Cookie laws by country, and what each one asks of your banner.
Some privacy laws need opt-in consent before any tracking cookie is set. Others let you set them and require an easy way to opt out. The table shows which is which, and each law has a page with the rules, the penalties and the official sources.
| Law | Where | Tracking cookies | Penalties |
|---|---|---|---|
| GDPRGeneral Data Protection Regulation and ePrivacy Directive | European Union and EEA | Opt-in before tracking | Up to €20m or 4% of global turnover |
| PECRPrivacy and Electronic Communications Regulations and UK GDPR | United Kingdom | Opt-in before tracking | Up to £17.5m or 4% of global turnover |
| TDDDGTelecommunications Digital Services Data Protection Act | Germany | Opt-in before tracking | Up to €300,000 under the TDDDG, plus GDPR fines |
| CNILArticle 82 of the French Data Protection Act and the CNIL guidelines | France | Opt-in before tracking | €325m to Google in 2025, the CNIL’s largest |
| LEKElectronic Communications Act (2022:482), chapter 9, section 28 | Sweden | Opt-in before tracking | GDPR fines via IMY; SEK 37m to Apoteket in 2025 |
| CCPACalifornia Consumer Privacy Act, as amended by the CPRA | California, United States | Opt-out, opt-in for some data | $2,500 per violation, $7,500 if intentional |
| Colorado Privacy ActColorado Privacy Act (CPA) | Colorado, United States | Opt-out, opt-in for some data | Up to $20,000 per violation |
| Quebec Law 25Act to modernize legislative provisions as regards the protection of personal information | Quebec, Canada | Opt-in before tracking | Up to C$25m or 4% of global turnover |
| PIPEDAPersonal Information Protection and Electronic Documents Act | Canada | Opt-out allowed | Up to C$100,000 for specific offences |
| LGPDLei Geral de Proteção de Dados, Law 13.709/2018 | Brazil | Opt-in before tracking | 2% of Brazilian revenue, up to R$50m each |
A summary for website owners, not legal advice. Reviewed ; each page links the law and the regulator's guidance it was read from.
Most of these laws fail on the same thing.
Cookies set before the visitor has answered. A free scan shows whether your site does it, and which cookie is responsible.