Blog

Cookie laws by country: opt-in, opt-out and maximum fines in 2026

A world table of cookie consent rules in 2026: the law, opt-in or opt-out, the authority and the maximum fine in 36 jurisdictions, checked on official sources.

Published 21 October 2026 · By the Cookiequiet team · Markdown

Prior opt-in consent for non-essential cookies is the rule in the EU and EEA, the UK, Türkiye and Nigeria, and for tracking functions in Quebec. The United States uses an opt-out model in California and the other states with a privacy law, Switzerland requires information and a right to refuse, and most of Asia-Pacific, Latin America and the Middle East have no cookie-specific rule but treat cookie data as personal data, with consent as the main or one of several legal bases. Maximum fines range from NZ$10,000 in New Zealand to 4% of worldwide turnover under the GDPR, 5% in China and 10% of total revenue in South Korea for aggravated cases.

How to read the table

Opt-in: non-essential cookies may only be set after the visitor agrees; strictly necessary cookies are exempt.
Opt-out: cookies may be set, but visitors must be told and able to refuse, at least for advertising.
Consent as one basis: no cookie-specific rule; the data protection law applies to cookie data, and consent is one legal basis among others (contract, legitimate interest and so on).
Notice: the law asks for information, not consent.

Facts were checked on 21 October 2026 on the law's official text or the authority's site, listed in the sources. Fines are statutory maximums, not typical amounts.

Europe

Jurisdiction	Law	Model	Authority	Maximum fine
EU and EEA	ePrivacy Directive art. 5(3), GDPR	Opt-in	National authorities, coordinated by the EDPB	€20M or 4% of worldwide turnover (GDPR)
France	Art. 82, Loi Informatique et Libertés	Opt-in	CNIL	€10M or 2% of worldwide turnover (art. 20)
Germany	TDDDG § 25	Opt-in	State data protection authorities	€300,000 for a § 25 breach
Italy	Privacy Code art. 122; Garante guidelines of 10 June 2021	Opt-in; scrolling is never consent	Garante	€20M or 4% of worldwide turnover
Spain	LSSI art. 22.2	Opt-in	AEPD	€30,000 per minor offence
Netherlands	Telecommunicatiewet art. 11.7a	Opt-in; low-impact analytics exempt	ACM	€900,000 or 1% of turnover
United Kingdom	PECR reg. 6, UK GDPR	Opt-in; opt-out for statistics and appearance exceptions since 5 February 2026	ICO	£17.5M or 4% of worldwide turnover
Switzerland	Telecommunications Act art. 45c, FADP	Information and right to refuse (opt-out)	FDPIC	CHF 250,000, a criminal fine on the responsible individual
Türkiye	KVKK; Cookie guideline, July 2025	Opt-in for non-essential cookies	Personal Data Protection Authority	TRY 17,092,242 (2026 ceiling)

The Americas

Jurisdiction	Law	Model	Authority	Maximum fine
United States, federal	No federal cookie consent rule	None	None for cookies	None
California	CCPA as amended by the CPRA	Opt-out of sale and sharing; Global Privacy Control honoured	CPPA and Attorney General	$2,663 per violation, $7,988 if intentional
Other US states	18 state laws, including Virginia, Colorado and Texas	Opt-out of targeted advertising	State attorneys general	Generally $7,500 per violation; Colorado $20,000
Canada	PIPEDA	Meaningful consent, express or implied; opt-out accepted for non-sensitive behavioural ads	OPC	C$100,000 per offence
Quebec	Law 25	Opt-in for tracking functions (s. 8.1)	CAI	C$10M or 2% of worldwide turnover (administrative); C$25M or 4% (penal)
Brazil	LGPD; ANPD cookie guide of 2022	Consent as one of ten bases	ANPD	2% of Brazilian revenue, capped at R$50M per infraction
Mexico	LFPDPPP of 20 March 2025	Tacit consent after a privacy notice (opt-out)	Secretaría Anticorrupción y Buen Gobierno	320,000 times the UMA, up to double for sensitive data
Argentina	Law 25,326	Free, express and informed consent as the general rule	AAIP	ARS 100,000 per infraction (art. 31)
Chile	Law 21,719, in force 1 December 2026	Prior consent, one basis among several	Agencia de Protección de Datos Personales	20,000 UTM; 4% of annual revenue for repeated very serious breaches
Colombia	Law 1581 of 2012	Prior, informed authorisation (opt-in)	SIC	2,000 monthly minimum wages

