Cookie banner requirements by country: a practical matrix

There are two families of cookie rules. In the EU and EEA, the UK, Brazil, Türkiye and Quebec, non-essential cookies need an opt-in: nothing runs until the visitor clicks, and refusing must be as easy as accepting. In the US states, Switzerland, federal Canada and Japan, the model is notice and opt-out: you may set most cookies, but you must say so clearly and give a way to refuse, and in twelve US states you must honor the Global Privacy Control signal. If your audience spans both families, the practical answer is a banner that changes behavior by region.

This page is an operational summary, not legal advice. Each row links to the detailed law page with its sources.

What does the banner have to do in each region?

Why is Europe opt-in?

Article 5(3) of the ePrivacy Directive requires consent before storing or reading information on a device, except for what is strictly necessary for a service the visitor asked for. The GDPR defines the quality of that consent: freely given, specific, informed, unambiguous, and as easy to withdraw as to give, with the burden of proof on the website. The Court of Justice ruled in Planet49 (2019) that a pre-ticked box is not consent. The EDPB cookie banner taskforce agreed in 2023 that a first layer without a reject option, or with a reject option hidden behind a link, is a problem for most authorities. Each country enforces through its own authority and sometimes its own text, which is why the country pages matter: see France, where the CNIL publishes the most detailed guidance, and Germany, where the rule sits in section 25 of the TDDDG.

What changed in the UK?

Regulation 6 of PECR still requires opt-in consent. Since 5 February 2026, the Data (Use and Access) Act 2025 adds two narrow exceptions: first-party statistics used to improve your own service, and cookies that remember appearance choices, provided visitors are told and can object for free. Advertising, cross-site tracking and social pixels still need consent, and PECR fines can now reach the UK GDPR scale. The ICO tested the top 1,000 UK websites against a simple rule: rejecting must be as easy as accepting.

Is Switzerland really opt-out?

Mostly. Article 45c of the Telecommunications Act requires websites to inform visitors about processing on their device, the purpose, and their right to refuse. The Swiss FADP requires express consent only for sensitive data and high-risk profiling. The FDPIC's 2025 cookie guidelines describe an opt-out model with a prominent Reject option as the baseline and opt-in for intrusive tracking. Many Swiss sites simply show the EU banner, which satisfies both.

What do US states require?

No US state requires consent before cookies. The CCPA/CPRA in California and the other state laws give visitors the right to opt out of the sale or sharing of their data and of targeted advertising, which is what ad pixels feed. In practice that means a "Do Not Sell or Share My Personal Information" or "Your privacy choices" link, an opt-out that actually stops the advertising tags, opt-in for sensitive data, and recognition of Global Privacy Control where the state requires it: California, Colorado, Connecticut, Texas, Oregon, Montana, Delaware, New Jersey, New Hampshire, Nebraska, Minnesota and Maryland.

Canada and Quebec: why two rows?

Federal law, PIPEDA, asks for meaningful consent whose form depends on sensitivity. The Privacy Commissioner accepts opt-out consent for online behavioral advertising if visitors are clearly told, can opt out immediately and persistently, and no sensitive data or children are involved. Quebec's Law 25 goes further: technology that can identify, locate or profile a person must be off by default, so advertising cookies and profiling analytics need an opt-in for Quebec visitors.

Brazil and Türkiye

Brazil's LGPD needs a legal basis for every cookie, and the ANPD's cookie guide says consent is the right basis for advertising and most non-necessary cookies. Its model banner shows Accept and Reject side by side with nothing pre-selected. Türkiye's KVKK guideline requires explicit consent through an active click for non-essential cookies and recommends Accept, Reject and Preferences buttons of equal size and color.

What about the rest of the world?

• Japan. Since 16 June 2023, the Telecommunications Business Act's external transmission rule requires website operators that make a visitor's browser send data to third parties (analytics, ad tags) to do one of three things: notify or publish what is sent, to whom and why; obtain consent; or offer an opt-out. Most sites publish a notice page. See Japan.
• South Africa. POPIA treats online identifiers as personal information, so tracking cookies need consent or a legitimate interest that survives the balancing test.
• Australia. The Privacy Act has no cookie consent rule; notice and a privacy policy apply when the data identifies a person, and most businesses under A$3 million turnover are exempt.
• South Korea, India and others. Laws are evolving quickly; check the country pages such as South Korea before you decide to show nothing.

How do you build one banner for all of this?

Three settings cover most sites. Show the full opt-in banner in the EEA, the UK, Switzerland, Brazil, Türkiye, Canada and South Africa. Show an opt-out notice with a "Do not sell or share" link to visitors in US states with a privacy law, and honor GPC. Show nothing, or the opt-out notice, elsewhere. If you cannot detect the region reliably, show the opt-in banner everywhere: it satisfies every row of the table.

Cookiequiet does this with geo-targeting on every plan, including the free plan for one website: the banner can be shown only in regulated countries, with an opt-out notice for US state visitors and GPC honored as an opt-out. Setup is one script tag placed before your other scripts, with Reject all on by default and Consent Mode v2 switched on in the snippet the dashboard gives you, and takes about five minutes from sign-up to a live banner. Starter is €3 per website per month or €29 a year, with no pageview limit; pricing has the details.