Cookie Consent Laws to Watch Before 2027 — The Full Watchlist

If you updated your cookie banner this spring, congratulations: you are compliant with the past.

As of August 2026, several of the year's biggest US and UK dates have already landed — Connecticut's SB 1295 amendments, Virginia's VCDPA tweaks, California DROP processing, and the UK DUAA complaints-procedure requirement. What remains is still unusually busy: Connecticut's October 2026 geolocation-sale ban, India's DPDP consent-manager and full-enforcement cliffs, two brand-new US state privacy laws with 2027 effective dates, and an EU Digital Omnibus proposal that could rewrite cookie rules — but is not law yet.

None of this requires panic. Most of it requires a calendar. This post is that calendar — what is now in force, what is genuinely still coming, what is still just a proposal, and what to prepare for first.

(For what is already in force and enforced today, see do you need to update your cookie banner in 2026; for how we got here, the 2026 changes retrospective; for the opt-in vs opt-out map, where opt-in cookie consent is required.)

Which new cookie consent and privacy laws take effect before 2027?

Already live as of August 2026: Connecticut's SB 1295 CTDPA amendments (July 1), Virginia's VCDPA amendments (July 1), California DROP processing for data brokers (August 1), and the UK DUAA complaints-procedure requirement (June 19). Still ahead on the confirmed pipeline: Connecticut's precise-geolocation sale ban on October 1, 2026; India's DPDP consent-manager phase on November 13, 2026; then on January 1, 2027 Oklahoma's new privacy law, California's ADMT rules, and Vermont's Age-Appropriate Design Code — followed by Alabama in May 2027 and full DPDP enforcement in India that same month. The EU's Digital Omnibus, which would rewrite cookie consent rules entirely, is still a proposal under negotiation.

Here is the watchlist at a glance:

United States: the 2026–2027 pipeline keeps filling

The wave that brought Tennessee, Minnesota, and Maryland online in 2025, then Indiana, Kentucky, and Rhode Island on January 1, 2026, has not crested. Mid-2026 added another cluster of hard dates; the rest of the year and early 2027 keep the calendar full.

Just landed: Connecticut SB 1295, Virginia, and California DROP

Connecticut's SB 1295 amendments took effect July 1, 2026. They matter even if you ignored the CTDPA the first time:

• The applicability threshold dropped from 100,000 to 35,000 consumers — and disappears entirely if you process sensitive data or offer personal data for sale.
• Targeted advertising and data sales involving minors aged 13–17 are flatly prohibited where you know (or wilfully disregard) the user's age. Consent does not cure it.
• Privacy notices must explicitly disclose targeted-advertising processing and sales.
• A separate profiling impact-assessment obligation applies to covered profiling activities created or generated on or after August 1, 2026.

If you run ads or analytics with meaningful Connecticut traffic and have not re-checked coverage under the 35,000 threshold, that is overdue — not optional.

Virginia amendments to the VCDPA, signed in April 2026, also took effect July 1, 2026, tightening rules around specific sensitive data categories.

California's DROP (the Delete Request and Opt-out Platform under the Delete Act): registered data brokers must process consumer deletion requests submitted through DROP as of August 1, 2026 — retrieving requests at least every 45 days. Not a cookie-banner change, but a signal of where US enforcement energy is going — centralized, one-click rights execution.

Next up: Connecticut SB 4 on October 1, 2026

Connecticut is not done. Public Act 26-64 (formerly SB 4, as amended) takes effect October 1, 2026 for most of its privacy amendments, including a ban on selling a consumer's precise geolocation data (defined as identifying location within a 1,750-foot radius). Data-broker registration to sell or license brokered personal data in Connecticut follows on January 1, 2027, with a state deletion mechanism arriving later (DCP must establish it by July 1, 2028).

If your stack collects or monetizes precise location — or you sit near the data-broker definition — put October 1 and January 1 on the same calendar as Oklahoma.

January 1, 2027: three (plus Connecticut brokers) things land at once

• Oklahoma Consumer Data Privacy Act — signed in March 2026, effective January 1, 2027. Another opt-out-model comprehensive law in the Virginia mold.
• California ADMT rules — under the CCPA regulations finalized in September 2025, businesses using automated decision-making technology for significant decisions must comply by January 1, 2027, including notices and opt-outs.
• Vermont's Age-Appropriate Design Code (Act 63) — effective January 1, 2027 for services reasonably likely to be accessed by under-18s: data minimization by default, no targeted nudging, restrictions on push notifications. Similar laws have drawn First Amendment challenges, so watch for litigation — but do not bank on it.
• Connecticut data-broker registration — see SB 4 above.

