# Cookie banner requirements by country: a practical matrix

> What a cookie banner must do in the EU, UK, Switzerland, US states, Canada, Quebec, Brazil, Türkiye, Japan and more: opt-in or opt-out, Reject button, GPC.

Source: https://cookiequiet.com/guides/cookie-banner-requirements-by-country
Published: 2026-10-21
Publisher: Cookiequiet

## Steps

1. **List where your visitors come from** Check your analytics or server logs for the countries and US states that send traffic, and note which rows of the matrix apply.
2. **Set the opt-in regions** Show the full banner with Accept and Reject on the first layer, and nothing non-essential before the choice, in the EEA, the UK, Brazil, Türkiye, Quebec and other opt-in regions.
3. **Set the opt-out regions** For US states with a privacy law, show a notice with a Do Not Sell or Share link and make sure the opt-out stops advertising tags.
4. **Honor Global Privacy Control** Treat the browser signal as an opt-out of sale, sharing and targeted advertising for US visitors, at least in the states that require it.
5. **Decide the default for everyone else** Choose between no banner, the opt-out notice, or the opt-in banner everywhere when location is unknown or uncertain.
6. **Test from each region** Use a VPN or a browser location override to load the site from each region and confirm the right banner and the right tag behavior.

There are two families of cookie rules. In the EU and EEA, the UK, Brazil, Türkiye and Quebec, non-essential cookies need an opt-in: nothing runs until the visitor clicks, and refusing must be as easy as accepting. In the US states, Switzerland, federal Canada and Japan, the model is notice and opt-out: you may set most cookies, but you must say so clearly and give a way to refuse, and in twelve US states you must honor the Global Privacy Control signal. If your audience spans both families, the practical answer is a banner that changes behavior by region.

This page is an operational summary, not legal advice. Each row links to the detailed law page with its sources.

## What does the banner have to do in each region?

| Region | Before the choice | First layer | Also required |
|---|---|---|---|
| EU and EEA | Nothing non-essential | Accept and Reject with equal ease, purposes, link to details | Proof of consent, easy withdrawal |
| United Kingdom | Nothing non-essential, except first-party statistics and appearance settings with a right to object | Accept and Reject with equal ease | Proof of consent |
| Switzerland | Cookies may run | Information and a visible way to refuse | Opt-in for intrusive tracking |
| US states with a privacy law | Cookies may run | No banner required; an opt-out link | Honor Global Privacy Control in twelve states |
| Canada (federal) | Depends on sensitivity | Clear notice and an immediate opt-out for behavioral ads | Express consent for sensitive data |
| Quebec | Tracking that identifies, locates or profiles is off | Explain how to switch it on | Privacy by default |
| Brazil | Nothing non-essential | Accept and Reject side by side | No cookie wall |
| Türkiye | Nothing non-essential | Accept, Reject and Preferences of equal size and color | No consent by browsing |
| Japan | Cookies may run | Notice or publication of what is sent to whom | Or consent, or an opt-out |

## Why is Europe opt-in?

Article 5(3) of the [ePrivacy Directive](/laws/eprivacy-directive) requires consent before storing or reading information on a device, except for what is strictly necessary for a service the visitor asked for. The [GDPR](/laws/gdpr) defines the quality of that consent: freely given, specific, informed, unambiguous, and as easy to withdraw as to give, with the burden of proof on the website. The Court of Justice ruled in Planet49 (2019) that a pre-ticked box is not consent. The EDPB cookie banner taskforce agreed in 2023 that a first layer without a reject option, or with a reject option hidden behind a link, is a problem for most authorities. Each country enforces through its own authority and sometimes its own text, which is why the country pages matter: see [France](/laws/france), where the CNIL publishes the most detailed guidance, and [Germany](/laws/germany), where the rule sits in section 25 of the TDDDG.

