Cookie Consent Requirements by Country

European Union

GDPR + ePrivacy Directive

The European Union maintains the strictest cookie consent regime in the world. The ePrivacy Directive requires prior consent before any non-essential cookie or tracking technology is placed on a user's device, while the GDPR defines what valid consent looks like and sets the penalties for getting it wrong.

The Legal Framework

Cookie consent in the EU is governed by two interlocking pieces of legislation. The ePrivacy Directive (2002/58/EC, as amended in 2009) established the rule that storing information on a user's terminal equipment — which includes cookies, local storage, fingerprinting scripts, and tracking pixels — requires the user's prior informed consent, unless the cookie is strictly necessary for the service the user has explicitly requested. The GDPR (Regulation 2016/679), which came into force in May 2018, provides the definition of valid consent and the enforcement mechanisms. Together, these laws create the opt-in consent model that applies across all 27 EU member states.

The European Commission formally withdrew the long-awaited ePrivacy Regulation in February 2025, ending years of legislative uncertainty. This means the existing ePrivacy Directive remains the legal backbone for cookie consent rules in Europe. The withdrawal has had an important practical effect: national Data Protection Authorities are now enforcing the current rules more aggressively and uniformly, with no expectation that the framework is about to change.

What Valid Consent Requires

Under GDPR Article 7 and Recital 32, valid consent for cookies must meet all of the following criteria:

• Freely given — Users must have a genuine and free choice. Consent cannot be a precondition for accessing a service. Cookie walls that block access until a user clicks "Accept" are non-compliant in most EU jurisdictions.
• Specific — Consent must be granular. Users should be able to accept or reject cookies by purpose category (such as analytics, marketing, and preferences) rather than being presented with a single all-or-nothing choice.
• Informed — Before consenting, users must be told what cookies will be set, who sets them, what data is collected, and for what purposes. A vague statement like "we use cookies to improve your experience" is not sufficient.
• Unambiguous — Consent requires a clear affirmative action. Pre-ticked checkboxes, implied consent through continued browsing, and scroll-based consent mechanisms are all invalid under EU law.
• Withdrawable — Users must be able to withdraw consent as easily as they gave it. A "manage preferences" link should be accessible at all times, not just during the initial banner interaction.

Strictly Necessary Exemption

The only cookies exempt from the consent requirement are those that are strictly necessary for the functioning of the service the user has explicitly requested. This narrow exemption covers session identifiers for shopping carts, authentication tokens for logged-in users, load balancing cookies, and security cookies that detect fraud or authentication abuse. It does not cover analytics cookies, preference cookies (such as language selection), or any form of advertising or tracking cookies — all of these require consent.

Enforcement and Penalties

Enforcement is handled by national Data Protection Authorities across the EU's 27 member states. The maximum penalty for GDPR violations is the higher of 20 million euros or 4% of annual global turnover. Cookie-specific fines have escalated dramatically in recent years. France's CNIL has been the most aggressive enforcer: it fined Google 150 million euros in 2021 and then 325 million euros in September 2025 for making cookie rejection harder than acceptance, and it fined SHEIN 150 million euros in September 2025 for placing cookies before consent was obtained and for failing to provide a working "Reject all" button.

The EU Cookie Fatigue Reforms

The European Commission has acknowledged the problem of "cookie fatigue" — the phenomenon where users mindlessly click "Accept" on every banner without reading anything. In response, the Commission has proposed targeted reforms aimed at reducing the administrative burden on businesses and improving user experience while preserving strong data protection. These are not a reopening of the GDPR; the core consent requirements remain intact. The reforms focus on streamlining how consent is collected, potentially allowing browser-level consent signals to satisfy website-level requirements. These proposals are still under development as of early 2026.

United Kingdom

UK GDPR + PECR

After Brexit, the United Kingdom retained the substance of EU data protection law but now operates its own regulatory framework. Cookie consent is governed by the Privacy and Electronic Communications Regulations (PECR), which requires prior consent for non-essential cookies, while the UK GDPR provides the definition of consent and the enforcement powers.

