Laws
Cookie and privacy laws, one page each
What each law requires for cookies and trackers, who it applies to, the exceptions, the fines and the authority, with sources. Written to answer the question alone; the product appears only where it is the natural next step.GDPR: European Union and EEAWhat the GDPR requires for cookies and consent: opt-in before non-essential cookies, a real Reject option, proof of consent, fines up to 4% of turnover.ePrivacy Directive: European Union and EEA (transposed into national law)The ePrivacy Directive is the EU cookie law: prior consent before storing or reading anything on a device, two exemptions, fines set by each country.UK GDPR and PECR: United KingdomUK cookie law: PECR regulation 6 requires consent before non-essential cookies, the 2026 exceptions for statistics, ICO enforcement, fines up to £17.5 million.CCPA / CPRA: California, United StatesWhat the CCPA/CPRA requires for cookies: an opt-out of sale and sharing, a Do Not Sell or Share link, Global Privacy Control honored, fines up to $7,988 each.LGPD: BrazilHow Brazil's LGPD applies to cookies: free, informed and unequivocal consent for non-necessary cookies, the ANPD cookie guide, fines up to 2% of revenue.Swiss FADP: SwitzerlandSwitzerland's FADP and Article 45c TCA: inform visitors about cookies and let them refuse, express consent for high-risk profiling, fines up to CHF 250,000.Quebec Law 25: Quebec, CanadaWhat Quebec's Law 25 requires for cookies: tracking and profiling off by default and explained first, with penalties up to C$25 million or 4% of turnover.PIPEDA: Canada (federal)How Canada's PIPEDA applies to cookies: meaningful consent, implied for non-sensitive tracking, opt-out for behavioral ads, and the reform bill of June 2026.POPIA: South AfricaHow South Africa's POPIA applies to cookies: online identifiers are personal data, consent must be voluntary, specific and informed, fines up to R10 million.US state privacy laws: United States (states other than California)US state privacy laws beyond California, explained for cookies: opt-out of targeted ads and data sales, Global Privacy Control, fines of $7,500 per violation.Australian Privacy Act: AustraliaAustralia's Privacy Act and cookies: no consent rule but an APP 5 notice, consent for sensitive data, the A$3 million threshold, penalties up to A$50 million.KVKK: TürkiyeTürkiye's KVKK and cookies: explicit consent before non-essential cookies, the cookie guideline and its exemptions, the 2020 Amazon decision, indexed fines.