Global Privacy Laws Compared: Cookie Rules in the EU, UK, US, India and Beyond

A comparison designed for website decisions

A useful comparison separates the legal trigger from the interface. Two countries may both expect transparency while taking different approaches to prior consent, objections or advertising opt-outs. The table below summarises selected questions as reviewed on 1 November 2026; thresholds, exceptions and sector-specific duties need separate assessment.

The practical review suggestions are our synthesis, not a regulator-issued universal checklist.

EU and EEA: device access and personal data are separate layers

Article 5(3) ePrivacy rules address device storage and access; GDPR may also apply to subsequent personal-data processing. The CNIL summary of the EDPB task force reports broad support for refusal options at the same level as acceptance. It also stresses case-by-case assessment of misleading design rather than a universal colour standard.

Source: CNIL summary of the EDPB cookie banner task force report

Implementation question: if a visitor refuses an optional purpose, can your team show which configured tools stay inactive? Document the rule and the observed outcome, rather than treating a banner screenshot as the complete evidence.

UK: reassess exceptions under the updated guidance

The ICO’s final guidance includes communication, strictly necessary, statistical, appearance and emergency-assistance exceptions. Their conditions are purpose-specific. Statistical and appearance uses also require clear information and a simple free way to object. A tool’s analytics label is not enough to establish exemption.

Official source: UK PECR exceptions

Read our UK ICO 2026 guide for the fuller discussion. Keep an internal explanation of why your particular configuration is covered by the rule you selected.

United States: compare states, not just the country

California’s official guidance describes sale/sharing opt-outs for covered businesses, including GPC. Colorado separately requires covered controllers to honour recognised universal opt-out mechanisms for sale and targeted advertising; its regulator identifies GPC and explains privacy-policy disclosure duties.

Official source: California CCPA guidance

Official source: Colorado universal opt-out guidance

Do not use these two states as a complete US legal map. For each market, confirm coverage, exemptions, sensitive-data requirements and the rights that affect your actual processing. Maintain explicit routing for supported signals rather than assuming a consent preference switch handles them automatically.

India: distinguish preparation from commencement

India’s DPDP Act concerns digital personal data, with consent and specified legitimate uses as processing grounds. It does not prescribe a universal cookie-banner layout. The commencement notification schedules major operational provisions for 18 months after November 2025 publication; separate provisions have different dates.

Official source: India DPDP Act 2023

Official source: India commencement notification

Our India DPDP guide provides further context. As a website team, map the information behind identifiers before deciding how each processing activity should be handled.

Canada and Brazil: examine the local framework

Canada’s OPC says express consent is generally needed for sensitive information, unexpected uses or meaningful residual risk of significant harm. Its advertising guidance describes conditions for an opt-out approach; it is not an unconditional exemption for marketing.

Official source: Canada meaningful consent guidance

Official source: Canada advertising guidance

Brazil’s ANPD cookie guide discusses LGPD principles and recommends practices for cookie policies and banners. Use it to inform a purpose-by-purpose local assessment rather than treating every cookie as having the same legal basis.

Official source: Brazil ANPD cookie guide announcement

Turn the comparison into a regional configuration record

Use a short record for every market: legal reviewer, applicability conclusion, purposes, default behaviour, notice language, user controls, signal handling and evidence date. Store the approved configuration version beside the record. That makes a later vendor change easier to assess.

• Keep commercial vendor settings separate from the legal conclusion about their use.
• Define what happens if regional detection is unavailable or inconclusive.
• Review shared scripts that serve more than one purpose.
• Retain a change history so support and engineering can explain differences between deployments.

See the international review workflow to turn this comparison into tasks.

Frequently asked comparison questions

Is GDPR the worldwide cookie law?

No. An EU data-protection analysis is only one part of a multi-market review. Other frameworks may impose different obligations or use different triggers.

Does geo-targeting settle which law applies?

No. It is an implementation input. Business activities, territorial scope and statutory coverage still require assessment.

Which banner should my business choose?

Choose a tool that supports your reviewed configuration and makes updates maintainable. TrustCookies’ product overview explains its controls; no platform choice removes the need to verify your implementation.