Privacy laws we follow
These are the laws behind what the banner does, each linked to its official text. When a new law takes effect, banners switch over by themselves on that day. 8 laws take effect soon.
| Took effect | Where | Law | What visitors see |
|---|---|---|---|
| 1 Jan 2028Coming up | Vermont | Vermont Data Privacy and Online Surveillance Act, 9 V.S.A. ch. 61A | Opt-out link |
| 13 May 2027Coming up | India | Digital Personal Data Protection Act, 2023 Consent provisions take effect 18 months after the 13 Nov 2025 commencement notice. | Asks first |
| 13 May 2027Coming up | India | Digital Personal Data Protection Rules, 2025 | Asks first |
| 1 May 2027Coming up | Alabama | Alabama Personal Data Protection Act (HB 351, 2026) | Opt-out link |
| 1 Jan 2027Coming up | Louisiana | Louisiana Data Privacy Act, La. R.S. 51:1780.1 et seq. | Opt-out link |
| 1 Jan 2027Coming up | Oklahoma | Oklahoma consumer data privacy law (SB 546, 2026) | Opt-out link |
| 1 Dec 2026Coming up | Chile | Law 21.719 on the protection and processing of personal data Official text in Spanish. | Asks first |
| 1 Nov 2026Coming up | Egypt | Personal Data Protection Law No. 151 of 2020, arts. 1, 2 and 6, and its Executive Regulations (Decree 816 of 2025) The Executive Regulations were published on 1 Nov 2025 with a year to comply. Official text in Arabic (Official Gazette); the link is an English translation. | Asks first |
| 5 Feb 2026 | United Kingdom | Privacy and Electronic Communications Regulations 2003 (PECR), reg. 6 and Schedule A1 Rewritten by the Data (Use and Access) Act 2025; the consent rule applied from 2011. | Asks first |
| 1 Jan 2026 | California | CCPA Regulations, Cal. Code Regs. tit. 11, §7000 et seq. Current text in force from 1 Jan 2026, including §7025 on opt-out preference signals. | Opt-out link |
| 1 Jan 2026 | Indiana | Indiana Consumer Data Protection Act, Ind. Code art. 24-15 | Opt-out link |
| 1 Jan 2026 | Kentucky | Kentucky Consumer Data Protection Act (2024 Ky. Acts ch. 72) | Opt-out link |
| 1 Jan 2026 | Rhode Island | Rhode Island Data Transparency and Privacy Protection Act, R.I. Gen. Laws §6-48.1-1 et seq. | Opt-out link |
| 1 Jan 2026 | Vietnam | Law on Personal Data Protection No. 91/2025/QH15 Official text in Vietnamese. | Asks first |
| 1 Jan 2026 | Vietnam | Decree 356/2025/ND-CP detailing the Law on Personal Data Protection Official text in Vietnamese. | Asks first |
| 1 Oct 2025 | Maryland | Maryland Online Data Privacy Act, Md. Code Com. Law §14-4701 et seq. | Opt-out link |
| 14 Aug 2025 | Israel | Protection of Privacy Law (Amendment 13) and the Privacy Protection Authority's opinion on consent Amendment 13 in force 14 Aug 2025; the regulator's opinion on consent published 25 Feb 2026. Official text in Hebrew. | Small notice |
| 31 Jul 2025 | Minnesota | Minnesota Consumer Data Privacy Act, Minn. Stat. §325M.10 et seq. | Opt-out link |
| 1 Jul 2025 | Tennessee | Tennessee Information Protection Act, Tenn. Code Ann. §47-18-3201 et seq. Applies to businesses with over $25M in annual revenue that also meet data-volume thresholds. | Opt-out link |
| 30 Mar 2025 | Peru | Personal Data Protection Law (Law 29733) and its Regulation (DS 016-2024-JUS) The regulation in force from 30 Mar 2025 requires express, provable consent; continued browsing is not consent. | Asks first |
| 21 Mar 2025 | Mexico | Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP 2025) Tracking notice rule: Regulation art. 14. Official text in Spanish. | Notice, can turn off |
| 1 Feb 2025 | Liechtenstein | Communications Act of 5 April 2023 (KomG), Art. 61(4) Official text in German. | Asks first |
| 15 Jan 2025 | New Jersey | New Jersey consumer data privacy law, N.J.S.A. 56:8-166.4 et seq. Effective 365 days after its approval on 16 Jan 2024. | Opt-out link |
| 1 Jan 2025 | China | Network Data Security Management Regulations (State Council Decree No. 790) Official text in Chinese. | Asks first |
| 1 Jan 2025 | Delaware | Delaware Personal Data Privacy Act, Del. Code tit. 6, ch. 12D | Opt-out link |
| 1 Jan 2025 | Iowa | Iowa Consumer Data Protection Act, Iowa Code ch. 715D | Opt-out link |
| 1 Jan 2025 | Nebraska | Nebraska Data Privacy Act, Neb. Rev. Stat. §87-1101 et seq. | Opt-out link |
| 1 Jan 2025 | New Hampshire | New Hampshire privacy law, N.H. Rev. Stat. Ann. ch. 507-H | Opt-out link |
| 1 Jan 2025 | Norway | Electronic Communications Act (LOV-2024-12-13-76), §3-15 Official text in Norwegian. | Asks first |
| 10 Nov 2024 | Poland | Electronic Communications Law of 12 July 2024, art. 399 Replaced art. 173 of the Telecommunications Law, which applied from 2013. | Asks first |
| 1 Oct 2024 | Montana | Montana Consumer Data Privacy Act, Mont. Code Ann. §30-14-2801 et seq. | Opt-out link |
| 1 Jul 2024 | Florida | Florida Digital Bill of Rights, Fla. Stat. §501.701–501.722 Most duties apply only to businesses with over $1B in global revenue. | No banner |
| 1 Jul 2024 | Oregon | Oregon Consumer Privacy Act, ORS 646A.570–646A.589 | Opt-out link |
| 1 Jul 2024 | Texas | Texas Data Privacy and Security Act, Tex. Bus. & Com. Code ch. 541 Universal opt-out signals honoured from 1 Jan 2025. | Opt-out link |
| 31 Dec 2023 | Utah | Utah Consumer Privacy Act, Utah Code §13-61-101 et seq. Applies to businesses with over $25M in annual revenue. | Opt-out link |
| 22 Sept 2023 | Quebec | Act respecting the protection of personal information in the private sector (CQLR c. P-39.1), s. 8.1 Section 8.1 added by Law 25 (2021, c. 25). | Asks first |
| 14 Sept 2023 | Saudi Arabia | Personal Data Protection Law (Royal Decree M/19, amended by M/148) Compliance required from 14 Sep 2024 after a one-year grace period. | Asks first |
| 1 Jul 2023 | Colorado | Colorado Privacy Act, Colo. Rev. Stat. §6-1-1301 et seq. Universal opt-out signals honoured from 1 Jul 2024. | Opt-out link |
| 1 Jul 2023 | Connecticut | Connecticut Data Privacy Act, Conn. Gen. Stat. §42-515 et seq. Opt-out preference signals honoured from 1 Jan 2025. | Opt-out link |
| 12 Jun 2023 | Nigeria | Nigeria Data Protection Act, 2023 | Asks first |
| 1 Jan 2023 | Virginia | Virginia Consumer Data Protection Act, Va. Code §59.1-575 et seq. | Opt-out link |
| 10 Nov 2022 | Slovenia | Electronic Communications Act (ZEKom-2), art. 225 Official gazette text in Slovenian. | Asks first |
| 17 Oct 2022 | Indonesia | Law 27/2022 on Personal Data Protection Compliance required from 17 Oct 2024 after a two-year transition. Official text in Indonesian. | Asks first |
| 1 Sept 2022 | Iceland | Electronic Communications Act No. 70/2022, art. 88(2) Official text in Icelandic. | Asks first |
| 12 Jul 2022 | Croatia | Electronic Communications Act (NN 76/2022), art. 43(4) Official gazette text in Croatian. | Asks first |
| 22 Jun 2022 | Sweden | Electronic Communications Act (2022:482), ch. 9 §28 The rule applied under the 2003 Act from 2011. Official text in Swedish. | Asks first |
