EnglishEspañol
Data Privacy LawsLegal Information

Cookie Banner Requirements: US & EU Rules (2026)

Independently fact-checkedEditor-reviewedLaw current as of August 14, 2026By Recording Law Editorial TeamReviewed August 28, 202613 min read

Independently fact-checked against primary sources (last audited August 14, 2026). · Reviewed by the RecordingLaw editorial team. · Law checked current as of August 14, 2026. · 7 primary sources cited on this page. How we verify our legal content

Cookie Banner Requirements: US & EU Rules (2026)

Whether your website needs a cookie banner depends on where your visitors are located. EU law requires opt-in consent before placing any non-essential cookies. US state laws like the CCPA require opt-out mechanisms instead. No single federal US cookie-banner law exists.

Cookie banners are the most visible artifact of privacy law on the internet. Nearly every major website displays one, but the requirements behind those banners differ sharply between the EU and the US. An EU-compliant banner asks permission before tracking. A US-compliant banner offers a way to opt out after tracking has begun. Getting this wrong carries real consequences: the French CNIL fined Google 150 million euros in 2021 over the design of its cookie consent interface.

This guide breaks down exactly what a compliant cookie banner looks like in each jurisdiction, what elements are required, which design choices are illegal, and how to handle the overlap when a single website serves both European and American visitors.

Hand holding a smartphone by its plain matte back in a softly lit living room
A compliant EU banner must offer Accept All and Reject All buttons with equal visual prominence

EU cookie consent is governed by the ePrivacy Directive (Directive 2002/58/EC, amended by 2009/136/EC) and the GDPR (Regulation 2016/679). The core rule is simple: no non-essential cookies may be placed on a user's device until the user gives informed, affirmative consent.

A compliant EU cookie banner must include the following elements.

Clear identification of purposes. The banner must explain, in plain language, what cookies are used for. Vague language like "We use cookies to improve your experience" is insufficient. Each purpose (analytics, advertising, social media, functional enhancements) should be identified.

Accept and reject options with equal prominence. Users must be able to reject non-essential cookies as easily as they accept them. The CNIL and Italian Garante both require a reject button on the first layer of the banner, not hidden behind a "Manage Preferences" link. The reject button must be the same size, color weight, and prominence as the accept button.

Granular consent by category. Users must be able to consent to specific categories of cookies (analytics, advertising, functional) independently. An "Accept All" button is permissible only if accompanied by individual category toggles and an equally prominent "Reject All" option.

Information about cookie duration and recipients. Users must be told how long cookies persist and which third parties receive data through cookies. This information can be in a linked cookie policy rather than the banner itself, but the link must be accessible from the banner.

No pre-ticked checkboxes. The CJEU ruled in Planet49 (Case C-673/17) that pre-ticked checkboxes do not constitute valid consent. All cookie category toggles must default to "off" or unchecked.

Prior blocking of cookies. Non-essential cookies must not load until the user provides consent. This means the banner must block analytics scripts, advertising pixels, and social media embeds from executing until an affirmative choice is made. This is often the most technically challenging requirement.

What a Compliant EU Banner Looks Like

A compliant first-layer EU cookie banner typically includes:

  1. A brief explanation: "This website uses cookies for analytics, advertising, and social media integration."
  2. A link to the full cookie policy with detailed cookie inventory
  3. An "Accept All" button
  4. A "Reject All" button (same size and visual weight)
  5. A "Manage Preferences" link that opens granular category-level controls
  6. All category toggles default to off in the preferences panel

Users must be able to withdraw cookie consent at any time, and withdrawal must be as easy as giving consent. Most implementations satisfy this through a persistent cookie settings icon or link in the website footer. When a user withdraws consent, previously set cookies should be deleted and the associated tracking should stop.

Organizations must maintain records demonstrating that valid consent was obtained. Records should include the timestamp, the user's consent choices (which categories were accepted or rejected), the version of the cookie banner shown, and the user's IP address or a pseudonymized identifier.

The ePrivacy Directive does not specify how often consent should be refreshed. National guidance varies: the CNIL recommends every 6 months, while other authorities suggest 12 months. Best practice is to re-display the consent banner whenever new cookie categories are added or processing purposes change.

Hands typing on a laptop at a wooden desk with a small closed brass padlock beside it
US cookie banners operate on an opt-out model, primarily driven by California's CCPA/CPRA

The United States has no federal law requiring cookie consent banners. US cookie banner obligations come from state privacy laws, primarily the California Consumer Privacy Act as amended by the CPRA (CCPA/CPRA), with additional requirements from other state privacy laws.

