Global Privacy Laws & Cookie Consent Guide

ePrivacy governs cookies; GDPR governs personal data.

PECR governs cookies; UK GDPR governs personal data.

Covers 'sharing' for cross-context behavioral advertising.

Targeted advertising and sale require easy opt-out.

Opt-out rights for targeted ads and sale; no mandatory GPC recognition.

Opt-out for targeted ads and sales; GPC recognition required from Jan 2025.

Opt-out for sale and targeted advertising; no GPC requirement.

Opt-out for sale and targeted ads; must honor UOOMs like GPC.

Emerging state laws (2024-2025) with opt-out rights for targeted ads and sales. Requirements vary by state.

Sites directed to children under 13 require parental consent.

Healthcare providers and covered entities must not share Protected Health Information via tracking technologies without patient authorization.

Financial institutions must disclose information sharing practices including tracking technologies and provide opt-out mechanisms.

Opt-in consent required for non-obvious purposes like third-party behavioral advertising.

Strong consent and transparency requirements.

Transparency and opt-out approach; no specific cookie consent law. Notice and user controls required.

LGPD lawful bases apply to tracking.

Opt-in consent required when cookies identify individuals for analytics or advertising.

Consent required for personalized ads and sensitive data; notice required for cross-border data transfers.

Strict opt-in required before placing cookies that collect personal information.

Hybrid model: some cookies allowed under legitimate interest; profiling/marketing require consent. Opt-out always required.

Notice and opt-out required; moving toward opt-in for explicit consent especially after 2023 reforms.

Consent required for most non-essential data processing including tracking cookies.

Transparency and opt-out approach; emphasis on privacy notices and user controls.

Prior informed consent required for cookies that identify users.

Consent or legitimate interest required; direct marketing requires opt-in consent.

Explicit prior informed consent required for tracking that identifies users.

Consent required for most non-essential data processing.