How Cookie Consent Requirements Differ for US vs EU Visitors

Visit the same website from Paris and from Chicago and you may see completely different cookie banners, or none at all in the US. That's because the rules are built on opposite ideas: the EU requires permission first, while US laws mostly give you the right to say no afterwards.

The EU and UK: opt-in

• Under the EU's ePrivacy rules and GDPR, sites need your consent before setting non-essential cookies, such as for advertising and most analytics.
• Consent must be freely given, specific and as easy to refuse as to give. Pre-ticked boxes don't count.
• Regulators enforce this. In January 2022, France's privacy regulator, the CNIL, fined Google and Facebook for making it harder to refuse cookies than to accept them.
• The UK has similar rules under its own data protection and electronic communications laws.

Cookies needed for the site to work, such as a shopping cart or login, don't need consent.

The US: mostly opt-out

• There's no federal cookie law. Sites can usually set cookies without asking first.
• State privacy laws, led by California, give residents the right to opt out of their data being sold or shared for advertising. Sites covered by these laws show a link such as "Do Not Sell or Share My Personal Information" or "Your Privacy Choices".
• California and several other states require sites to honor Global Privacy Control, a browser signal that opts you out automatically.
• More states pass privacy laws each year, so requirements keep growing.

Why sites show different banners

Many sites detect your location and show the strictest banner only where it's required: a full consent banner in Europe, an opt-out link or a simple notice in the US. Some sites show the EU-style banner to everyone because it's simpler to run one system.

What it means for you

• In the EU or UK: clicking "Reject all" should stop non-essential cookies. Cookie Auto-Reject clicks reject for you on common consent banners.
• In the US: where a banner offers reject, use it. Turn on a browser or extension that sends Global Privacy Control, and use the opt-out links on sites you visit often.
• Everywhere: block third-party cookies in your browser. It works regardless of banners or laws.

For other countries, see cookie rules around the world, and for banner tricks, see dark patterns in cookie consent.