Cookie consent laws around the world are not all the same. Some regions require websites to obtain permission before using non-essential cookies, while others focus on transparency and the right to opt out.
This can be confusing for website owners, especially when visitors come from several countries. This guide compares the main approaches used in the European Union, United Kingdom, Norway, Switzerland, United States, Canada, Brazil, and Australia.
If you are new to this topic, start with our guide explaining what web cookies are and how they work.
Cookie consent laws vary by region. The EU and Norway generally require prior consent for non-essential cookies, while many US privacy laws focus on notice and opt-out rights. Other countries use privacy laws that may require consent depending on the data collected and how it is used.
What Are Cookie Consent Laws?
Cookie consent laws are rules that control how websites store information on a visitor’s device or collect information through online tracking technologies.
Despite the name, these rules do not always come from a specific “cookie law.” They may be part of:
- data protection laws;
- electronic communications laws;
- consumer privacy laws;
- online advertising rules;
- laws protecting children or sensitive information.
The rules may also cover more than traditional browser cookies. Tracking pixels, local storage, advertising identifiers, embedded services, and browser fingerprinting can fall within the scope of privacy or tracking requirements.
Before applying any legal requirement, you therefore need to understand the types of cookies and tracking technologies used by your website.
Opt-In vs Opt-Out Cookie Consent
One of the biggest differences between international cookie laws is whether they use an opt-in or opt-out approach.
Opt-in consent
Under an opt-in system, certain cookies or trackers should not be activated until the visitor makes a clear choice.
This approach commonly applies to non-essential analytics, advertising, and tracking technologies in European-style consent systems.
Opt-out rights
Under an opt-out system, certain data collection may begin without prior permission. However, the visitor must be informed and given a clear way to stop specific uses of their information.
For example, some US privacy laws allow consumers to opt out of the sale or sharing of personal information and its use for targeted advertising.
An EU visitor may need to select “Accept” before advertising cookies are activated. A California visitor may instead need a clear option to stop personal information from being sold or shared for cross-context behavioural advertising.
These are general models. Individual laws can include exceptions, special rules for sensitive information, and different requirements for children.
Cookie Consent Laws Around the World at a Glance
The following table gives a simplified comparison of the main regions covered in this guide.
| Region | Main framework | Common approach | Is a banner always required? |
|---|---|---|---|
| European Union | ePrivacy rules and GDPR | Prior consent for many non-essential cookies | No, it depends on the cookies used |
| United Kingdom | PECR and UK GDPR | Prior consent unless an exception applies | No, it depends on the technologies used |
| Norway | Ekomloven and GDPR | Prior consent for non-essential cookies | Usually required when non-essential tracking is used |
| Switzerland | FADP and Telecommunications Act | Opt-out in many cases; opt-in for higher-risk processing | No, requirements depend on the processing |
| United States | Federal sectoral and state privacy laws | Mainly notice and opt-out rights | No, requirements depend on the applicable law |
| California | CCPA and CPRA | Opt-out of sale or sharing | No, the business must first fall within the law |
| Canada | PIPEDA and provincial laws | Context-dependent meaningful consent | No, it depends on the data and purpose |
| Brazil | LGPD | Transparency and an appropriate legal basis | No, it depends on the processing |
| Australia | Privacy Act and Australian Privacy Principles | Transparency, data minimisation, and context-dependent consent | No, there is no universal EU-style requirement |
This table is only a general comparison. Whether a law applies can depend on the website, business, visitor, type of information collected, and purpose of the tracking.
European Union Cookie Consent Laws
Cookie requirements in the European Union mainly come from national laws implementing the ePrivacy Directive. The GDPR also applies when cookies or similar technologies process personal data.
In general, websites should obtain consent before activating non-essential cookies. This can include cookies used for:
- advertising and remarketing;
- cross-site tracking;
- social media tracking;
- many analytics purposes;
- building visitor profiles.
Consent should be freely given, informed, specific, and based on a clear action. Visitors should also be able to reject non-essential cookies and withdraw consent later.
Cookies that are strictly necessary to provide a service requested by the visitor may be exempt from the consent requirement. Examples can include login, security, or shopping cart cookies.
The European Union’s official business guidance explains that cookies requiring consent should not be set when the page first opens. Read the EU guidance on using cookies for more information.
Want a clearer explanation of how GDPR cookie consent works?
United Kingdom Cookie Consent Laws
The United Kingdom uses the Privacy and Electronic Communications Regulations, commonly called PECR, alongside the UK GDPR.
PECR applies when a website or online service stores information on a user’s device or accesses information already stored there. The rules can cover:
- browser cookies;
- tracking pixels;
- web storage;
- scripts and tags;
- device fingerprinting;
- similar storage and access technologies.
Prior consent is required unless a specific PECR exception applies. If the information is also personal data, the UK GDPR may create additional obligations.
The Information Commissioner’s Office published updated guidance in 2026 that explains how PECR applies to cookies and other storage and access technologies. See the ICO storage and access technologies guidance.