California: CCPA/CPRA Requirements

California's CCPA/CPRA does not require opt-in cookie consent. Instead, it requires businesses to provide specific opt-out mechanisms.

"Do Not Sell or Share My Personal Information" link. Businesses that sell personal information or share it for cross-context behavioral advertising must display a clear link on their homepage and in their privacy policy. This link must lead to a page where consumers can exercise their opt-out rights.

Global Privacy Control (GPC) recognition. Under the CCPA regulations finalized by the California Privacy Protection Agency (CPPA), businesses must treat GPC signals as valid opt-out requests. GPC is a browser-level signal (available in Firefox, Brave, DuckDuckGo, and through browser extensions) that automatically communicates a user's opt-out preference.

No opt-in required (with exceptions). The CCPA/CPRA does not require opt-in consent for cookie placement. However, businesses must obtain opt-in consent before selling the personal information of consumers under 16 years old (with parental consent required for those under 13).

"Limit the Use of My Sensitive Personal Information" link. If a business uses or discloses sensitive personal information beyond what is necessary to provide the requested service, it must display an additional link allowing consumers to limit that use.

Other State Privacy Laws

Several other states have enacted comprehensive privacy laws with provisions affecting cookie-based tracking.

Colorado (CPA): Requires businesses to provide opt-out mechanisms for targeted advertising and the sale of personal data. Businesses must honor universal opt-out signals (including GPC) starting July 1, 2024.

Connecticut (CTDPA): Requires opt-out rights for targeted advertising, data sales, and profiling. Mandates recognition of universal opt-out mechanisms.

Virginia (VCDPA): Provides consumer opt-out rights for targeted advertising and data sales. Does not require recognition of universal opt-out signals.

Texas (TDPSA): Effective July 1, 2024. Provides opt-out rights for targeted advertising and data sales. Under Tex. Bus. & Com. Code Sec. 541.055(e), a consumer may designate an authorized agent to opt out through a technology such as a link, a browser setting or extension, or a global setting on a device, and a controller must honor that request if it can verify, with commercially reasonable effort, the consumer's identity and the agent's authority to act. The same subsection excuses compliance where the request is not communicated clearly and unambiguously, the controller cannot verify that the consumer is a Texas resident, the controller does not possess the ability to process the request, or the controller does not process similar requests to comply with another state's law. Section 541.055(f)(2) separately bars a technology that uses a default setting instead of requiring an affirmative, freely given, and unambiguous consumer choice.

Oregon (OCPA): Effective July 1, 2024. Includes opt-out rights and requires recognition of universal opt-out mechanisms.

Montana (MTCDPA), New Jersey (NJDPA), Minnesota (MCDPA), Delaware (DPDPA), and Maryland (MODPA): Each of these states has since enacted a comprehensive privacy law that addresses opt-out preference signals, but the dates attached to them are not all the same kind of date, so read each one carefully. Montana must allow a consumer to opt out through a preference signal no later than January 1, 2025 (Mont. Code Ann. Sec. 30-14-2809(3)(b)), and Delaware no later than January 1, 2026 (6 Del. C. Sec. 12D-106(e)(1)); both of those are signal-recognition deadlines, not the dates the privacy laws themselves took effect. Minnesota's chapter took effect July 31, 2025 and carries the signal duty from that date (Minn. Stat. Sec. 325M.14, subd. 3). New Jersey also requires signal recognition, on a deadline set separately from its law's effective date. Maryland works differently: under Md. Code, Com. Law Sec. 14-4607, a controller may satisfy its opt-out duty either by providing a clear and conspicuous opt-out link or, on or before October 1, 2025, by honoring an opt-out preference signal, so the signal is one permitted method there rather than a standalone mandate. Maryland's act took effect October 1, 2025 and does not reach processing activities before April 1, 2026. More states are adding these requirements as their privacy laws take effect, so confirm the current list before finalizing a compliance program.

What a US-Compliant Banner Looks Like

A US cookie banner for California compliance typically includes:

  1. A notice that the site uses cookies and tracking technologies
  2. A link to the privacy policy
  3. A "Do Not Sell or Share My Personal Information" link
  4. A "Limit the Use of My Sensitive Personal Information" link (if applicable)
  5. GPC auto-detection that honors the signal without requiring user interaction

Unlike EU banners, US banners do not need to block cookies before the user makes a choice. Cookies may load by default, with the banner providing opt-out controls.