## What changed in the UK?

Regulation 6 of [PECR](/laws/uk-gdpr-pecr) still requires opt-in consent. Since 5 February 2026, the Data (Use and Access) Act 2025 adds two narrow exceptions: first-party statistics used to improve your own service, and cookies that remember appearance choices, provided visitors are told and can object for free. Advertising, cross-site tracking and social pixels still need consent, and PECR fines can now reach the UK GDPR scale. The ICO tested the top 1,000 UK websites against a simple rule: rejecting must be as easy as accepting.

## Is Switzerland really opt-out?

Mostly. Article 45c of the Telecommunications Act requires websites to inform visitors about processing on their device, the purpose, and their right to refuse. The [Swiss FADP](/laws/swiss-fadp) requires express consent only for sensitive data and high-risk profiling. The FDPIC's 2025 cookie guidelines describe an opt-out model with a prominent Reject option as the baseline and opt-in for intrusive tracking. Many Swiss sites simply show the EU banner, which satisfies both.

## What do US states require?

No US state requires consent before cookies. The [CCPA/CPRA](/laws/ccpa-cpra) in California and the [other state laws](/laws/us-state-privacy-laws) give visitors the right to opt out of the sale or sharing of their data and of targeted advertising, which is what ad pixels feed. In practice that means a "Do Not Sell or Share My Personal Information" or "Your privacy choices" link, an opt-out that actually stops the advertising tags, opt-in for sensitive data, and recognition of [Global Privacy Control](/guides/global-privacy-control) where the state requires it: California, Colorado, Connecticut, Texas, Oregon, Montana, Delaware, New Jersey, New Hampshire, Nebraska, Minnesota and Maryland.

## Canada and Quebec: why two rows?

Federal law, [PIPEDA](/laws/pipeda), asks for meaningful consent whose form depends on sensitivity. The Privacy Commissioner accepts opt-out consent for online behavioral advertising if visitors are clearly told, can opt out immediately and persistently, and no sensitive data or children are involved. [Quebec's Law 25](/laws/quebec-law-25) goes further: technology that can identify, locate or profile a person must be off by default, so advertising cookies and profiling analytics need an opt-in for Quebec visitors.

## Brazil and Türkiye

Brazil's [LGPD](/laws/lgpd) needs a legal basis for every cookie, and the ANPD's cookie guide says consent is the right basis for advertising and most non-necessary cookies. Its model banner shows Accept and Reject side by side with nothing pre-selected. Türkiye's [KVKK](/laws/kvkk) guideline requires explicit consent through an active click for non-essential cookies and recommends Accept, Reject and Preferences buttons of equal size and color.

## What about the rest of the world?

- **Japan.** Since 16 June 2023, the Telecommunications Business Act's external transmission rule requires website operators that make a visitor's browser send data to third parties (analytics, ad tags) to do one of three things: notify or publish what is sent, to whom and why; obtain consent; or offer an opt-out. Most sites publish a notice page. See [Japan](/laws/japan).
- **South Africa.** [POPIA](/laws/popia) treats online identifiers as personal information, so tracking cookies need consent or a legitimate interest that survives the balancing test.
- **Australia.** The [Privacy Act](/laws/australia-privacy-act) has no cookie consent rule; notice and a privacy policy apply when the data identifies a person, and most businesses under A$3 million turnover are exempt.
- **South Korea, India and others.** Laws are evolving quickly; check the country pages such as [South Korea](/laws/south-korea) before you decide to show nothing.

## How do you build one banner for all of this?

Three settings cover most sites. Show the full opt-in banner in the EEA, the UK, Switzerland, Brazil, Türkiye, Canada and South Africa. Show an opt-out notice with a "Do not sell or share" link to visitors in US states with a privacy law, and honor GPC. Show nothing, or the opt-out notice, elsewhere. If you cannot detect the region reliably, show the opt-in banner everywhere: it satisfies every row of the table.

Cookiequiet does this with geo-targeting on every plan, including the free plan for one website: the banner can be shown only in regulated countries, with an opt-out notice for US state visitors and GPC honored as an opt-out. Setup is one script tag placed before your other scripts, with Reject all on by default and Consent Mode v2 switched on in the snippet the dashboard gives you, and takes about five minutes from sign-up to a live banner. Starter is €3 per website per month or €29 a year, with no pageview limit; [pricing](/pricing) has the details.

