South Korea
PIPA
South Korea's Personal Information Protection Act is one of the strictest in Asia, with heavy fines and criminal penalties.
Read the full guide →
Notice-Only
Australia
Privacy Act
Australia's Privacy Act governs handling of personal information by government agencies and organisations above the revenue threshold.
Read the full guide →
Notice-Only
New Zealand
Privacy Act 2020
New Zealand's updated privacy framework with mandatory breach reporting and cross-border disclosure controls.
Read the full guide →
Notice-Only
Philippines
Data Privacy Act
The Philippines' DPA protects individual personal information with consent requirements and a national privacy commission.
Read the full guide →
Notice-Only
Vietnam
Decree 13/2023
Vietnam's data protection decree introduces consent obligations and data localisation requirements for certain categories.
Read the full guide →
Region
Middle East & Africa
Data protection regulation in the Middle East and Africa is growing rapidly. South Africa's POPIA is one of the most comprehensive, while the UAE and Saudi Arabia have introduced modern frameworks for their digital economies.
Notice-Only
United Arab Emirates
UAE PDPL
The UAE's federal Personal Data Protection Law establishes data processing principles and consent requirements for the UAE's rapidly growing digital economy.
Read the full guide →
Opt-In
South Africa
POPIA
South Africa's Protection of Personal Information Act is a GDPR-inspired framework requiring lawful processing, consent, and notification of data subjects.
Read the full guide →
Multi-region
Cross-Border and Technical Compliance
Some compliance topics apply across multiple jurisdictions. These guides cover consent mechanisms, industry standards, and technical requirements that span the regulatory landscape.
Cookie Categories
Understanding the different types of cookies and how to categorise them for compliance.
Read guide →Google Consent Mode v2
How Google Consent Mode works with your cookie banner to preserve analytics and ad measurement.
Read guide →Opt-In vs Opt-Out
The key differences between consent models and when each applies to your website.
Read guide →Data Sovereignty
Where data can be stored and processed - cross-border transfer rules across jurisdictions.
Read guide →Children's Privacy Worldwide
Age verification, parental consent, and child-specific protections across global regulations.
Read guide →Dark Patterns in Cookie Banners
What counts as a deceptive design pattern and how regulators are cracking down.
Read guide →Global Privacy Control
The browser-level universal opt-out signal and which laws require you to honour it.
Read guide →Cookie Consent Fines
A look at enforcement actions and fines issued for cookie consent violations.
Read guide →One Script, Every Region
How Geo-Detection Works
Kukie applies the right consent model to each visitor automatically - here is the mechanism behind it.
1
Country Resolved From IP
When the banner loads, the visitor's country is resolved from their IP address against a locally hosted MaxMind GeoLite2 database on our EU servers - no third-party geolocation service is called.
2
Region Rules Applied
The country is matched against your site's region rules: opt-in banner for EU/UK visitors, opt-out notice for US visitors, a simple notice elsewhere - including region-specific texts and languages.
3
Safe Fallback
If a location cannot be determined (VPNs, unusual networks), the banner falls back to your site's default configuration - so no visitor ever goes without the consent experience you configured.
Frequently Asked Questions
Common questions about cookie consent laws around the world.
Which countries require a cookie consent banner?
Any website with visitors in the EU/EEA, the UK, or Switzerland needs an opt-in cookie banner - non-essential cookies must stay blocked until the visitor agrees. Several other jurisdictions, including Brazil (LGPD) and South Africa (POPIA), also require consent or clear notice for tracking. Most US state laws follow an opt-out model instead, where cookies may load by default but visitors need an accessible way to refuse data sales and targeted advertising.
What is the difference between opt-in and opt-out consent?
Under an opt-in model (GDPR, ePrivacy), no non-essential cookies may be set before the visitor actively agrees - silence or scrolling does not count as consent. Under an opt-out model (most US state laws), cookies may be set by default, but visitors must be able to refuse the sale or sharing of their data, typically via a "Do Not Sell" link or a universal opt-out signal like Global Privacy Control.
Do I need a different cookie banner for every country?
No. A geo-targeting consent platform shows each visitor the consent experience their region requires from a single script: an opt-in banner for EU visitors, an opt-out notice for US visitors, and a simple notice elsewhere. You configure the rules once and the correct banner is applied automatically based on visitor location.
Is GDPR-style consent enough for visitors from other countries?
Showing a strict opt-in banner to everyone is legally safe almost everywhere, because GDPR consent exceeds the requirements of most other laws. The trade-off is data loss: opt-in banners reduce analytics and advertising data in regions that do not require them. Geo-targeting lets you stay compliant while only applying the strict model where the law demands it.
Which US states have privacy laws?
More than 20 US states have comprehensive privacy laws, starting with California (CCPA/CPRA) and followed by Virginia, Colorado, Connecticut, Texas, Oregon, Montana, and others. Nearly all follow an opt-out model. See the state-by-state comparison above for the full list, or read our detailed guide for each law.
What happens if a website ignores cookie consent laws?
Enforcement varies by jurisdiction. GDPR fines can reach EUR 20 million or 4% of global annual turnover, and EU data protection authorities routinely fine sites for missing or manipulative cookie banners. US state attorneys general can seek civil penalties per violation, and California actively enforces CCPA/CPRA. Beyond fines, non-compliance is increasingly visible to users, competitors, and complaint-driven regulators.
One Banner, Every Jurisdiction
Kukie auto-detects each visitor's location and applies the correct consent model - opt-in for the EU, opt-out for the US, notice for everywhere else. Start with a free scan to see what your site is setting.