Side-by-Side Comparison: EU vs. US

RequirementEU (ePrivacy + GDPR)US (CCPA/CPRA + State Laws)
Consent modelOpt-in (prior consent required)Opt-out (default tracking, user can object)
Default cookie stateBlocked until consentActive until opt-out
Reject buttonRequired, equal to acceptNot required; opt-out link suffices
Pre-ticked boxesIllegal (Planet49 ruling)No prohibition
Granular categoriesRequiredNot required
GPC recognitionNot mandatory (supplemental)Mandatory in CA, CO, CT, DE, MN, MT, NJ, OR, TX; one of two permitted opt-out methods in MD (list growing)
"Do Not Sell" linkNot applicableOnly CA requires a link carrying that title; CO, CT, OR and MD require a clear and conspicuous opt-out link, and VA and TX require a clear and conspicuous opt-out disclosure
Consent recordsRequiredOpt-out request records required
Re-consent period6-12 months (varies by DPA)N/A (opt-out is persistent)
Maximum penalty20M euros / 4% turnover$7,988 per intentional violation, CPI-adjusted (CA, eff. Jan. 1, 2025)

Both EU and US website operators frequently make compliance errors in their cookie banner implementations.

Dark Patterns

Dark patterns are design choices that manipulate users into accepting cookies against their actual preference. Regulators across the EU have specifically targeted these practices.

Accept-only first layer. Displaying a prominent "Accept All" button on the first layer while requiring users to click through to a second layer to find the reject option. The CNIL, Italian Garante, and Austrian DSB have all found this non-compliant.

Color and size manipulation. Making the "Accept" button large and colorfully highlighted while displaying "Reject" or "Manage Preferences" as small gray text. The EDPB's guidelines on dark patterns specifically address visual manipulation of consent interfaces.

Confusing language. Using double negatives or unclear wording like "Do not opt out of not sharing" that confuses users about what they are agreeing to.

Consent fatigue exploitation. Requiring excessive clicks to reject cookies (e.g., toggling off each of 50 individual cookies) while offering a single "Accept All" button.

Many websites place analytics and advertising cookies before the user interacts with the banner. In the EU, this violates the prior consent requirement. Technically, no non-essential cookie should fire until the user clicks "Accept." This requires the consent management platform to block scripts until consent is given, often implemented through a tag manager that gates script execution on consent status.

Failing to log consent choices makes it impossible to demonstrate compliance during a regulatory audit. Every consent decision (accept, reject, or specific category selections) should be timestamped and stored.

Blocking access to the website entirely unless cookies are accepted is generally non-compliant in the EU. The EDPB has stated that "access to services and functionalities must not be made conditional on the consent of a user" to cookie placement. A few national authorities (notably the Netherlands) permit cookie walls under limited conditions, but the safest approach is to allow access regardless of consent choice.

Failing to Honor GPC in the US

Under the CCPA/CPRA, businesses must treat GPC signals as valid opt-out requests. Simply ignoring GPC because the user has not also clicked the "Do Not Sell" link is non-compliant. The California Attorney General's enforcement actions have specifically targeted businesses that failed to honor GPC.

A common question for EU-compliant websites is whether any analytics data can be collected without consent. The answer depends on the tool and the jurisdiction.

Server-Side Analytics

Server log analysis (IP addresses, page views, referrers) does not use cookies and therefore falls outside the ePrivacy Directive's cookie consent requirement. However, if IP addresses are considered personal data (they are, under the GDPR), a legal basis is still needed for that processing. Legitimate interest under GDPR Article 6(1)(f) may apply for basic server-side analytics if appropriate safeguards are in place.

Privacy-Preserving Analytics Tools

Some analytics tools are designed to operate without cookies or with only first-party, session-limited cookies. Tools like Plausible, Fathom, and self-hosted Matomo (in cookieless mode) can provide aggregate traffic data without requiring consent under most national implementations of the ePrivacy Directive.

The French CNIL explicitly allows first-party audience measurement cookies without consent under strict conditions: the data must be aggregated, not shared with third parties, used only for audience measurement, and limited in retention period. The tool must also allow users to opt out.

Google Analytics 4 (GA4) places cookies that transfer data to Google's servers in the United States. It requires consent in the EU under both the ePrivacy Directive (for cookie placement) and the GDPR (for the international data transfer to Google). The Austrian, French, and Italian data protection authorities have all ruled that Google Analytics transfers violate GDPR's data transfer rules, making it particularly important to gate GA4 on consent.

CCPA "Do Not Sell or Share" Integration

For websites that display both an EU cookie banner and US opt-out mechanisms, integrating the CCPA's "Do Not Sell or Share" requirement into the consent flow requires careful design.

Unified vs. Separate Interfaces

Some consent management platforms offer a unified interface that adapts based on the visitor's location. An EU visitor sees the full opt-in banner. A California visitor sees the "Do Not Sell or Share" mechanism. This approach simplifies the user experience and reduces banner fatigue for US visitors who are not subject to opt-in requirements.