Our separate UK guide will examine the available exceptions, valid consent, statistical uses, and practical banner requirements in more detail.
Norway Cookie Consent Laws
Norway is not an EU member, but it is part of the European Economic Area and applies the GDPR.
Cookie use is also regulated by section 3-15 of the Norwegian Electronic Communications Act, commonly called Ekomloven.
Following a legal change that took effect on 1 January 2025, consent for cookies and similar technologies must meet the GDPR standard. This means consent should be obtained before non-essential cookies or trackers are used.
The rules are technology-neutral. They can apply even when the stored or accessed information is not personal data. Strictly necessary technologies may fall within an exception.
Norway’s data protection authority provides practical examples of valid and invalid consent mechanisms in its cookie and tracking technology guidance.
Switzerland Cookie Consent Laws
Switzerland is not part of the European Union or European Economic Area. Its main data protection framework is the Federal Act on Data Protection, known as the FADP.
Swiss requirements are not identical to the EU’s general prior-consent model.
According to guidance from the Swiss Federal Data Protection and Information Commissioner, non-essential cookies do not automatically require consent in every situation. However, website visitors must generally be informed and given an effective opportunity to reject non-essential cookies.
Express opt-in consent becomes more important when processing involves sensitive personal data, high-risk profiling, or particularly intrusive uses of tracking technologies.
The Swiss authority also warns against dark patterns and recommends that withdrawing consent or rejecting cookies should not be more difficult than accepting them.
Website owners can read the official Swiss cookie guidance for additional details.
A GDPR-style opt-in banner may still be appropriate for a Swiss website with visitors in the European Economic Area. The laws that apply do not depend only on where the website owner is located.
United States Cookie Consent Laws
The United States does not have one comprehensive federal cookie law equivalent to the EU’s ePrivacy framework.
Instead, online tracking may be affected by a combination of:
- state consumer privacy laws;
- federal laws applying to specific industries;
- children’s privacy requirements;
- consumer protection and unfair practice rules;
- contractual requirements from advertising platforms.
Many state privacy laws use a notice-and-opt-out approach. They may give consumers the right to opt out of the sale of personal data, targeted advertising, profiling, or certain types of data sharing.
Some laws also require consent before processing sensitive personal information or information belonging to children.
This means a US website does not automatically need the same Accept and Reject banner used in the EU. However, it may need a privacy notice, preference controls, an opt-out mechanism, or a region-specific consent interface.
For a simple introduction to the two models, see our comparison of GDPR vs CCPA.
California Cookie Consent Requirements
California has one of the best-known state privacy frameworks in the United States. The California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives consumers several rights over their personal information.
For cookies and online tracking, an important requirement is the right to opt out of the sale or sharing of personal information.
Under the CCPA, “sharing” includes sharing personal information for cross-context behavioural advertising. This can make some advertising and tracking technologies relevant even when no money changes hands.
Covered businesses may need to:
- explain their online data collection practices;
- provide an accessible opt-out method;
- stop selling or sharing information after an opt-out request;
- honour applicable Global Privacy Control signals;
- apply additional protections to sensitive information and minors.
The CCPA does not apply to every website or small business. Businesses must first check whether they fall within its scope.
The California Attorney General explains the consumer’s right to opt out of sale or sharing and how the Global Privacy Control works.
Canada Cookie Consent Laws
Canada does not have one federal law dedicated only to browser cookies. However, cookies and tracking technologies can fall within privacy laws when they collect, use, or disclose personal information.
The federal Personal Information Protection and Electronic Documents Act, commonly called PIPEDA, generally requires meaningful consent for the collection, use, and disclosure of personal information.
Meaningful consent means people should understand:
- what information is being collected;
- why it is being collected;
- which organisations may receive it;
- the important consequences or risks;
- which choices are available.
The appropriate form of consent depends on the context. Express consent is generally more appropriate for sensitive information, unexpected uses, or processing that creates a meaningful risk of harm. Implied consent may be possible in more limited situations.
Provincial privacy laws can create additional requirements. A website serving Canadian visitors should therefore avoid treating Canada as one completely uniform consent region.
The Office of the Privacy Commissioner of Canada provides more information about meaningful consent under PIPEDA.
Brazil Cookie Consent Laws
Brazil’s General Data Protection Law, known as the LGPD, regulates the processing of personal data. Cookies and similar identifiers may fall within the law when they relate to an identified or identifiable person.
Consent is one possible legal basis under the LGPD, but it is not the only one. The correct legal basis depends on the purpose and circumstances of the processing.
Website owners should still provide clear information about:
- which cookie categories are used;
- why information is collected;
- how long cookies remain active;
- whether information is shared with third parties;
- how visitors can manage their choices.
Brazil’s National Data Protection Authority has published an official guide covering cookies, cookie policies, and consent banners. The guidance encourages clear choices and discourages designs that make refusing cookies unnecessarily difficult.
