Cookie and Tracker Rules Worldwide: Consent, Opt-Out, and the Space Between

The legal stack in the EU: ePrivacy Article 5(3) (implemented nationally, PECR in the UK) requires consent for storing or accessing information on a user's device unless strictly necessary for a service the user requested, and since the GDPR, that consent carries the Article 4(11)/7 standard, prior, informed, specific, freely given, unambiguous, withdrawable, with the CJEU's Planet49 judgment (2019) killing pre-ticked boxes and establishing that the rules apply regardless of whether the data is personal. What enforcement has made concrete: prior means prior, tags fire only after affirmative choice (the fire-then-ask pattern is the most-cited violation in CNIL's sweep letters); reject as easy as accept, CNIL's December 2021 decisions fined Google 150 million EUR and Facebook 60 million EUR specifically for offering one-click accept against multi-click refusal, and its 60 million EUR Microsoft/Bing decision (2022) repeated the theory, making the first-layer Reject All button the de facto European standard; cookie walls are heavily restricted (the EDPB's position, with CNIL and national DPAs tolerating paywall-or-consent models only under conditions, the 'consent or pay' debate continuing through the EDPB's 2024 opinion on large platforms); granularity by purpose with per-purpose choice at least in a second layer; and withdrawal as easy as consent, a persistent re-open mechanism. The earlier CNIL round (December 2020: Google 100 million EUR, Amazon 35 million EUR) punished firing before consent and inadequate information, so the full French case law spans the banner lifecycle. Beyond France: the ICO's PECR enforcement and its 2023-2024 campaign warning the UK's top websites over missing reject buttons; the EDPB cookie-banner taskforce report (2023) harmonizing positions on deceptive designs; Spain's AEPD, Italy's Garante, and Belgium's APD running steady fine practice; and the Belgian decision against IAB Europe's TCF (upheld in relevant part by the CJEU in 2024 on OpenRTB questions) putting the adtech consent-string plumbing itself under GDPR scrutiny. Strictly-necessary stays narrow: security, load balancing, cart state, consent storage; analytics is not exempt in most member states (CNIL's audience-measurement exemption is conditional and narrow), advertising never is.

Through classification and signals rather than consent gates. The classification step: CCPA defines sale as disclosure for monetary or other valuable consideration and CPRA adds sharing for cross-context behavioral advertising, definitions broad enough that routine adtech, analytics pixels, and audience-matching flows constitute sales or shares, a conclusion the California AG's Sephora settlement (2022, $1.2 million) made explicit: Sephora's third-party analytics and ad trackers were sales, and failing to honor Global Privacy Control signals against them violated the CCPA; other state laws regulate targeted advertising with similar effect. The machinery this obligates: a Do Not Sell or Share My Personal Information mechanism (link or the alternative opt-out preference-signal-only compliance path California permits); honoring universal opt-out signals, GPC is mandatory in California (AG and CPPA position, post-Sephora), Colorado (whose rules created a formal recognized-signal registry with GPC approved), Connecticut, Texas, Montana, Oregon, Delaware, New Jersey, and the growing list, meaning a browser-level header must suppress sale/share flows without any user click on your site; effectuation within 15 business days in California, with downstream propagation to the third parties who received data; opt-in rather than opt-out for known minors' data sales (16-and-under mechanics in CCPA) and for sensitive data in the Virginia-family states, with California's limit-use right as its variant; and no dark patterns, the CPRA and Colorado rules invalidate consent or choice obtained through manipulative interfaces, and the CPPA's enforcement advisories plus its Honda action (2025) have targeted asymmetric and burdensome opt-out flows. What the US model does not require: a cookie banner as such, consent-before-firing for general audiences, or granular purpose toggles, which is why importing the European banner into the US is a design choice, not an obligation, and running the European banner badly in the US (an Accept-only banner over active GPC-ignoring trackers) manages to fail both models at once. The private-litigation overlay: wiretapping theories (CIPA in California) against session-replay and chat pixels, the Meta pixel healthcare cases, and VPPA suits against video-page trackers price tracker misconfiguration independently of the statutes above.