GPC Auto-Detection

For visitors in California, Colorado, Connecticut, Oregon, Texas, Montana, New Jersey, Minnesota, Delaware, and Maryland, the website should automatically detect GPC browser signals and suppress advertising and data-sharing cookies without displaying any banner at all. If GPC is detected, the site should treat it as an opt-out and confirm this in its privacy center.

Multi-State Compliance

For US-wide compliance, a best-practice approach combines:

  1. A "Do Not Sell or Share My Personal Information" link (that exact title is required only by California, under Cal. Civ. Code Sec. 1798.135(a); CO, CT, OR, VA, TX and other states require a clear and conspicuous way to opt out, which such a link satisfies)
  2. GPC auto-detection (satisfies the universal opt-out mandates in CA, CO, CT, DE, MN, MT, NJ, OR and TX, and is one of Maryland's two permitted opt-out methods, a list that keeps growing)
  3. A "Your Privacy Choices" or "Your Opt-Out Rights" footer link (satisfies general notice requirements)
  4. Age-gating for users under 16 in California (opt-in consent required before selling minors' data)

Design Principles

  • Place the banner in a fixed position (bottom or center of the screen) that does not completely block content
  • Use clear, plain language at an 8th-grade reading level
  • Display accept and reject options with identical visual treatment (size, color, font weight)
  • Include a "Manage Preferences" option for granular control
  • Provide a persistent method to change preferences after initial choice (footer link or floating icon)

Technical Implementation

  • Use a consent management platform (CMP) that blocks non-essential scripts until consent
  • Integrate with your tag manager to gate script execution on consent status
  • Test that no tracking cookies fire before user interaction
  • Implement GPC detection for US visitors
  • Log all consent events with timestamps and version identifiers
  • Audit third-party scripts regularly, as they may introduce new cookies without notice

Accessibility

  • Ensure the banner is keyboard-navigable and screen-reader compatible
  • Maintain sufficient color contrast for all text and interactive elements
  • Provide focus indicators for interactive elements
  • Do not use auto-closing banners that disappear before assistive technology users can interact with them

This is general legal information, not legal advice. Cookie banner requirements depend on the specific jurisdictions your website serves, the types of cookies and tracking technologies used, and your organization's data processing activities. Consult a data protection attorney for advice specific to your situation.

Frequently Asked Questions

Does my website need a cookie banner in the US?

There is no federal US law requiring a cookie consent banner. However, if your website sells personal information or shares it for targeted advertising, California's CCPA/CPRA requires a 'Do Not Sell or Share My Personal Information' link. Other states (Colorado, Connecticut, Virginia, Texas, Oregon) have similar opt-out requirements. You may also need to display a banner to honor Global Privacy Control signals in states that mandate universal opt-out recognition.

Can I use a single cookie banner for both EU and US visitors?

Yes, but the banner should adapt based on the visitor's location. An EU visitor should see a full opt-in consent interface with accept and reject buttons of equal prominence. A US visitor should see a simpler notice with opt-out options. Most consent management platforms support geolocation-based banner display. Alternatively, you can apply the EU standard globally, which satisfies both sets of requirements but may reduce analytics and advertising data from US visitors.

What is the Global Privacy Control (GPC) and do I have to honor it?

GPC is a browser-level signal that communicates a user's opt-out preference. In California, businesses must honor GPC as a valid opt-out of the sale or sharing of personal information under the CCPA/CPRA. Colorado, Connecticut, Oregon, Texas, Montana, New Jersey, Minnesota, and Delaware also require recognition of universal opt-out mechanisms, while Maryland treats honoring the signal as one of two permitted ways to offer an opt-out. More states are adding this requirement as their own privacy laws take effect. If your website uses advertising cookies that share data with third parties, you must detect and honor GPC signals from visitors in these states.

Are pre-ticked cookie consent checkboxes legal?

Pre-ticked checkboxes are illegal for cookie consent in the EU. The Court of Justice of the EU ruled in Planet49 (Case C-673/17, October 2019) that consent must involve a clear affirmative action by the user, and a pre-ticked checkbox does not meet this standard. In the US, there is no specific prohibition on pre-ticked boxes, but manipulative consent interfaces could raise issues under FTC deceptive practices enforcement.

What counts as a dark pattern in a cookie banner?

Regulators identify several dark patterns: making the accept button visually dominant (larger, brighter) while minimizing the reject option; requiring multiple clicks to reject but only one click to accept; using confusing language or double negatives; hiding the reject option behind a 'Manage Preferences' link when 'Accept All' is displayed on the first layer; and continuously re-displaying the banner to users who previously rejected cookies. The EDPB and national DPAs like the CNIL have specifically sanctioned these practices.

