Reference
The regulations we implement against.
The consent model, the mechanism it requires and when it applied. A starting point, not legal advice; the guides in each area carry the detail and the sources.
| Regulation | Region | Model | What it requires | Since |
|---|---|---|---|---|
| GDPR | EU / EEA | Opt-in | Consent before non-essential processing; granular categories; equal-weight reject; consent records | In force May 2018 |
| ePrivacy Directive | EU / EEA | Opt-in | Article 5(3): consent before storing or reading anything on the device, cookies and beyond | 2002, amended 2009 |
| UK GDPR and PECR | United Kingdom | Opt-in | Same consent standard as the EU; PECR governs cookies and electronic marketing | UK GDPR from 2021 |
| CCPA / CPRA | California | Opt-out | Do Not Sell or Share; Global Privacy Control honoured; sensitive data limits | CCPA Jan 2020, CPRA Jan 2023 |
| US state laws | 19 states | Opt-out, with opt-in for sensitive data | Universal opt-out signals, sensitive data consent, thresholds by revenue and volume | 2023 onwards |
| LGPD | Brazil | Opt-in | Consent or another legal basis; regional variant on the EU architecture | In force Sept 2020 |
| PIPEDA and Law 25 | Canada / Quebec | Opt-in | Meaningful consent; Law 25 adds cookie consent and privacy-by-default in Quebec | Law 25 phased 2022 to 2024 |
| POPIA | South Africa | Opt-in | Consent or justification; direct marketing opt-in | In force July 2021 |
| PDPA | Singapore, Thailand | Opt-in | Consent-based with deemed consent and notification duties | 2012, amended 2020 |
| PIPL | China | Opt-in | Separate consent for sensitive data and cross-border transfer | In force Nov 2021 |
| DPDP | India | Opt-in | Consent through a notice; consent managers; rules phased in | Enacted Aug 2023 |
| TCF 2.2 | IAB Europe framework | Signal standard | Transparency and Consent string passed to ad-tech vendors | Current version 2023 |
| Consent Mode v2 | Google platforms | Signal standard | ad_storage, analytics_storage, ad_user_data, ad_personalization sent through the tag | Required in the EEA from March 2024 |
| EU AI Act | EU | Risk-based obligations | Governance and transparency duties by risk class; relevant where profiling meets consent | In force Aug 2024, phased |
See what fires before consent on your own site.
A free audit of your current banner and tags across regions, with the findings in writing and a 30-minute call to go through them.