Post-graduate law degree, CIPP/E from the International Association of Privacy Professionals (IAPP). Privacy and Data Protection Research Writer at TermsFeed.
On this page
- 1. Cookies Under EU Law
- 2. Why Cookie Consent Matters
- 2.1. Technically Necessary Cookies
- 2.2. Cookies and Children
- 2.3. Legal Uncertainty
- 3. North America
- 3.1. Cookie Consent in United States (Federal Laws)
- 3.1.1. Cookie Consent in California
- 3.2. Cookie Consent in Canada
- 4. South and Central America
- 4.1. Cookie Consent in Argentina
- 4.2. Cookie Consent in Brazil
- 4.3. Cookie Consent in Mexico
- 5. Africa
- 5.1. Cookie Consent in Nigeria
- 5.2. Cookie Consent in South Africa
- 6. Asia
- 6.1. Cookie Consent in China
- 6.2. Cookie Consent in Hong Kong
- 6.3. Cookie Consent in India
- 6.4. Cookie Consent in Japan
- 7. Australasia
- 7.1. Cookie Consent in Australia
- 7.2. Cookie Consent in New Zealand
- 8. Summary Chart
Most websites that have adopted a cookie consent solution like a cookie banner have done so in order to comply with European Union (EU) law. The EU places strict requirements on businesses who collect personal information about internet users within its borders.
But what about countries outside of the EU? Almost every country has privacy laws of some kind. Let's take a look at the rules on cookie consent in some major markets around the world.
This article will look more at these laws and what they require in order for you to be in compliance.
Use our Cookie Consent all-in-one solution (Privacy Consent) for cookies management to comply with GDPR & CCPA/CPRA and other privacy laws:
- For GDPR, CCPA/CPRA and other privacy laws
- Apply privacy requirements based on user location
- Get consent prior to third-party scripts loading
- Works for desktop, tables and mobile devices
- Customize the appearance to match your brand style
Create your Cookie Consent banner today to comply with GDPR, CCPA/CPRA and other privacy laws:
Start the Privacy Consent wizard to create the Cookie Consent code by adding your website information.
At Step 2, add in information about your business.
At Step 3, select a plan for the Cookie Consent.
You're done! Your Cookie Consent Banner is ready. Install the Cookie Consent banner on your website:
Display the Cookie Consent banner on your website by copy-paste the installation code in the
</head>section of your website. Instructions how to add in the code for specific platforms (WordPress, Shopify, Wix and more) are available on the Install page.
Cookies Under EU Law
The EU's requirement for cookie consent comes from two important laws:
- The ePrivacy Directive, which requires consent for cookies and other things that collect personal information or track users' behavior.
- The General Data Protection Regulation (GDPR), which sets strict rules on how businesses request and obtain consent. "Implied" consent and "opt-out" models of consent are not allowed. Consent must be earned via a user's specific, clear, affirmative action.
The combination of these two laws has led to many websites implementing cookie banners so that they could continue legally engaging in practices like personalized advertising, retargeting and analytics.
Here's an example of a standard cookie banner that allows users to give or decline to give consent for cookies:
If you use advertising cookies, and you offer goods and services in the EU, you'll need a cookie consent solution, too.
Why Cookie Consent Matters
On the face of it, cookie banners may seem like an unnecessary annoyance. But there is a reason that governments are becoming more concerned about regulating online business activity - to protect its citizens.
The EU is way ahead of any other jurisdiction in the world when it comes to data protection. Gradually, however, other places are starting to introduce privacy laws inspired by EU law.
Businesses are increasingly driven by an imperative to collect personal information. This can help drive sales by personalizing marketing, predicting people's behavior, and influencing their choices. Cookies are a way to help achieve all of these things.
Before we look at some the treatment of cookies around the world, there are a few things to keep in mind.
Technically Necessary Cookies
There is an important distinction between different types of cookies. Some are necessary for the functioning of a website, and some are desirable from a user's perspective.
Generally, when we refer to "cookies" in this article, we're referring to cookies that are used for ad personalization and tracking. These are the sorts of cookies that collect personal information and can have privacy implications.
You should also assume that other devices that serve similar functions, such as web beacons and pixel tags, are included in this definition.