Canada: PIPEDA has no cookie-specific statute; the OPC's guidance applies the meaningful-consent framework, implied consent can suffice for non-sensitive tracking where the practice is obvious and an opt-out is easy, but express consent is expected for sensitive inferences and cross-site behavioral advertising aimed at children is off-limits; the OPC's online behavioral advertising guidance sets conditions (transparency, opt-out ability, no sensitive categories); Quebec moves the line: Law 25 requires technologies that identify, locate, or profile a user to be off by default with the user informed and activating them, a European-flavored rule the CAI's guidance applies to tracking, so a Canada strategy increasingly means a Quebec consent layer atop implied-consent rest-of-Canada. Brazil: no ePrivacy analogue, so trackers are analyzed straight under LGPD's bases, and the ANPD's cookie guidance (2023) expects consent for non-essential cookies with legitimate-interests arguable only narrowly, plus LGPD-standard transparency; in practice the market converged on EU-style banners. China: PIPL requires consent (or another basis, rarely available for adtech) with separate consent for sensitive data, and the PIS specification plus app-regulation enforcement (the MIIT's app sweeps) police SDK data collection aggressively; the practical rule for China-facing properties is explicit consent before non-essential SDKs and trackers initialize, with China-specific privacy notices. Japan: the 2022 APPI amendment regulates third-party-provided 'personally referable information' (cookie-linked data that becomes personal data on the recipient's side requires confirming the recipient obtained consent), and the 2023 telecommunications-law amendment added an external-transmission rule (notice or consent for sending user data off-device, a soft ePrivacy analogue). Australia: no consent mandate for cookies today, the Privacy Act reform process has targeted online tracking, and the OAIC applies the existing APPs to identifiable tracking. South Korea: PIPA plus the network act require consent for behavioral advertising data in most configurations, with PIPC guidance. India: the DPDP Act's consent-first architecture will reach trackers as the rules operationalize. The composite: outside the US, the world defaults toward consent for non-essential tracking; the differences are in exemption breadth, enforcement energy, and whether the requirement is cookie-specific (ePrivacy-style) or falls out of the general law (LGPD, PIPL).

Geo-segmented behavior from a single stack, four layers deep. The tag inventory, the layer everything depends on: every cookie, pixel, SDK, and script cataloged with owner, purpose category, data sent, and recipients, refreshed by scheduled scans, because the recurring failure in every jurisdiction is not banner design but unmanaged tags, the marketing pixel added after the banner shipped, firing for everyone. The policy engine: per-jurisdiction rules expressed as configuration, consent regimes (EU/UK, Quebec's off-by-default, Brazil, China) get prior-consent gating with reject-parity banners and granular categories; opt-out regimes (US states) get GPC ingestion, sale/share classification per tag, opt-out links, and suppression propagation; calibrated regimes (rest-of-Canada, Japan's notice rule) get their documented middle settings; and the geolocation that selects the rule set fails protective (unknown location gets the strictest applicable treatment). The firing control, where compliance is real or fake: tags load only through the consent platform's gates (a tag manager consulting consent state before injection), server-side collection respects the same state, GPC headers suppress classified flows without user interaction, and consent-mode-style degraded signals are used only where they genuinely honor the choice; the test is empirical, run the network tab as a fresh EU visitor, reject, and watch what still fires, exactly what CNIL sweeps, the ICO's campaign, plaintiff firms, and this site's scanner do. The records and lifecycle layer: consent receipts (who, when, what was shown, what was chosen) retained per GDPR accountability and CPRA rules, choice persistence across sessions and devices where identity permits, re-prompt cadence per national guidance (CNIL's 6-month convention for re-solicitation after refusal, 13-month cookie lifetimes), withdrawal mechanics wired to actually stop and where required delete, and change management, every new tag routes through classification before production. Governance closes the loop: quarterly scans reconciled against the inventory, drift alerts when unclassified tags appear, and the banner's own UX audited against dark-pattern doctrine on both continents, since asymmetric flows are now independently enforceable in Paris and Sacramento alike.

Ranked by enforcement frequency. Tags firing before or despite choice: the top finding in CNIL sweeps, the basis of the Google Analytics-adjacent enforcement wave, the core of the Sephora GPC theory, and the easiest violation to prove, a regulator or plaintiff loads the page in a clean browser, rejects (or sends GPC), and reads the network log; because the evidence is mechanical, intent arguments do not help, and because the check is scriptable, sweeps scale (CNIL reports checking hundreds of sites per campaign; the CPPA and multi-state AG coalitions run coordinated sweeps of GPC honoring). Reject asymmetry and dark patterns: one-click accept versus buried refusal (the 150M/60M EUR French decisions), confirmshaming copy, color-and-contrast manipulation, and pre-selected toggles, all documented in the EDPB taskforce report and the CPPA's advisories, and increasingly punished as standalone violations even where consent was technically collected. Classification gaps: the US-side equivalent, adtech flows not labeled as sales/shares so the opt-out suppresses nothing (Sephora's core failure), or sensitive-data pixels (health pages sending symptoms to ad platforms, the Meta-pixel hospital litigation and the FTC's GoodRx and BetterHelp actions under the Health Breach Notification Rule and Section 5) that no general opt-out can cure. Consent-string and vendor-chain rot: choices collected but not propagated, the TCF consent string misdeclared, or third parties re-syncing suppressed identifiers, the IAB Europe litigation's terrain and the reason downstream propagation clauses belong in adtech contracts. Orphaned surfaces: the marketing microsite, the mobile app's SDKs (a different stack than the website, routinely forgotten), embedded videos and chat widgets carrying their own trackers, and post-M&A properties running the acquirer's old banner. The discovery asymmetry to internalize: you must audit continuously to know your state, but any outsider can audit you in five minutes, which is why tracker compliance rewards the boring disciplines, inventory, gating, scanning, records, over banner cosmetics.