Global Privacy Laws & Cookie Consent Guide

ePrivacy governs cookies; GDPR governs personal data.

PECR governs cookies; UK GDPR governs personal data.

Covers 'sharing' for cross-context behavioral advertising.

Targeted advertising and sale require easy opt-out.

Opt-out rights for targeted ads and sale; no mandatory GPC recognition.

Opt-out for targeted ads and sales; GPC recognition required from Jan 2025.

Opt-out for sale and targeted advertising; no GPC requirement.

Opt-out for sale and targeted ads; must honor UOOMs like GPC.

Opt-out rights for targeted advertising, sale, and profiling. Must honor universal opt-out mechanisms (GPC) from January 1, 2026.

Opt-out rights for targeted advertising, sale, and profiling. Must honor universal opt-out mechanisms (GPC) since January 1, 2025.

Opt-out rights for targeted advertising, sale, and profiling. Must honor universal opt-out mechanisms (GPC) since July 31, 2025. Includes a distinctive right to question the result of profiling.

One of the strictest US state laws: strong data minimization, an outright ban on the sale of sensitive data, and opt-out rights for targeted advertising and sale. Must honor universal opt-out mechanisms (GPC).

Opt-out rights for targeted advertising, sale, and profiling. Must honor universal opt-out mechanisms (GPC).

Opt-out rights for targeted advertising, sale, and profiling. No mandatory universal opt-out (GPC) recognition. Provides a unique affirmative defense for maintaining a NIST Privacy Framework program.

Delaware (DPDPA), Nebraska (NDPA), and New Hampshire (NHDPA): opt-out rights for targeted advertising and sale, and each of these states requires honoring universal opt-out mechanisms (GPC).

Iowa (ICDPA), Indiana (INCDPA), Kentucky (KCDPA), Rhode Island (RIDTPPA), and Florida (FDBR): opt-out rights for sale and (in most) targeted advertising. These states do NOT mandate universal opt-out (GPC) recognition.

Sites directed to children under 13 require parental consent.

Healthcare providers and covered entities must not share Protected Health Information via tracking technologies without patient authorization.

Financial institutions must disclose information sharing practices including tracking technologies and provide opt-out mechanisms.

Federal and substantially similar private-sector privacy laws allow opt-out consent for online behavioral advertising where OPC conditions are met; express opt-in remains required for sensitive, unexpected, or higher-risk processing.

Strong consent and transparency requirements.

Transparency and opt-out approach; no specific cookie consent law. Notice and user controls required.

LGPD lawful bases apply to tracking.

Opt-in consent required when cookies identify individuals for analytics or advertising.

Consent required for personalized ads and sensitive data; notice required for cross-border data transfers.

Strict opt-in required before placing cookies that collect personal information.

Hybrid model: some cookies allowed under legitimate interest; profiling/marketing require consent. Opt-out always required.

Notice and opt-out required; moving toward opt-in for explicit consent especially after 2023 reforms.

Consent required for most non-essential data processing including tracking cookies.

Transparency and opt-out approach; emphasis on privacy notices and user controls.

Prior informed consent required for cookies that identify users.

Consent or legitimate interest required; direct marketing requires opt-in consent.

Explicit prior informed consent required for tracking that identifies users.

Opt-in consent required for non-essential cookies that collect personal data. Effective December 13, 2026.

Consent required for most non-essential data processing.

The Dutch Telecommunications Act (Telecommunicatiewet) Art. 11.7a implements the EU ePrivacy Directive. Consent required before placing non-essential cookies. GDPR applies in parallel for personal data processing. Enforced by Autoriteit Persoonsgegevens (Dutch DPA) and ACM.

Cookies fall under DPDPA scope as they collect data 'in relation to' identifiable individuals (Section 2(t)). Affirmative opt-in consent required for non-essential cookies that process personal data.