Cookies and Children
Very often, separate laws apply to tracking the online behavior of children.
We're only going to look at one such law, the Children's Online Privacy Protection Act (COPPA) in the United States. This will give you an idea of how such regulation works.
There may be similar laws in other countries we look at, too. If your business intends to market to children, you should think very carefully about whether using advertising cookies is appropriate at all.
Cookies are not mentioned explicitly in many laws. Even the mammoth GDPR only mentions the word "cookie" once.
Some jurisdictions define "personal information" in a broad way, that implies that cookies should be included. Others define "personal information" in a more narrow way.
When asking whether a particular country requires cookie consent, it's not always easy to answer simply yes or no. It may be that the issue of cookies simply hasn't been considered by the country's lawmakers or courts yet. We can't be certain about how they will treat the issue once they do.
Cookie Consent in United States (Federal Laws)
Privacy law in the United States is very weak compared to many other major economies. Essentially, the U.S. does not require consent for cookies.
If you've determined that COPPA applies to you, you'll need to be very careful about using cookies at all, particularly tracking cookies. Numerous investigations have been launched into the use of tracking cookies, for example on websites operated by Hasbro, Mattel and Fisher-Price.
Cookie Consent in California
The strongest privacy laws in the U.S. can be found in California. And because they apply to any business operating in California, they effectively apply to any business operating in the United States.
The California Consumer Privacy Act (CCPA) and its amendments, known as the California Privacy Rights Act (CPRA) both have requirements when it comes to cookies.
Cookie Consent in Canada
The privacy regime in Canada is much stricter than in the United States. But it's still not as strict as in the EU.
There is some confusion about the cookie situation in Canada. Let's examine how cookies are treated under Canadian law.
Canada has two main privacy laws:
- Personal Information Protection and Electronic Documents Act (PIPEDA)
- Canada's Anti-Spam Legislation (CASL)
The combination of these two laws gives some sort of requirement for cookie consent, but not necessarily cookie banners.
PIPEDA mentions two types of consent:
- Express consent. This type of consent is given explicitly, through a specific action. For example, clicking the "I Agree" option on a cookie banner.
- Implied consent. This type of consent can be inferred through a person's actions or inaction. For example, where a user has been given the option to opt out but has not done so.
CASL requires that website and app operators get "express consent" for the installation of certain "computer programs." CASL deems that cookies are a type of computer program.
However, you can assume that you have a person's express consent for cookies if "the person's conduct is such that it is reasonable to believe that they consent to the program's installation."
How might a person's conduct indicate that they consent to cookies? Here's some guidance from the Canadian Radio-television and Communications Commission:
So, as long as you respect people's opt-out choices and browser settings, you can assume that you have their express consent to set cookies under Canadian law.
It may have occurred to you that this sounds more like "implied consent" than "express consent." In any case, the upshot is that Canada does not require (express) consent for cookies, as long as proper information and an opt-out process are provided.
South and Central America
Cookie Consent in Argentina
Argentina's Personal Data Protection Act requires personal information to only be collected with express consent, given in writing or "other similar means."
There are a few exceptions to this consent requirement, such as where the personal information forms part of a list limited to:
- National identity number
- Tax or social security identification
- Date of birth
- Phone number
The question, then, turns to whether cookies are considered personal information. This is not clear from the law.
Applying the principle that cookies are increasingly considered personal information, you should proceed with caution - Argentina may require consent for cookies.
Cookie Consent in Brazil
There are two key privacy pieces of privacy legislation in Brazil:
- The Civil Rights Framework for the Internet (known as the "Marco Civil") (English version)
- The Brazilian General Data Protection Law (LGPD) (English version), which went into force in 2020
These laws don't make specific reference to cookies. But in a similar way to other Latin American laws, they do suggest that cookies containing personal information require express consent.
Therefore, proceed with caution - Brazil may require consent for cookies.
Cookie Consent in Mexico
There are several important privacy laws in Mexico, including
- The Federal Law on the Protection of Personal Data held by Private Parties (English version)
- The Privacy Notice Guidelines (Spanish version)
Under these laws, Mexico does require consent for cookies, except where cookies are required for technical purposes. Full notice of how cookies and other devices collect personal information is also a legal requirement.