Asia-Pacific

Jurisdiction	Law	Model	Authority	Maximum fine
Japan	APPI; Telecommunications Business Act art. 27-12 (since 16 June 2023)	Notice, consent or opt-out for sending user data to third parties	PPC; Ministry of Internal Affairs and Communications	¥100M for a corporation (APPI art. 184)
South Korea	PIPA	Auto-collection disclosed in the privacy policy; consent one of seven bases	PIPC	3% of total revenue; 10% for aggravated cases since 11 September 2026
China	PIPL	Consent as the main basis in a closed list, no legitimate interest	CAC	RMB 50M or 5% of the previous year's turnover
India	DPDP Act 2023 and Rules 2025; main duties apply 18 months after 13 November 2025	Consent or listed legitimate uses	Data Protection Board of India	₹250 crore
Singapore	PDPA 2012; PDPC guidelines	Consent; none needed for cookies that collect no personal data	PDPC	10% of Singapore turnover above S$10M, otherwise S$1M
Thailand	PDPA 2019, fully in force 1 June 2022	Consent before collection, with six exceptions	PDPC	THB 5M (administrative)
Vietnam	Law 91/2025/QH15, in force 1 January 2026	Consent, silence is not consent; social networks must let users refuse cookies	Ministry of Public Security	VND 3 billion; 5% of revenue for transfer breaches; 10 times the revenue from selling data
Indonesia	Law 27 of 2022, compliance due 17 October 2024	Explicit consent, one of six bases	Agency not yet established	2% of annual revenue
Philippines	Data Privacy Act of 2012	Consent, one of several criteria	NPC	PHP 5M criminal fine (s. 33)
Australia	Privacy Act 1988	Notice (APP 5); no cookie consent rule	OAIC	Greater of A$50M, 3 times the benefit, or 30% of adjusted turnover
New Zealand	Privacy Act 2020	Notice (IPP 3), not consent	Privacy Commissioner	NZ$10,000 for offences

Africa and the Middle East

Jurisdiction	Law	Model	Authority	Maximum fine
South Africa	POPIA	Consent as one lawful ground	Information Regulator	R10M
Nigeria	NDPA 2023; NDPC GAID 2025 art. 19	Opt-in for non-necessary cookies	NDPC	Greater of NGN 10M or 2% of annual gross revenue for controllers of major importance
Kenya	Data Protection Act 2019	Consent as one basis	ODPC	KES 5M or 1% of turnover, whichever is lower
Israel	Protection of Privacy Law 1981, Amendment 13	Informed consent, explicit or implied	Privacy Protection Authority	Set per violation, for example NIS 2 to 8 per data subject; no single cap
UAE	Federal Decree-Law No. 45 of 2021	Consent first, with listed exceptions	UAE Data Office	Not yet set by Cabinet decision; ADGM free zone up to $28M
Saudi Arabia	PDPL, Royal Decree M/19, amended by M/148	Consent by default; exceptions include legitimate interest	Competent authority; text published by SDAIA	SAR 5M, doubled for a repeat
Egypt	Law 151 of 2020; Executive Regulation (Decree 816 of 2025)	Explicit consent unless the law authorizes processing	Personal Data Protection Center	EGP 5M and imprisonment for sensitive data and transfer offenses; EGP 1M for processing without consent

What does this mean for one website with visitors everywhere?

Three practical rules cover most of the table. Use an opt-in banner with Reject all wherever an opt-in rule applies: the EEA, the UK, Türkiye, Nigeria, and for tracking in Quebec. Show an opt-out notice with a "Do not sell or share" link to visitors in California and the other US states with a privacy law, and honour Global Privacy Control. Elsewhere, give clear notice in a privacy policy and ask for consent where the local law makes consent the basis, which an opt-in banner also satisfies.

Geo-targeting does this automatically. Cookiequiet includes it on every plan, Free included: show the banner everywhere, only in regulated countries, or in a custom list, with an opt-out notice in US states. Country-by-country banner settings are in cookie banner requirements by country.

Questions

The EU and EEA countries, the United Kingdom, Türkiye and Nigeria require consent before non-essential cookies, and Quebec requires it for tracking functions. Colombia requires prior authorisation for personal data generally. Switzerland, California and the other US states with privacy laws use an opt-out model.

No federal rule requires cookie consent. California and 18 other states have privacy laws that give an opt-out of the sale or sharing of personal data and of targeted advertising, which covers advertising cookies and pixels.

In proportion to turnover, South Korea allows up to 10% of total revenue for aggravated cases since 11 September 2026, China up to 5% of the previous year's turnover, and the GDPR up to 4% of worldwide turnover. Australia allows up to 30% of adjusted turnover for serious interferences.

An opt-in banner with Reject all meets the stricter rules, so it is lawful almost everywhere, but it lowers consent rates where the law does not require it and does not replace the Do not sell or share link that US state laws expect.

Sources

Cookie banner fines in 2026: who was fined, how much and whyCookie fines keep coming: Google €325 million, Shein €150 million, American Express €1.5 million, and dozens of smaller CNIL sanctions. The reasons repeat.The Do Not Sell or Share link: what California requiresIf you sell or share Californians' data, including through ad trackers, you need a Do Not Sell or Share link and must honor GPC. Sephora paid $1.2 million.The CNIL cookie guidelines explained: what France expects from your bannerThe CNIL's 2020 guidelines set rules much of Europe follows: no consent by scrolling, Reject all as easy as Accept all, proof of consent. Rules and fines.Is a free cookie banner enough? When it is and when it is notA free cookie banner is legally enough if it blocks, offers Reject all and records consent. Where free plans fall short: traffic caps, short logs, no TCF.

Back to Blog

Put a quiet banner on your website today

Free for one website with every core feature, no card and no trial clock. Upgrade a website to Starter for $3 a month to match your brand with AI and drop the branding, or to Pro for $9 to design it with the AI agent.

Start free, no card See pricing