| 1 Jun 2022 | Thailand | Personal Data Protection Act B.E. 2562 (2019) English translation published by the Ministry of Digital Economy and Society. | Asks first |
| 1 Feb 2022 | Slovakia | Electronic Communications Act No. 452/2021 Coll., §109(8) Official text in Slovak. | Asks first |
| 10 Jan 2022 | Belgium | Law of 30 July 2018 on the protection of personal data, art. 10/2 Replaced art. 129 of the Electronic Communications Law, which applied from 2012. | Asks first |
| 1 Jan 2022 | Czechia | Electronic Communications Act No. 127/2005 Coll., §89(3) Opt-in since 2022; before then the rule was opt-out. | Asks first |
| 1 Dec 2021 | Germany | Telecommunications Digital Services Data Protection Act (TDDDG), §25 Named TTDSG until May 2024. | Asks first |
| 1 Dec 2021 | Lithuania | Law on Electronic Communications, art. 73(4) The rule applied under the former art. 61(3) from 2011. Official text in Lithuanian. | Asks first |
| 1 Nov 2021 | Austria | Telecommunications Act 2021 (TKG 2021) §165(3) Official text in German. The rule applied under TKG 2003 §96(3) from 2011. | Asks first |
| 1 Nov 2021 | China | Personal Information Protection Law English translation from the National People's Congress. | Asks first |
| 18 Sept 2020 | Brazil | Lei Geral de Proteção de Dados Pessoais (Law 13.709/2018) Official text in Portuguese. | Asks first |
| 1 Jul 2020 | South Africa | Protection of Personal Information Act 4 of 2013 (POPIA) Enforced from 1 Jul 2021 after a one-year grace period. | Asks first |
| 1 Jan 2020 | California | California Consumer Privacy Act, Cal. Civ. Code §1798.100 et seq. Amended by the CPRA from 1 Jan 2023. | Opt-out link |
| 25 May 2018 | European Union | General Data Protection Regulation (EU) 2016/679, arts. 4(11) and 7 (what counts as consent) | Asks first in every EU country |
| 7 Apr 2016 | Turkey | Law on the Protection of Personal Data No. 6698 (KVKK) English text from the KVKK; the Turkish text governs. | Asks first |
| 1 Jan 2015 | Finland | Act on Electronic Communications Services (917/2014), §205 The rule applied under the previous Act from 2011. | Asks first |
| 2 Jul 2014 | Singapore | Personal Data Protection Act 2012 PDPC Advisory Guidelines on Selected Topics (rev. May 2024), paras 7.7 to 7.14, cover cookies. | Small notice |
| 1 Jan 2013 | Malta | Processing of Personal Data (Electronic Communications Sector) Regulations (S.L. 586.01), reg. 5 | Asks first |
| 18 Oct 2012 | Colombia | Statutory Law 1581 of 2012 on personal data protection Official text in Spanish. | Asks first |
| 30 Aug 2012 | Portugal | Law 41/2004 on privacy in electronic communications, art. 5 Official text in Portuguese. | Asks first |
| 5 Jun 2012 | Netherlands | Telecommunications Act, art. 11.7a Official text in Dutch. | Asks first |
| 1 Jun 2012 | Italy | Personal Data Protection Code (Legislative Decree 196/2003), art. 122 Official text in Italian. | Asks first |
| 18 May 2012 | Cyprus | Regulation of Electronic Communications and Postal Services Law 112(I)/2004, art. 99(5) Consolidated text on CyLaw (Cyprus Bar Association), in Greek. | Asks first |
| 10 Apr 2012 | Greece | Law 3471/2006 on privacy in electronic communications, art. 4(5) Consolidated text from the Hellenic Data Protection Authority, in Greek. | Asks first |
| 1 Apr 2012 | Spain | Information Society Services Act (Law 34/2002, LSSI), art. 22.2 Official text in Spanish. | Asks first |