## Questions

### Can I show the EU banner to everyone?

Yes. An opt-in banner with an equal Reject button meets the requirements of every region in the table, because opt-out regimes do not forbid asking first. The cost is a lower consent rate outside Europe, which is why many sites use geo-targeting.

### Do US visitors need a cookie banner?

Not under any current state law. They need a privacy notice, a visible way to opt out of the sale or sharing of their data and of targeted advertising, and recognition of Global Privacy Control in the states that require it.

### Does the GDPR apply to a website outside the EU?

It can. The GDPR applies to organizations outside the EU that offer goods or services to people in the EU or monitor their behavior there, and tracking cookies are a form of monitoring. The ePrivacy rules apply to cookies placed on devices in the EU.

### Is Switzerland treated like the EU?

Not exactly. Swiss law requires information and a way to refuse rather than prior consent for most cookies, with opt-in for sensitive data and intrusive tracking. Showing the EU banner to Swiss visitors is the simple way to meet both.

## Sources

- [Directive 2002/58/EC (ePrivacy Directive), article 5(3)](https://eur-lex.europa.eu/eli/dir/2002/58/oj)
- [Regulation (EU) 2016/679 (GDPR), articles 3, 4(11) and 7](https://eur-lex.europa.eu/eli/reg/2016/679/oj)
- [Court of Justice of the EU, Planet49 (C-673/17), press release of 1 October 2019 (PDF)](https://curia.europa.eu/jcms/upload/docs/application/pdf/2019-10/cp190125en.pdf)
- [EDPB, Report of the work undertaken by the Cookie Banner Taskforce (PDF)](https://www.edpb.europa.eu/system/files/2023-01/edpb_20230118_report_cookie_banner_taskforce_en.pdf)
- [ICO, Guidance on the use of storage and access technologies: what are the exceptions?](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guidance-on-the-use-of-storage-and-access-technologies/what-are-the-exceptions/)
- [Swiss Telecommunications Act (FMG), article 45c](https://www.fedlex.admin.ch/eli/cc/1997/2187_2187_2187/en)
- [FDPIC, Guidelines on data processing using cookies and similar technologies, version 1.1 of 6 October 2025 (PDF)](https://www.edoeb.admin.ch/dam/en/sd-web/brLL9rM3ny9d/Leitfaden%20des%20ED%C3%96B%20betreffend%20Datenbearbeitungen%20mittels%20Cookies%20und%20%C3%A4hnlichen%20Technologien%20V.%201.1%20vom%2006.10.2025_EN.pdf)
- [Colorado Attorney General, Universal Opt-Out and the Colorado Privacy Act](https://coag.gov/opt-out/)
- [Office of the Privacy Commissioner of Canada, Guidelines on privacy and online behavioural advertising](https://www.priv.gc.ca/en/privacy-topics/technology/online-privacy-tracking-cookies/tracking-and-ads/gl_ba_1112/)
- [Commission d'accès à l'information du Québec, Main changes under Law 25](https://www.cai.gouv.qc.ca/protection-renseignements-personnels/sujets-et-domaines-dinteret/principaux-changements-loi-25)
- [ANPD, Guia orientativo: cookies e proteção de dados pessoais (PDF)](https://www.gov.br/anpd/pt-br/centrais-de-conteudo/materiais-educativos-e-publicacoes/guia-orientativo-cookies-e-protecao-de-dados-pessoais.pdf)
- [KVKK, Guideline on cookie practices (PDF)](https://www.kvkk.gov.tr/SharedFolderServer/CMSFiles/fb193dbb-b159-4221-8a7b-3addc083d33f.pdf)
- [Ministry of Internal Affairs and Communications (Japan), External transmission rule (外部送信規律)](https://www.soumu.go.jp/main_sosiki/joho_tsusin/d_syohi/gaibusoushin_kiritsu.html)