See the ANPD announcement and its Cookies and Personal Data Protection guide.
Australia Cookie Consent Laws
Australia does not use the same universal prior-consent model as the European Union. The Privacy Act 1988 and the Australian Privacy Principles become important when cookies, pixels, or other trackers handle personal information.
The Office of the Australian Information Commissioner states that the Privacy Act does not prohibit tracking pixels. However, organisations must use them in a way that complies with Australian privacy obligations.
Depending on the circumstances, organisations may need to:
- collect only information that is reasonably necessary;
- clearly explain their use of tracking technologies;
- avoid covert collection;
- obtain consent before collecting sensitive information;
- provide a simple opt-out for certain direct marketing uses;
- review tracking pixels and third-party services regularly.
A banner or pop-up can be one way to provide notice or offer privacy choices, but it is not automatically required for every Australian website.
The OAIC provides detailed guidance about tracking pixels and Australian privacy obligations.
Which Cookie Laws Apply to Your Website?
The location of your business is important, but it is not the only factor.
Depending on the law, you may also need to consider:
- where your visitors are located;
- whether you offer goods or services in that region;
- whether you monitor people’s online behaviour;
- what types of information you collect;
- whether the information is sensitive;
- whether children use the website;
- whether data is sold, shared, or used for targeted advertising;
- whether the law includes business size, revenue, or data-volume thresholds.
Do not assume that only the law of your home country matters. Some privacy laws can apply to businesses outside the region when they target, serve, or monitor people located there. The exact scope must be checked separately for each law.
A small local website and a large international ecommerce store may therefore have very different obligations, even if they use similar cookies.
Practical Cookie Compliance Steps for Website Owners
You do not need to start by reading every privacy law in full. Begin by understanding what your own website does.
Use these steps to identify the requirements that may be relevant to your website.
- Identify your cookies and trackers. Check analytics, advertising, embeds, plugins, forms, and third-party scripts.
- Categorise each technology. Separate necessary, preference, analytics, and marketing purposes.
- Review your visitor locations. Identify the main countries and regions your website serves.
- Check the applicable laws. Consider regional scope, business thresholds, and the type of data processed.
- Choose the correct consent model. Your website may need opt-in consent, opt-out controls, or both.
- Update your privacy information. Clearly explain your cookies, purposes, providers, and user choices.
- Configure your consent tool. Make sure its regional settings match your actual requirements.
- Test the final setup. Confirm that cookies and trackers respond correctly to user choices.
A cookie audit is a good starting point because it shows what your website is actually loading.
You should also create or update your cookie policy and then test your cookie banner after configuring it.
Do You Need a Different Banner for Different Regions?
Not always. There are two common approaches.
Use one strict consent model
Some websites use an EU-style opt-in banner for all visitors. This can make the technical setup easier, but it may request more consent than is legally required in some regions.
Use region-specific settings
Other websites use geolocation or regional consent settings. For example:
- an EU or Norwegian visitor receives prior opt-in choices;
- a California visitor receives sale and sharing opt-out controls;
- an Australian visitor receives an appropriate notice and marketing choices.
A consent management platform may help manage these variations, but the tool must still be configured correctly. Installing a banner does not automatically make a website compliant.
Choose a consent tool that supports the regions your visitors actually come from. Then test each regional configuration instead of relying only on the tool’s default settings.
Conclusion
Cookie consent laws around the world do not follow one universal model. The European Union, the United Kingdom, and Norway generally use consent-first rules for non-essential technologies. Many US laws focus more heavily on notice and opt-out rights, while countries such as Canada, Brazil, Switzerland, and Australia use requirements that depend on the data and purpose involved.
The best starting point is not the banner itself. First identify your cookies and trackers, check where your visitors are located, and determine which legal frameworks may apply. You can then choose and configure an appropriate consent solution.
Ready to explore one region in more detail? Continue with our UK cookie consent guide to learn how PECR and the UK GDPR affect websites using cookies and tracking technologies.
This article provides general information about cookie consent and privacy requirements. It does not constitute legal advice.
Frequently Asked Questions
Common questions about this topic
No. Cookie and tracking requirements vary considerably. Some regions require prior consent for non-essential technologies, while others focus on transparency, legal basis, or opt-out rights.
Both can matter. Some laws apply because a business is established in a region, while others may apply when an outside business offers services to or monitors people located there.
No. The answer depends on the law, the cookies and trackers used, the information collected, and whether the business falls within the law’s scope.
Opt-in requires the visitor to make a choice before certain processing begins. Opt-out allows the visitor to stop a type of processing that may otherwise take place.
It may be possible, especially if the website uses a stricter consent model for everyone. However, international websites often use regional settings to provide the appropriate controls for different visitors.
Possibly. Some laws include business-size or revenue thresholds, while others can apply regardless of website size. A small website should still check its cookies, visitors, and the scope of the relevant laws.
