Cookie Consent Laws Around the World: What Every Website Owner Needs to Know

What are cookie consent laws?

Cookie consent laws is a convenient search term for several overlapping rules. Some regulate storing or accessing information on a device. Others govern personal-data processing, advertising or consumer privacy rights. A website owner needs to connect those rules to the tools running on the site, rather than choose a banner based on its appearance.

This guide explains the concepts. For a side-by-side regional overview, use our global privacy law comparison. For an implementation workflow, go to the international cookie review checklist.

Why cookies are only part of the picture

The EDPB’s technical guidance examines Article 5(3) beyond traditional cookies, including tracking techniques such as pixels and unique identifiers. Removing a cookie does not, by itself, resolve questions about device access.

Official source: EDPB technical scope guidance

As a practical first step, inventory scripts, embedded videos, chat widgets, tag managers and browser storage together. A marketing team may recognise a vendor name while a developer recognises a network endpoint. Bring those views together before deciding which controls are needed.

Opt-in, opt-out and exemptions: three different decisions

Prior consent

An opt-in setup waits for a valid choice before activating a purpose that requires consent. The relevant question is what happens before a visitor clicks—not simply whether the banner eventually records a decision. In the EU, the cookie-banner task force emphasised understandable choices and identified problems with missing refusal options.

Source: CNIL summary of the EDPB cookie banner task force report

Opt-out rights

For covered businesses, California’s CCPA includes sale and sharing opt-out rights. Global Privacy Control is one way consumers communicate those requests. This is not a blanket rule that every US website must use a European-style opt-in banner.

Official source: California CCPA guidance

Purpose-specific exemptions

An exemption is a conditional legal assessment, not a category name in a dashboard. The UK’s updated guidance recognises five exceptions. Statistical and appearance uses require information and an easy, free objection mechanism, alongside the other applicable conditions.

Official source: UK PECR exceptions

Which countries should your website consider?

Start with the markets you deliberately serve, your operating entities, the people whose information you process and the activities you carry out. Then ask your adviser to assess each law’s territorial reach and thresholds. A visitor’s IP-derived location can help select a configuration, but cannot settle legal applicability on its own.

• An Indian SaaS business serving European customers should review more than its registered-office location.
• A retailer using advertising vendors should examine data sharing as well as cookie storage.
• A site for children or handling sensitive information needs additional assessment; a standard adult marketing flow may be unsuitable.

These examples identify questions for review; they do not establish that a particular law applies to every business fitting that description.

Does every cookie need permission?

No universal yes-or-no answer works across jurisdictions. Record the purpose and assess the relevant rule. A login or basket function and a behavioural advertising profile do not have the same job. Calling both “necessary” conceals that distinction.

Canada’s privacy regulator discusses how sensitivity and context affect the form of consent for behavioural advertising. In Brazil, ANPD’s cookie guidance connects cookie use with LGPD principles and provides recommendations for notices and banners. Neither should be reduced to a copy of another region’s interface.

Official source: Canada advertising guidance

Official source: Brazil ANPD cookie guide announcement

How to make the first review manageable

• List each tool, its owner, purpose, data recipients and the pages where it appears.
• Separate confirmed facts from assumptions, such as a vendor’s claimed exemption.
• Map each purpose to the appropriate choice, notice or objection mechanism.
• Check the initial visit and subsequent choices using a fresh browser state.
• Document unresolved findings and give each an owner and review date.

For example, if the marketing team adds a new campaign pixel, the change record should connect that pixel to its purpose and trigger a configuration review. This is more useful than an inventory that lists only cookie names.

Common questions about international cookie consent

Do small websites need to think about consent?

Yes. A small visitor count does not tell you which technologies are deployed or which legal conditions apply. Determine scope first; avoid assuming either universal exemption or universal coverage.

Can a scanner prove compliance?

A scan can identify observations within its coverage. It cannot determine every legal basis, read all vendor contracts or assess every logged-in journey. Combine findings with configuration review and qualified advice.

Can I use one banner everywhere?

You can share a visual design, but purpose controls, disclosures and signal handling may need regional differences. Make sure visitors can understand the interface in the languages you support.

A useful next step

Choose one important visitor journey and document it from first arrival through a changed preference. Use what you learn to improve the wider setup. Explore TrustCookies for banner customisation and workspace controls; configuration and installation still need review.