Cookie Consent in Nigeria
Nigeria's main privacy laws are:
- The National Information Technology Development Agency Act 2007 (English version)
- The Nigerian Data Protection Regulation 2019 (English version)
The 2007 Act does not refer to cookies, and the 2019 Regulation only notes the word once. Little appears to have been written about its requirements or interpretation.
The language around consent in the Regulation is very similar to that of the EU's GDPR. Consent is defined as:
"any freely given, specific, informed and unambiguous indication of the data subject's wishes by a clear affirmative action"
This would suggest a strong "opt-in" or "express" model of consent.
Consent is one of six legal reasons for processing personal information. The others, which include fulfillment of a "legal obligation" or performance of a contract, are unlikely to apply when using cookies.
Therefore, it would appear that, as of January 2019, Nigeria does require consent for cookies.
Cookie Consent in South Africa
There are two main privacy laws in South Africa:
- The Electronic Communications and Transactions Act 2002 (English version)
- The Protection of Personal Information Act (POPI) (English version)
The POPI Act was passed in 2013 and bears some similarities to EU data protection law. It didn't become enforceable until July 1, 2020.
Cookie Consent in China
Privacy law in China is covered by myriad regulations, statutes and court opinions. Internet censorship, cybersecurity laws and the "Great Firewall of China" present additional challenges to entering this online marketplace.
Examples of laws governing online marketing include:
- The Internet Email Services Regulations (information in English)
- The Law on Tortious Liability (English version)
There's also the Personal Information Protection Law (PIPL) that took effect on November 1, 2021.
However, no Chinese law appears to make reference to cookies.
An interesting civil lawsuit was brought against Chinese search engine Baidu in 2015. The claimant alleged that she had been psychologically harmed by Baidu's use of retargeting cookies.
Although this decision is not binding on other courts, it can be taken as partial confirmation that China does not require consent for cookies.
Cookie Consent in Hong Kong
The main privacy laws in Hong Kong are:
- The Personal Data (Privacy) Ordinance (English/Cantonese version)
- The Unsolicited Electronic Messages Ordinance (English version)
These laws don't specifically require consent for cookies.
The Hong Kong Privacy Commissioner provides some helpful guidance on applying the Ordinances in the context of online behavioral advertising.
Today, Hong Kong does not require consent for cookies.
Cookie Consent in India
The IT Act prohibits the introduction of a "computer virus" into a computer. "Computer virus" is defined quite broadly. Here's part of the definition:
"any computer instruction, data or programme that [...] attaches itself to another computer resource and operates when a programme, data or instruction is executed or some other event takes place in that computer resource."
It is possible that cookies could be captured within this definition.
Cookie Consent in Japan
Two of Japan's main privacy laws are:
- The Act on the Protection of Personal Information (APPI) (English version)
- The Act on Regulation of the Transmission of Specified Electronic Mail (English version)
As of 2022, the APPI requires opt-in consent for the use of third-party cookies and an opt-out mechanism for third-party transfer of personal data.
Cookie Consent in Australia
Australia's main privacy laws are:
- The Privacy Act 1988
- The Spam Act 2003 marketing law
Neither law makes any reference to cookies.
The Office of the Australian Information Commissioner provides some guidance on applying the "Australian Privacy Principles" that derive from Australian law. This does suggest that information collected by cookies might constitute personal information if a person could be "reasonably identified" from it.
Cookie Consent in New Zealand
New Zealand's main privacy laws are:
- The Privacy Act, a data protection law
- The Unsolicited Electronic Messages Act 2007, an anti-spam law
Neither of these laws makes reference to cookies or implies that they should be treated as personal information.
New Zealand does not require consent for cookies.
Here's what we've learned about cookie consent around the world.
Remember the caveats we considered at the top of the article about children, technically necessary cookies and legal uncertainty. And be aware that certain laws require disclosure even if they don't require express consent.
|Consent required||Consent not required||Proceed with caution|
|Canada||✔ (consent can be assumed under certain conditions)|
|Japan||✔ (for first-party cookies)||✔ (for third-party cookies)|
|South Africa||✔ (a cookie notice and policy are required)|
|United States (California)||✔|