Privacy Laws Around the World: How Cookie Requirements Differ by Country

Why do some sites show a cookie banner and others don't? Because cookie rules vary a lot by country. This is a general overview, not legal advice. If you run a site, check the rules for where your visitors are, or ask a privacy lawyer.

European Union: consent first

The ePrivacy Directive requires consent before storing non-essential cookies on someone's device, and the GDPR sets what valid consent looks like: freely given, specific, informed, and as easy to refuse as to give. Strictly necessary cookies, like a shopping cart or login, don't need consent. This is why EU sites show banners with accept and reject options.

United Kingdom: similar, with some changes

The UK has its own versions of these rules, PECR and the UK GDPR, which also require consent for most non-essential cookies. The UK has been moving to relax consent rules for some low-risk uses, such as certain analytics, so check the current guidance from the Information Commissioner's Office.

United States: opt-out, state by state

There's no general federal cookie consent law. Instead, state privacy laws, led by California's CCPA as amended by the CPRA, give people the right to opt out of the "sale" or "sharing" of their personal information, including through advertising cookies. Several states require sites to honor Global Privacy Control, a browser signal that says "don't sell or share my data". That's why many US sites show a "Do not sell or share my personal information" link rather than a consent banner.

Other countries

• Canada: PIPEDA requires meaningful consent, but implied consent can be acceptable for less sensitive uses. Quebec's Law 25 is stricter.
• Brazil: the LGPD is similar in spirit to the GDPR.
• India: the Digital Personal Data Protection Act 2023 introduces consent-based rules as it's phased in.
• Many others, including Switzerland, South Africa, Japan, and Australia, have their own data protection laws with varying cookie expectations.

What this means in practice

Many sites show one banner to everyone, set up for the strictest rules. If you run a site, the free cookie policy generator and privacy policy generator give you a starting draft. As a visitor, Cookie Auto-Reject answers the banners for you.