{"page":"/blog/cookie-banner-rules-by-country","modified":"2026-11-10","license":"https://creativecommons.org/licenses/by/4.0/","columns":["Jurisdiction","Legal basis","Consent for advertising cookies","Reject-button rule","GPC or browser signal","Regulator guidance","Notable enforcement"],"rows":[["EU baseline","Directive 2002/58/EC, Art. 5(3); GDPR Art. 7(3)","Yes, prior consent; exceptions for transmission and strictly necessary storage","Directive is silent on design; GDPR Art. 7(3): withdrawing consent must be as easy as giving it","No EU rule recognises GPC (n/d for any national rule)","EDPB Guidelines 2/2023, v2.0, 7 Oct 2024","Consent rules are enforced nationally (see rows below)"],["France","Art. 82, Loi n° 78-17, as read in CNIL délibération 2020-091","Yes","CNIL: refusing must be as easy as accepting; a \"tout refuser\" button or an equally simple option (CNIL FAQ)","n/d","Guidelines and recommendation, 17 Sep 2020","€325 million and €150 million, 1 Sep 2025; €15,000 ticketing company, 26 Mar 2026 (CNIL list)"],["Germany","§ 25 TDDDG, as applied in the DSK guidance","Yes","DSK: a first-layer reject option is needed when users must interact with the banner to keep using the site, which it says is \"very often\" the case (paras. 124 and 125)","n/d","OH Digitale Dienste v1.2, Nov 2024","n/d"],["Italy","Art. 122, Codice privacy (D.lgs. 196/2003), as read in the Garante guidelines","Yes","Garante: closing the banner with the \"X\" keeps the defaults, so no profiling cookies; scrolling alone is not consent","n/d","Guidelines, 10 Jun 2021","n/d"],["Spain","Art. 22.2 LSSI (Ley 34/2002), as read in the AEPD guide","Yes","AEPD: reject offered \"at the same time, at the same level and with the same visibility\" as accept, on the first layer","n/d","Guía sobre el uso de las cookies, Jul 2023","n/d"],["Netherlands","Art. 11.7a Telecommunicatiewet, as cited by the AP","Yes","AP: reject and accept on the same layer; refusing must not take more clicks","n/d","AP, \"Clear cookie banners\" (notes Apr and Nov 2025)","AP says it has increased cookie enforcement since 2024; amounts n/d"],["Ireland","Reg. 5, S.I. 336/2011, as read in the DPC guidance","Yes","DPC: a reject option must have \"equal prominence\"","n/d","Guidance note, Apr 2020","n/d"],["Belgium","Art. 129, Law of 13 June 2005 (per Linklaters, 27 Oct 2023)","Yes","n/d","n/d","APD cookie checklist, 20 Oct 2023 (Linklaters)","IAB Europe, TCF, €250,000, 2 Feb 2022 (APD)"],["Norway (EEA)","Ekomloven § 3-15 from 1 Jan 2025 (secondary sources only)","Yes (secondary sources)","n/d","n/d","n/d","Xandr, €8.6 million, decision 2 Oct 2026, for real-time bidding data, not banner design (EDPB, 16 Oct 2026)"]],"sourceUrls":[["https://eur-lex.europa.eu/eli/dir/2002/58/oj","https://eur-lex.europa.eu/eli/reg/2016/679/oj","https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-22023-technical-scope-art-53-eprivacy-directive_en"],["https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042398005","https://www.cnil.fr/fr/cookies-et-autres-traceurs/regles/cookies/FAQ","https://www.cnil.fr/fr/cookies-et-autres-traceurs/regles/cookies/lignes-directrices-modificatives-et-recommandation","https://www.cnil.fr/en/sanctions-issued-cnil"],["https://www.datenschutz-berlin.de/fileadmin/user_upload/pdf/publikationen/DSK/orientierungshilfen/2024_DSK-OH_Digitale-Dienste.pdf"],["https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9677876"],["https://www.aepd.es/sites/default/files/2020-07/guia-cookies.pdf"],["https://www.autoriteitpersoonsgegevens.nl/en/themes/internet-and-smart-devices/cookies/clear-cookie-banners"],["https://www.dataprotection.ie/sites/default/files/uploads/2020-04/Guidance%20note%20on%20cookies%20and%20other%20tracking%20technologies.pdf"],["https://web.archive.org/web/20250124234749/https://www.linklaters.com/knowledge/publications/alerts-newsletters-and-guides/2023/october/27/the-belgian-dpa-issues-a-checklist-for-the-compliant-use-of-cookies","https://www.dataprotectionauthority.be/citizen/iab-europe-held-responsible-for-a-mechanism-that-infringes-the-gdpr"],["https://www.edpb.europa.eu/news/norwegian-dpa-fines-xandr-eur-8-600-000-for-unlawful-processing-of-personal-data_en"]]}