Later in 2027

• Alabama Personal Data Protection Act — signed April 17, 2026, effective May 1, 2027.
• Kentucky HB 692 — amendments to the KCDPA effective July 1, 2027.

The upshot: the US still is not adopting EU-style opt-in, but the matrix of opt-out rights, minors' protections, geolocation restrictions, and universal opt-out signals keeps expanding. Our US state cookie banner requirements guide covers the per-state mechanics.

United Kingdom: the DUAA's big bang already happened — but it's not finished

The Data (Use and Access) Act's main PECR changes commenced on February 5, 2026: new consent exceptions for low-risk purposes (first-party statistics, appearance preferences, emergency assistance) and PECR fines raised from £500,000 to GDPR levels — up to £17.5 million or 4% of global turnover. The ICO's final Storage and Access Technologies guidance followed on April 29, 2026. The DUAA requirement to operate a formal data-protection complaints procedure commenced on June 19, 2026. All of that is "now," not "next" — see the 2026 banner update guide.

What is still ahead:

• The ICO's review of PECR regulation 6 for online advertising. Alongside the final guidance, the ICO said its work on how storage-and-access rules apply to online advertising continues separately, with further updates to follow. If you are hoping the UK relaxes consent for some advertising use cases, this is the workstream to watch through late 2026.

The ICO also noted that 99% of the UK's top 1,000 websites now meet its cookie banner standards — which tells you how the remaining 1% should expect to be treated.

India: the DPDP countdown is real, with two hard dates

India's DPDP Rules were notified on November 13, 2025 — final, not draft — with an 18-month phased rollout:

• November 13, 2026 (Phase 2): the Consent Manager registration framework becomes operational (Rule 4). Registered Consent Managers must be India-incorporated companies meeting net-worth and interoperability requirements. This is the year to decide whether you will engage a Consent Manager or keep consent records in-house — and to make withdrawal flows actually work.
• May 13, 2027 (Phase 3): the substantive obligations — notice, consent, breach notification, data principal rights, cross-border rules — become fully enforceable, with penalties up to INR 2.5 billion (roughly USD 26 million).

If you have an Indian user base, the rest of 2026 is the build-and-test window before Phase 2. The architecture signal matters even if India is not your market: consent is being treated as auditable, interoperable infrastructure, not a banner you bolt on.

EU: the Digital Omnibus could rewrite cookie consent — but it is not law

The long-stalled ePrivacy Regulation proposal was formally withdrawn in early 2025. Its replacement arrived on November 19, 2025: the Digital Omnibus, which would fold cookie rules out of the ePrivacy Directive and into the GDPR. The headline changes, as proposed:

• Single-click reject with equal prominence to accept.
• A six-month cooling-off period: if a user refuses consent, you cannot re-ask for the same purpose for at least six months.
• A whitelist of consent-exempt low-risk purposes, such as aggregated audience measurement.
• Machine-readable consent signals — browser-level preferences that websites would have to honor.
• GDPR-level fines (up to 4% of global turnover) for violations.

Status as of mid-2026: the AI portion of the omnibus reached a provisional political deal in May 2026, but the data-protection and cookie portion is still working through the Council, with Parliament at an earlier stage. The text may change substantially, and adoption will be followed by a transition period. Realistically, nothing here changes your EU banner before 2027 — quite possibly later.

Supportive: If it passes as proposed, fewer banners for harmless purposes and honest one-click choices are genuinely good news.
Cynical: The EU has been about to fix cookie banners since 2017. Do not architect your 2026 roadmap around a press release.

Until then, the ePrivacy Directive and national enforcement remain fully in force — see our developer's guide to the ePrivacy Directive.

Canada: reform is expected, not scheduled

Canada is the "watch but don't build yet" file:

• Federal: Bill C-27 died when Parliament was dissolved in early 2025. A new private-sector privacy bill — expected to carry over C-27-style penalties of up to CAD 25 million or 5% of global revenue — has been repeatedly signalled for 2026 but had not been tabled as of this writing.
• Alberta: a legislative committee delivered 12 recommendations for amending PIPA in February 2025, including children's-privacy obligations and a penalty-based enforcement regime; amendments are anticipated in 2026.
• Quebec: Law 25 is fully in force — its opt-in consent rules belong on your "now" list, not your watchlist. Our Canada consent banner guide covers it.

How to prioritize: a traffic-based triage

You do not prepare for thirteen deadlines at once. You rank them by your traffic and the cost of being wrong.

Three rules of thumb:

1. Hard dates beat big headlines. Connecticut's October 2026 geolocation ban will affect more real businesses this year than the Digital Omnibus. Enacted law with a date outranks any proposal.
2. Minors' data is the common thread. Connecticut, Vermont, Oregon's under-16 sale ban, India's parental-consent rules — if your audience skews young, this is your biggest 2026–2027 workstream.
3. Don't rebuild for proposals. Monitor the Digital Omnibus and Canada's federal bill quarterly; build when there is final text and a commencement date.

What to actually do this quarter

• Confirm Connecticut SB 1295 coverage under the 35,000-consumer / sensitive-data / sale triggers — and close any gap.
• Inventory precise geolocation collection and sale/share paths ahead of Connecticut's October 1, 2026 ban.
• Audit whether you serve targeted ads to known or likely 13–17-year-olds in the US.
• Put November 13, 2026 (India Phase 2) on the compliance calendar with a named owner.
• If you profile for significant decisions, scope California ADMT notice and opt-out work for January 1, 2027.
• Confirm your CMP can add a new regional ruleset (Oklahoma, Alabama, Connecticut broker mode) as configuration, not code.
• Set a quarterly check on the Digital Omnibus, the ICO's PECR reg 6 advertising work, and Canada's federal bill — and resist doing more than that.

Where CookieChimp fits

The pattern across every jurisdiction above is the same: rules keep changing, and the teams that cope are the ones whose consent setup is configuration, not hardcoded UI. CookieChimp is built for exactly that — geo-targeted banners that apply the right ruleset per region, automatic cookie scanning so new tags don't outrun your policy, consent logs that prove what each user saw and chose, and built-in Google Consent Mode v2 and Global Privacy Control support as US states keep adding signal requirements. When Oklahoma's effective date arrives, it should be a settings change, not a sprint. And if you're wondering whether one banner can stretch across all of this: can one cookie banner cover every country?

FAQ

References

1. MultiState, "20 State Privacy Laws in Effect in 2026: Key Dates & Changes": multistate.us
2. Wiley, "Major Changes to Connecticut's Consumer Privacy Law Will Take Effect July 1, 2026": wiley.law
3. Foley & Lardner, "Connecticut Dramatically Expands Its Data Privacy Act" (Jul 2026): foley.com
4. Proskauer, "From Data Brokers to DNA: Connecticut Enacts Sweeping Privacy Amendments" (SB 4 / PA 26-64): privacylaw.proskauer.com
5. Moore & Van Allen (JD Supra), "Privacy in Bloom: Four States Reshape the Data Protection Landscape This Spring": jdsupra.com
6. California Privacy Protection Agency, "California Finalizes Regulations to Strengthen Consumers' Privacy": cppa.ca.gov
7. CalPrivacy, "DROP for data brokers": privacy.ca.gov
8. Vermont General Assembly, "Bill Status S.69 (Act 63) — Age-Appropriate Design Code": legislature.vermont.gov
9. ICO, "Statement on the commencement of the Data (Use and Access) Act (DUAA)" (5 Feb 2026): ico.org.uk
10. ICO, "Final storage and access technologies guidance published" (29 Apr 2026): ico.org.uk
11. European Commission, "Digital Package — FAQs" (Digital Omnibus proposal): digital-strategy.ec.europa.eu
12. Press Information Bureau (India), "DPDP Rules, 2025 Notified" (Nov 2025; Rules gazette-dated 13 Nov 2025): pib.gov.in
13. India Briefing, "India's DPDP Timeline: Critical Compliance Deadlines for 2026-27": india-briefing.com
14. IAPP, "What 2026 may bring for Canada's privacy reform efforts": iapp.org

The laws will keep coming; your banner rebuild doesn't have to. Get started with CookieChimp and turn the next effective date into a configuration change.