Can I run Google Analytics without cookie consent in the EU?

No. Google Analytics 4 places cookies that transfer data to Google servers. EU data protection authorities (Austria, France, Italy) have specifically ruled that Google Analytics requires user consent under the ePrivacy Directive for cookie placement and the GDPR for the international data transfer. Privacy-preserving alternatives like Plausible, Fathom, or self-hosted Matomo in cookieless mode may operate without consent under some national implementations, particularly France's CNIL exemption for first-party audience measurement.

How often should I re-ask for cookie consent?

The ePrivacy Directive does not specify a re-consent interval. The French CNIL recommends re-requesting cookie consent every 6 months. Other national authorities suggest 12 months. You should also re-request consent whenever you add new cookie categories, change processing purposes, or update third-party data recipients. In the US, opt-out choices under the CCPA are generally persistent and do not need to be re-confirmed.

What penalties can I face for a non-compliant cookie banner?

In the EU, penalties can reach 20 million euros or 4% of global annual turnover under the GDPR, or lower amounts under national ePrivacy transpositions. France fined Google 150 million euros for cookie consent violations in 2021. In the US, the CCPA provides for penalties of up to $2,663 per unintentional violation and $7,988 per intentional violation, CPI-adjusted figures in effect since January 1, 2025 under Cal. Civ. Code Sec. 1798.155(a). California's AG and the CPPA have brought enforcement actions against businesses that failed to honor GPC or provide adequate opt-out mechanisms.

Updates

Corrected the multi-state opt-out details: only California requires a link titled 'Do Not Sell or Share My Personal Information,' the universal opt-out dates are now labeled as either signal-recognition deadlines or law effective dates, Maryland is described as allowing an opt-out link or a preference signal rather than mandating the signal, and the Texas signal duty now states the statutory conditions that limit it.

Added Texas and five more states (Montana, New Jersey, Minnesota, Delaware, Maryland) to this page's lists of states that require honoring the Global Privacy Control universal opt-out signal, updated the CCPA's penalty figures to the current CPI-adjusted amounts ($2,663 / $7,988, effective January 1, 2025), and replaced two dead CNIL links and one dead EDPB link with their current live URLs.

Independently fact-checked against the cited primary sources; governing law re-checked for recent changes

Reviewed and approved by an editor

Sources and References

  1. Directive 2002/58/EC - ePrivacy Directive(eur-lex.europa.eu).gov
  2. CJEU Case C-673/17 (Planet49)(curia.europa.eu).gov
  3. CNIL Cookie Guidelines(cnil.fr)
  4. Italy Garante Cookie Guidelines(garanteprivacy.it).gov
  5. EDPB Dark Patterns Guidelines(edpb.europa.eu).gov
  6. EDPB Consent Guidelines(edpb.europa.eu)
  7. California CCPA/CPRA(oag.ca.gov).gov
  8. CPPA Regulations(cppa.ca.gov).gov
  9. GDPR Regulation 2016/679(eur-lex.europa.eu).gov
  10. Cal. Civ. Code Sec. 1798.135(a): the only US provision mandating a homepage link titled 'Do Not Sell or Share My Personal Information'(leginfo.legislature.ca.gov)
  11. Va. Code Sec. 59.1-578(D): controllers must clearly and conspicuously disclose the processing and the manner of opting out, with no link title required(law.lis.virginia.gov)
  12. Tex. Bus. & Com. Code Secs. 541.055 and 541.103: authorized-agent opt-out signal conditions, the default-setting bar, and the opt-out disclosure duty(statutes.capitol.texas.gov)
  13. 6 Del. C. Sec. 12D-106(e)(1): opt-out link and, not later than January 1, 2026, recognition of an opt-out preference signal(delcode.delaware.gov)
  14. Mont. Code Ann. Sec. 30-14-2809: opt-out preference signal required no later than January 1, 2025(mca.legmt.gov)
  15. Minn. Stat. Sec. 325M.14, subd. 3: opt-out preference signal duty; chapter 325M effective July 31, 2025(revisor.mn.gov)
  16. Maryland SB 541 (Ch. 455, 2024) as enrolled, Maryland Online Data Privacy Act: opt-out link or preference signal as alternative methods, effective October 1, 2025(mgaleg.maryland.gov)
  17. Conn. Gen. Stat. Sec. 42-520(e)(1)(A): clear and conspicuous opt-out link plus opt-out preference signal recognition not later than January 1, 2025(cga.ct.gov)
Share: