Cookie Consent, Tracking, and Privacy Law Requirements

Cookie consent and tracking privacy law requirements split along a clear line: in the European Union, websites cannot load marketing or analytics cookies until you actively say yes; in most of the United States, tracking begins by default and you have the right to opt out. More than 20 U.S. states now have comprehensive privacy laws on the books, and browser-level opt-out signals are pushing both systems toward more explicit, auditable consent.

The Two Consent Models

The EU’s General Data Protection Regulation defines consent as a “freely given, specific, informed and unambiguous indication” of the user’s wishes, delivered through a “clear affirmative action.”¹ You have to click a button or check an unticked box before a site can load non-essential cookies. Silence, pre-ticked boxes, and scrolling do not count. The ePrivacy Directive supplies the specific rule for the device: Article 5(3) prohibits placing cookies or reading stored information on your device unless you have consented or the cookie is strictly necessary for a service you asked for.²

Consent has to be “freely given,” which places real limits on pressure tactics. If a site blocks all its content until you accept tracking cookies, regulators treat that as coercion. The European Data Protection Board has said access to a website cannot be conditional on accepting cookies, and national authorities have issued enforcement decisions against these cookie walls.

The California Consumer Privacy Act runs the other direction. Businesses can collect and use your data by default, but any company that sells or shares personal information must display a conspicuous “Do Not Sell or Share My Personal Information” link, and it must stop selling or sharing your data once you use it.³ Twenty states now have comprehensive consumer data privacy laws, including Colorado, Connecticut, Virginia, Texas, and Oregon. Most follow a version of the opt-out model with rights to stop the sale of personal data and to opt out of targeted-advertising processing.

Which Cookies and Trackers Need Consent

Not every cookie triggers a consent requirement. Cookies strictly necessary to deliver a service you requested are exempt: session cookies that keep you logged in, security cookies during a financial transaction, and cookies that hold your shopping cart.⁴ The exemption is narrow. A cookie has to be genuinely necessary for the site to function, not just useful to the business.

Everything else needs opt-in consent under EU law. That includes analytics cookies that measure how visitors use a site, functional cookies that remember preferences like language, and marketing cookies that follow you across sites to build an advertising profile. The law also distinguishes first-party cookies (set by the site you are on) from third-party cookies (set by external domains embedded in the page). Third-party cookies are the primary tool behind cross-site behavioral advertising and draw the heaviest regulatory attention.

Beyond Cookies: Pixels, Fingerprinting, and Session Replay

The rules do not stop at traditional cookies. Tracking pixels are tiny images embedded in a page that report back when it loads. Fingerprinting scripts collect your browser type, screen resolution, installed fonts, and other device characteristics to identify you without ever storing a file. Session replay scripts record mouse movements, clicks, and keystrokes to reconstruct your session.⁵ Article 5(3) of the ePrivacy Directive covers “the storing of information, or the gaining of access to information already stored, in the terminal equipment” of a user, and regulators read that to include fingerprinting and pixel-based tracking alongside conventional cookies. If a technology reads from or writes to your device for tracking, it needs consent.

What a Compliant Cookie Banner Looks Like

The banner itself is regulated, not just the tracking behind it. The European Data Protection Board’s Cookie Banner Taskforce established that refusing cookies must be as easy as accepting them.⁶ A banner with a prominent “Accept All” button must offer an equally visible “Reject All” option at the same level of the interface. Burying reject behind a link at the bottom of a text block, hiding it outside the banner frame, or using color contrast to make accept pop while reject fades: all violations.

These manipulative designs are called dark patterns. A banner that takes one click to accept but three to reject is a textbook example. In the United States, the FTC has authority to pursue similar practices under Section 5 of the FTC Act, which declares unfair or deceptive acts in commerce unlawful.⁷ The commission does not need to prove intent to deceive, only that the overall impression would likely mislead a reasonable consumer.

One more rule matters: no tracking scripts can load before you make a choice. The default has to be “off” for analytics and marketing tools while the banner sits on screen. Loading a tracking pixel in the background while the banner is visible is a violation even if you eventually click accept. Consent comes first.

What Sites Must Disclose

Both the GDPR and U.S. state laws require transparency about what data is collected and why. Under Article 13 of the GDPR, when a site collects personal data from you directly, it must tell you the categories of data gathered, the specific purposes of each tracking technology, how long the data will be stored, and who will receive it.⁸ The disclosure appears in the cookie notice on your first visit and in the privacy policy.

Third-party sharing deserves special attention. If a site embeds advertising pixels or analytics scripts that send your data to outside companies, it has to identify those recipients or at least their categories.⁹ Vague language like “we share data with partners” does not satisfy the requirement. Disclosures also have to be written in plain, accessible language; a privacy policy stuffed with legal jargon can itself be a compliance violation. Under the storage limitation principle, personal data cannot be kept longer than necessary for the purpose it was collected.¹⁰ Most European data protection authorities recommend renewing cookie consent every 6 to 12 months.

Withdrawing Consent

Under the GDPR, you can withdraw consent at any time, and the withdrawal process has to be as simple as the process for giving it. A site that collects consent with one click has to let you revoke it with one click, not through a buried settings menu or an email to customer support.¹¹ Best practice is a persistent “Cookie Settings” link in the footer. Once you change your preferences, the site has to stop the data collection you revoked immediately.

