Cookie banner rules by country: EU member states, the UK, Switzerland and US states compared

Scope. Eighteen rows: the EU baseline, seven EU member states, Norway, the UK, Switzerland, US federal law, five US states and one row for other US states. We include a jurisdiction when its regulator has published cookie or opt-out guidance, or when it has a statutory browser-signal rule.

Columns. The site shows six columns by default: jurisdiction, legal basis, consent for advertising cookies, reject-button rule, GPC or browser signal, and notable enforcement. Regulator guidance sits behind the column menu. "n/d" means we could not verify the point from a primary or dated source for this edition.

Three layers. Each row separates what the law says, what the regulator has said and, where shown, practice. A regulator's guidance is not the statute. Courts can and do disagree with it.

Dataset: CSV /datasets/cookie-banner-rules-by-country.csv, 18 rows, one row per jurisdiction. Columns: jurisdiction, region, legal_basis, legal_basis_url, ad_cookie_consent, reject_rule, browser_signal_rule, guidance_title, guidance_date, guidance_url, enforcement_summary, enforcement_date, enforcement_amount, enforcement_url, last_checked. Licence CC BY 4.0.

What the law says. Every EU member state transposes Article 5(3) of the ePrivacy Directive into its own statute. The Directive sets one consent rule and two exceptions, so the core answer is the same everywhere: advertising cookies need prior consent (Directive 2002/58/EC). The Court of Justice held in Planet49 on 1 October 2019 that a pre-ticked box is not valid consent (CJEU, C-673/17).

What regulators have said. The differences sit in banner design. France, Spain, the Netherlands and Ireland all expect refusal to be as easy and visible as acceptance. Germany's regulators take a narrower line: a first-layer reject option is required when the banner blocks the site, and the DSK says common designs "very often" meet that condition (DSK, paras. 124 and 125). Italy treats closing the banner as a refusal (Garante, 10 June 2021). France's rules and sanctions get their own page on CNIL cookie rules.

What we observed in enforcement. The CNIL list shows a steady flow of small "simplified procedure" fines for cookie consent, from €3,000 to €20,000, alongside the large 2025 cases (CNIL sanctions list). The biggest EEA ad tech decision of 2026, Norway's €8.6 million fine on Xandr, concerned bidstream data rather than banner wording. It is covered in our guide to GDPR, ePrivacy and the bidstream.

What the law says. The UK kept a consent rule but wrote its exceptions into statute on 5 February 2026. Advertising is not among them. The fine for a breach is now up to £17.5 million or 4% of worldwide turnover (PECR Sch. 1, para. 18; DPA 2018, s. 157(5)). The full story, including the ICO's May 2026 advice on a possible advertising exception, is in our page on the UK Data (Use and Access) Act and advertising.

Switzerland works differently. Article 45c(b) of the Telecommunications Act lets operators process data on devices if users are informed and told they can refuse. The FDPIC reads the Federal Act on Data Protection on top of that. In its view, advertising cookies within "normal" profiling need only a visible opt-out, while "high-risk profiling" needs consent (FDPIC guidelines, sections 3.11.2 and 3.11.3).

What the regulator has said. The FDPIC writes that cross-site tracking for auction-based ad placement "may" exceed the normal threshold. Controllers that have not analysed the risk "must assume there is a potentially high risk" (same source, section 3.11.3). In practice, that puts much programmatic tracking in Switzerland close to a consent model.

What the law says. No US state requires a cookie consent banner for adult users in the EU sense. State laws give consumers a right to opt out of targeted advertising, "sale" or "sharing", and several require businesses to honour a browser signal as that opt-out. California's regulation is the most detailed: a qualifying signal must be processed as a valid opt-out request (11 CCR § 7025(b)). Its "symmetry in choice" rule is the closest US equivalent to a reject button (11 CCR § 7004(a)(2)).

What regulators have done. California's enforcers have named GPC failures in several actions. The Attorney General's Sephora settlement of 24 August 2022 required Sephora to honour GPC. The Healthline judgment of 1 July 2025 and the Disney settlement of 11 February 2026 both turned partly on signals (California AG). The CPPA's Tractor Supply decision of 30 September 2025 cited a failure to honour "opt-out preference signals such as Global Privacy Control" (CPPA).