Core Consent Requirements

Under PECR, consent is required before storing or accessing information on a user's terminal equipment via cookies or similar technologies. The requirements largely mirror the EU framework: consent must be freely given, specific, informed, and unambiguous. Pre-ticked checkboxes, implied consent through continued browsing, and preloading tracking technologies before obtaining consent all violate PECR. Users must be able to refuse tracking as easily as they can accept it, and cookie walls that force users to accept tracking in order to access essential services are non-compliant.

The Data (Use and Access) Act 2025

The most significant change to UK cookie law since Brexit is the Data (Use and Access) Act (DUAA), which received Royal Assent on 19 June 2025. The DUAA does not replace existing legislation but introduces important amendments to PECR. The most notable change is the introduction of new exceptions to the consent requirement for certain low-risk cookie uses. Consent is no longer required for cookies used solely for statistical analytics, website appearance or preference settings, security functions, fraud detection and fault prevention, or automatic authentication. However, organizations must still provide users with clear information about these cookies and offer a mechanism to opt out.

This divergence from EU law is significant. Under the EU's ePrivacy Directive, analytics cookies still require prior opt-in consent. Under the amended UK PECR, they no longer do, provided the organization is transparent about their use and offers an opt-out. Organizations subject to both UK and EU law will need to maintain different consent configurations for users in each jurisdiction.

ICO Enforcement

The Information Commissioner's Office is the UK's data protection regulator. Following a year-long review of the country's 1,000 most-visited websites, the ICO reports that more than 95% now meet its cookie compliance standards. In 2025, the ICO issued cookie compliance warnings to 134 UK websites for consent walls and insufficient transparency, imposing strict deadlines for remediation before opening formal investigations.

The DUAA has also dramatically increased the penalty exposure for PECR breaches. The previous cap of 500,000 pounds has been removed and replaced with a maximum of 17.5 million pounds or 4% of worldwide annual turnover, whichever is higher. This aligns PECR penalties with UK GDPR penalties, meaning that cookie violations now carry the same maximum fine as any other data protection breach.

Structural Changes Ahead

The ICO itself is being restructured. The DUAA provides for the replacement of the Information Commissioner's Office with a new "Information Commission" (IC), expected to be in place by 2027. The IC will adopt a corporate governance model with a chief executive and a board, similar to Ofcom. For businesses, the practical implication is that UK cookie enforcement will continue and likely intensify under the new structure, even as certain consent requirements become less strict.

United States

A Patchwork of State Privacy Laws

The United States has no federal cookie law. Instead, a rapidly expanding patchwork of state privacy legislation governs how businesses must handle cookies, consent, and personal data. These laws predominantly follow an opt-out model rather than the opt-in model used in Europe, but they still carry real compliance obligations and growing enforcement activity.

No Federal Cookie Law

As of February 2026, there is no comprehensive federal privacy or cookie law in the United States. Various federal proposals have been introduced over the years, including the American Data Privacy and Protection Act (ADPPA), but none have been enacted. The FTC has sectoral authority over deceptive and unfair business practices, which can include misleading cookie disclosures or privacy policy misrepresentations, but it does not have a general mandate to regulate cookie consent in the way that European DPAs do. Without a federal framework, the regulatory burden falls entirely on individual states.

The Opt-Out Model

US state privacy laws take a fundamentally different approach from European law. Rather than requiring opt-in consent before cookies are set, most state laws allow businesses to use cookies by default but require them to give users the ability to opt out of certain processing activities — specifically the sale of personal data, targeted advertising, and profiling. This means that technically, no US state law requires you to show a cookie consent banner in the European sense. However, if your website uses cookies for targeted advertising, cross-site tracking, or data sales, you must provide transparency about this data collection, offer a clear opt-out mechanism (such as a "Do Not Sell or Share My Personal Information" link), and honor universal opt-out signals like Global Privacy Control (GPC). For sensitive data processing, 16 of the 19 active state laws now require opt-in consent, though each state's definition of "sensitive personal information" differs slightly.