Global Privacy Control

Global Privacy Control is a browser-level setting that automatically tells every site you visit that you want to opt out of data sales and sharing. Instead of clicking opt-out links one site at a time, GPC broadcasts your preference with every page load through the browser’s navigator.globalPrivacyControl property; a value of “1” means the user has opted out.¹²

California law requires covered businesses to honor GPC as a valid opt-out request.¹³ At least a dozen states, including Colorado and Texas, now mandate that businesses honor universal opt-out mechanisms. The California Attorney General has already brought enforcement actions against companies that failed to honor GPC signals.

Children and Sensitive Data

The Children’s Online Privacy Protection Act adds federal protection in the United States for anyone under 13. Commercial sites that collect personal information from children, or that know a user is under 13, must obtain verifiable parental consent before collecting, using, or sharing that data.¹⁴ “Personal information” under COPPA includes persistent identifiers like cookies and device IDs when used to track a child across sites. Approved consent methods include a signed and returned consent form, a credit card with transaction notifications, a call to a toll-free number staffed by trained personnel, video conference verification, or government-issued photo ID with facial recognition. For lower-risk situations where the operator will not share the child’s data, an email plus a follow-up confirmation can suffice.

California’s CCPA adds a separate layer: businesses cannot sell personal information of anyone they know to be under 16 without opt-in consent. For children under 13, the opt-in has to come from a parent or guardian. Teens between 13 and 15 can opt in themselves.³

Certain categories of data get heightened protection even within the opt-out framework. Under the CCPA, sensitive personal information covers Social Security numbers, financial account credentials, precise geolocation, contents of mail and text messages, genetic and biometric data, health information, sexual orientation, and information about racial or ethnic origin, religious beliefs, or union membership. As of 2025, the definition also includes neural data. When a business collects sensitive personal information, you can direct it to limit use to what is necessary for the service you requested. Once you exercise that right, the business cannot use or disclose the information beyond a narrow set of permitted purposes and has to wait at least 12 months before asking you to consent to broader use again.

Penalties

Violations of the GDPR’s core consent requirements fall under the higher penalty tier: up to €20 million or 4% of the company’s total worldwide annual turnover from the preceding year, whichever is greater.¹⁵ The tier covers violations of basic processing principles, consent conditions, data subject rights, and cross-border data transfers. A lower tier of up to €10 million or 2% of global turnover applies to other obligations, such as recordkeeping.

Under the CCPA, the California Privacy Protection Agency can impose administrative fines of up to $2,663 per violation, or $7,988 per intentional violation and per violation involving minors under 16.¹⁶ The per-violation structure matters: a site that improperly tracks 100,000 users faces aggregate exposure that adds up fast.

Courts can hold operators who violate the COPPA Rule liable for civil penalties of up to $53,088 per violation.¹⁷ The FTC weighs the number of children involved, the type and amount of personal information collected, whether it was shared with third parties, and the size of the company when setting the amount. Outside COPPA, the FTC can still pursue deceptive cookie practices, including misleading banners and dark patterns, under Section 5 of the FTC Act.⁷

Proving Consent Was Collected

Collecting consent is only half the obligation. Under the GDPR, the data controller bears the burden of demonstrating that valid consent was obtained. That means logging a timestamp for each consent event, the specific choices the user made by category, which version of the cookie notice or privacy policy was displayed, and how long the data will be retained. The record has to be updated every time the user changes preferences.

Controllers also have to maintain records of processing activities, including the purposes of processing, categories of personal data involved, categories of recipients, and applicable retention schedules.¹⁰ Organizations that cannot produce these records during a regulatory audit face enforcement risk regardless of whether the underlying tracking was properly consented to. Without the records, a regulator has no reason to take the controller’s word for it.

1
General Data Protection Regulation (GDPR). GDPR Article 4 – Definitions
2
European Data Protection Board. EDPB Guidelines 2/2023 on Technical Scope of Art. 5(3) of ePrivacy Directive
3
State of California – Department of Justice – Office of the Attorney General. California Consumer Privacy Act (CCPA)
4
Information Commissioner’s Office. Cookies and Similar Technologies
5
U.S. Department of Health and Human Services (HHS). Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates
6
European Data Protection Board. Report of the Work Undertaken by the Cookie Banner Taskforce
7
Office of the Law Revision Counsel. 15 USC 45 – Unfair Methods of Competition Unlawful
8
General Data Protection Regulation (GDPR). GDPR Article 13 – Information to Be Provided Where Personal Data Are Collected From the Data Subject
9
Information Commissioner’s Office. Right to Be Informed
10
General Data Protection Regulation (GDPR). GDPR Article 5 – Principles Relating to Processing of Personal Data
11
Information Commissioner’s Office. How Should We Obtain, Record and Manage Consent
12
Global Privacy Control. How to Implement Global Privacy Control (GPC) for Publishers
13
State of California – Department of Justice – Office of the Attorney General. Global Privacy Control (GPC)
14
eCFR. 16 CFR Part 312 – Childrens Online Privacy Protection Rule
15
General Data Protection Regulation (GDPR). GDPR Article 83 – General Conditions for Imposing Administrative Fines
16
California Privacy Protection Agency. California Privacy Protection Agency Announces 2025 Increases for CCPA Fines and Penalties
17
Federal Trade Commission. Complying with COPPA – Frequently Asked Questions