| 29 Dec 2011 | Bulgaria | Electronic Commerce Act, art. 4a Consolidated text from the Ministry of Transport and Communications, in Bulgarian. | Asks first |
| 14 Dec 2011 | Denmark | Cookie Order (Executive Order No. 1148 of 9 Dec 2011), §3 Official text in Danish. | Asks first |
| 30 Sept 2011 | South Korea | Personal Information Protection Act Official English translation of the 2023 version; the Korean text is current to 2026. | Opt-out link |
| 1 Sept 2011 | Luxembourg | Law of 30 May 2005 on data protection in electronic communications, art. 4(3)(e) Official text in French. | Asks first |
| 26 Aug 2011 | France | Data Protection Act (Loi Informatique et Libertés), art. 82 Official text in French. | Asks first |
| 1 Jul 2011 | Ireland | ePrivacy Regulations 2011 (S.I. No. 336/2011), reg. 5(3) | Asks first |
| 8 Jun 2011 | Latvia | Information Society Services Law, Section 7.1 | Asks first |
| 25 May 2011 | European Union | ePrivacy Directive 2002/58/EC, art. 5(3), as amended by Directive 2009/136/EC Deadline for EU countries to bring the consent rule into national law. | Asks first in every EU country |
| 1 Apr 2007 | Switzerland | Telecommunications Act (SR 784.10), art. 45c Requires telling visitors and letting them refuse. | Asks first |
| 1 Jan 2005 | Estonia | Electronic Communications Act, §102(3)–(4) No explicit cookie-consent rule; the regulator applies GDPR consent to cookies. | Asks first |
| 1 Jan 2004 | Canada | Personal Information Protection and Electronic Documents Act (S.C. 2000, c. 5) In force federally from 1 Jan 2001; covers most businesses' websites from 1 Jan 2004. | Notice, can turn off |
| 2 Nov 2000 | Argentina | Law 25.326 on the Protection of Personal Data Consent must be free, express and informed (art. 5). Official text in Spanish. | Asks first |
| 28 Aug 1999 | Chile | Law 19.628 on the Protection of Private Life In force until Law 21.719 applies on 1 Dec 2026. Official text in Spanish. | Asks first |
No law matches that.
Court decisions we follow
Rulings that decide how the rules above apply.
- Planet49, C-673/17Court of Justice of the EU, 1 Oct 2019
Consent to cookies has to be an active choice: a pre-ticked box isn’t consent. The rule covers anything stored on a visitor’s device, personal data or not.
Nothing optional can be switched on by default, which is why the banner starts with everything off.
- Fashion ID, C-40/17Court of Justice of the EU, 29 Jul 2019
A site that embeds a third party’s plugin (here Facebook’s Like button) shares responsibility for the data the plugin sends when the page loads.
Embedded videos, maps and social buttons are your responsibility too, which is why the banner holds them until a visitor agrees.
- 3 O 17493/20Munich Regional Court I (LG München I), 20 Jan 2022
Loading Google Fonts from Google’s servers sent visitors’ IP addresses to Google without a legal basis, because the site could have hosted the fonts itself. The site owner paid €100 in damages. It is one German court’s decision, not an EU-wide ruling.
Host web fonts on your own site. Our checks flag fonts loaded from Google, and a banner can’t fix this one: the font loads before anyone could answer.
Rules version 2026.09.4. Each link goes to the official text, on a legislature’s site, an official gazette or EUR-Lex. We follow published law and regulators’ guidance, and this page is not legal advice. If you spot something out of date, write to hello@flatconsent.com.