California — CCPA / CPRA

California's Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), remains the most significant state privacy law in the country and the de facto national standard for US privacy compliance. The law applies to for-profit businesses that meet revenue or data volume thresholds and serve California residents. Key cookie-related requirements include providing a conspicuous "Do Not Sell or Share My Personal Information" link on the website, disclosing in the privacy policy what cookies are used and for what purposes, honoring browser-based opt-out signals such as Global Privacy Control automatically, and obtaining opt-in consent before selling the personal information of consumers under 16 years of age. The California Privacy Protection Agency enforces the law, with penalties of up to 2,500 dollars per unintentional violation and 7,500 dollars per intentional violation. Starting August 1, 2026, every registered data broker in California must also connect to a state-operated deletion platform, retrieve consumer deletion requests every 45 days, and process them automatically, with penalties of 200 dollars per request per day for missed deadlines.

Key State Laws Active in 2026

By early 2026, comprehensive privacy laws are active in more than 19 states, with three new laws taking effect on January 1, 2026. The regulatory landscape continues to expand rapidly.

Other states with active comprehensive privacy laws include Utah, Florida, Delaware, Iowa, New Hampshire, Nebraska, New Jersey, Tennessee, and Indiana (effective January 1, 2026). The IAPP's Westin Research Center tracks all proposed and enacted state privacy bills and was last updated in February 2026.

Brazil

LGPD — Lei Geral de Proteção de Dados

Brazil's General Data Protection Law (LGPD), in force since September 2020, establishes a comprehensive data protection framework that applies to cookies collecting personal data. While the LGPD does not contain cookie-specific provisions like the EU's ePrivacy Directive, the national authority (ANPD) has issued guidance making clear that consent is the appropriate legal basis for non-essential cookies.

Cookie Consent Under the LGPD

The LGPD requires a lawful basis for any processing of personal data, and cookies that collect personal data are no exception. In October 2022, the ANPD published its official guidance document, "Cookies and Protection of Personal Data," which clarifies the framework. For non-essential cookies — including analytics, marketing, profiling, and cross-site tracking cookies — the ANPD identifies consent as the appropriate lawful basis. For strictly necessary cookies that are essential for the functioning of the website, the legitimate interest basis may be used.

Under the LGPD, consent must be affirmative, specific, and unambiguous. Organizations must clearly state the identity of the data controller, the specific purposes of processing, details of any data recipients, and notification of any profiling activities. The consent mechanism must be presented in Portuguese (the official language of Brazil), and users must be provided with a free and easily accessible procedure to withdraw consent at any time. Organizations must also maintain adequate records and documentation of consent to demonstrate compliance.

Cookie Banner Requirements

The ANPD encourages a layered information format for cookie consent banners. The first layer should present a concise summary with options to accept, reject, or manage cookies. A "Manage Cookies" button should direct users to a second layer with detailed information about each category of cookies, including their specific purposes, retention periods, and instructions for blocking them. This layered approach is similar to the best practices recommended by European DPAs and reflects the global trend toward transparent, granular consent interfaces.

Key Data Protection Principles for Cookies

• Transparency — Data subjects must be informed clearly, precisely, and in easily accessible language about what data is collected, how it is used, and who receives it.
• Necessity and purpose limitation — Data collection must be relevant and limited to what is necessary for the stated purposes. Setting more cookies than needed for the disclosed purposes violates this principle.
• Storage limitation — Cookie retention periods must be proportionate to the processing purpose. Indefinite cookie lifetimes or excessively long retention periods are non-compliant.
• Data minimization — Only the minimum amount of personal data required for each stated purpose should be collected through cookies.

Enforcement and Penalties

The ANPD is Brazil's federal-level regulator for LGPD matters. Since January 2023, it has been associated with the Ministry of Justice and has full authority to enforce the LGPD and impose penalties. Non-compliance can result in fines of up to 2% of revenue in Brazil, capped at R$50 million (approximately 10 million USD) per violation. The ANPD can also require data processing activities to be halted until compliance is achieved, order deletion of improperly collected data, and issue public warnings.

While the ANPD has not yet taken enforcement action specifically targeting cookie practices, its regulatory agenda for 2025–2026 includes regulation of data subject rights, data protection impact assessments, security measures, and high-risk processing — all of which have direct implications for cookie compliance. Enforcement is also not limited to the ANPD: consumer protection authorities and individual data subjects can bring claims under the LGPD, creating multiple enforcement channels.

Canada

PIPEDA, CASL, and Quebec's Law 25

Canada's cookie consent landscape is defined by a stark split between federal law and Quebec's provincial legislation. Federally, PIPEDA allows implied consent for some cookie use, while Quebec's Law 25 demands explicit opt-in consent on par with the EU's GDPR. The long-anticipated federal reform (Bill C-27) died in Parliament in January 2025, leaving this divided regulatory landscape intact for the foreseeable future.

PIPEDA — The Federal Baseline

The Personal Information Protection and Electronic Documents Act (PIPEDA) has governed federal privacy law in Canada since 2000. Under PIPEDA, consent is required for the collection, use, and disclosure of personal data, but the form of consent can vary based on context. For routine, low-risk data collection where the purpose is obvious and well-explained, implied consent may be sufficient. For sensitive data or unexpected uses, express consent is required.

In practice, this means that websites using cookies for basic analytics and functionality may rely on implied consent under PIPEDA, provided the privacy policy clearly discloses what cookies are used and for what purposes. However, cookies used for targeted advertising, behavioral profiling, or cross-site tracking typically require express consent because these uses go beyond what a reasonable user would expect when visiting a website.

It is also important to note that Canadian regulators classify most cookies as "computer programs" under the Canadian Anti-Spam Law (CASL), which requires user consent before software is installed on a user's device. CASL's penalties are significant — up to 10 million CAD for individuals and 10 million CAD for organizations per violation — and create an additional legal basis for cookie consent obligations at the federal level.

The Death of Bill C-27

Bill C-27, the Digital Charter Implementation Act, was intended to modernize Canada's federal privacy law by introducing the Consumer Privacy Protection Act (CPPA), the Personal Information and Data Protection Tribunal Act (PIDPTA), and the Artificial Intelligence and Data Act (AIDA). Together, these would have replaced PIPEDA, strengthened consent requirements, introduced significant new penalties, and created Canada's first federal AI law.

In January 2025, Prime Minister Trudeau prorogued Parliament, automatically killing all pending bills including C-27. A snap federal election followed in April 2025, and after the election, re-tabling C-27 in its original form was no longer a political priority. As a result, Canada remains operating under PIPEDA — a law written in 2000 — with no federal AI law in place and the Office of the Privacy Commissioner lacking the enforcement powers that C-27 would have provided.

Quebec's Law 25 — The Strictest Standard in Canada

With federal reform stalled, Quebec's Law 25 (an Act to modernize legislative provisions as regards the protection of personal information) stands as the strictest privacy regime in Canada. Fully in force since September 2024, Law 25 requires explicit opt-in consent for all cookies and tracking technologies — making it the only legislation in North America that matches the GDPR's opt-in approach.

Key features of Law 25 include:

• Confidentiality by default — All public-facing systems must have privacy settings configured to the highest level of confidentiality by default, without any action required by the user. No tracking technologies can be activated unless the user expressly consents.
• Explicit opt-in consent — Before deploying any cookie or tracking technology that collects personal information, businesses must obtain the user's explicit and affirmative consent. This is not opt-out; it is a full GDPR-style opt-in requirement.
• Private right of action — Unlike most privacy laws globally, including PIPEDA and the GDPR, Law 25 allows individuals to bring legal action (including class actions) against businesses that breach their rights. Damages start at 1,000 CAD per individual.
• Significant penalties — Fines can reach 25 million CAD or 4% of global revenue, whichever is greater.
• Broad scope — Law 25 protects the personal data of anyone whose data is managed under its jurisdiction, including Quebec residents, Canadians from other provinces, and individuals outside Canada. It even protects the data of deceased individuals for up to 20 years.