The Global Privacy Platform (GPP) carries these US opt-outs in bid requests, and our GPP consent string decoder reads its US state sections. Implementation detail is in GPP and TCF implementation for engineers.

Most organisations do not run 18 banners. They run one CMP with regional rules. The legal answer for each visitor depends on a few facts, and a scenario shows how they combine.

A fashion retailer sells in France, Germany, the UK and California. Its site uses first-party analytics, a basket cookie, and advertising pixels from three platforms.

1. The basket cookie is the textbook strictly necessary case. The UK statute itself lists remembering a user's selections on a website as an example (PECR Sch. A1, para. 4(2)).
2. Analytics may fit the UK statistical exception, which replaces consent with information and an opt-out. In France and Germany, analytics must fit the Directive's "strictly necessary" exception or rely on consent, and each regulator reads that exception in its own guidance.
3. Advertising pixels need prior consent in France, Germany and the UK. California sets no prior-consent rule for adults; instead the retailer must treat a qualifying GPC signal as an opt-out of sale and sharing (11 CCR § 7025).
4. The reject option for French visitors is expected on the same screen and to be as easy as acceptance, under CNIL guidance. For German visitors the DSK test asks whether the banner blocks the site.

What practitioners do (practice, not law): many CMPs geolocate visitors and apply the strictest rule within a region. In the EEA they record consent in a TCF string, which our TCF consent string decoder can read.

• EU. The Digital Omnibus proposal of November 2025 would rework cookie consent and its exceptions. The Council's text moved the cookie rules back into ePrivacy Article 5(3), and a presidency text of 3 September 2026 lists consent exemptions (Taylor Wessing, 2026). Reports say the Council dropped a browser-signal provision (PPC Land). No final text existed on 9 November 2026. Our EU Digital Omnibus tracker follows each step.
• UK. The government may add an advertising exception by regulations under PECR regulation 6A. None had been laid in draft by 9 November 2026 (legislation.gov.uk).
• California. Browsers must offer an opt-out preference signal when the Opt Me Out Act takes effect in January 2027 (CPPA, 8 October 2025). Our ad tech regulation calendar lists the dates.

• Statutory text for Germany, Italy, Spain, the Netherlands, Ireland, Belgium and Norway. Each row cites the regulator's own reading of its statute or, for Belgium and Norway, secondary sources.
• Recent fines in Germany, Italy, Spain, the Netherlands and Ireland from a primary source.
• Whether any EU or EEA regulator treats GPC or another browser signal as a valid refusal.
• Universal opt-out start dates for Texas, Montana, New Jersey, Delaware, New Hampshire, Nebraska and Maryland, which secondary trackers report with conflicting dates.

1. Directive 2002/58/EC (ePrivacy Directive), Article 5(3), as amended. https://eur-lex.europa.eu/eli/dir/2002/58/oj
2. Regulation (EU) 2016/679 (GDPR), Article 7(3). https://eur-lex.europa.eu/eli/reg/2016/679/oj
3. CJEU, Case C-673/17, Planet49 (1 October 2019). https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62017CJ0673
4. EDPB, Guidelines 2/2023 on Technical Scope of Art. 5(3) of ePrivacy Directive, version 2.0 (adopted 7 October 2024). https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-22023-technical-scope-art-53-eprivacy-directive_en
5. CNIL, "The sanctions issued by the CNIL" (updated 14 April 2026). https://www.cnil.fr/en/sanctions-issued-cnil
6. CNIL, guidelines and recommendation on cookies and other trackers (17 September 2020). https://www.cnil.fr/fr/cookies-et-autres-traceurs/regles/cookies/lignes-directrices-modificatives-et-recommandation
7. CNIL, FAQ on the guidelines and recommendation. https://www.cnil.fr/fr/cookies-et-autres-traceurs/regles/cookies/FAQ
8. Légifrance, CNIL délibération n° 2020-091 (17 September 2020). https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042398005
9. DSK, Orientierungshilfe der Aufsichtsbehörden für Anbieter:innen von digitalen Diensten (OH Digitale Dienste), version 1.2 (November 2024). https://www.datenschutz-berlin.de/fileadmin/user_upload/pdf/publikationen/DSK/orientierungshilfen/2024_DSK-OH_Digitale-Dienste.pdf
10. Garante per la protezione dei dati personali, Linee guida cookie e altri strumenti di tracciamento (10 June 2021). https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9677876