EU and US cookie consent: plan the visitor journey before the banner

For many European tracking uses, the starting point is prior opt-in consent. For a business covered by California's CCPA, a central requirement is enabling and honouring opt-outs from sale or sharing, including recognised browser signals. These are different mechanisms. Neither summary covers every exemption, sector or US state law.

The sensible starting point is your actual data use and applicable rules. Geography helps deliver the right experience once those decisions have been made.

Start with three questions

• Where are the people you serve, target or monitor?
• What information do your website and partners collect, and for which purposes?
• Which laws and platform policies apply to your business and those activities?

Being a US company does not by itself remove European obligations, and getting one Californian visit does not by itself establish every CCPA duty. Applicability depends on more than an IP address. Use the California Attorney General's CCPA guidance and the GDPR's territorial-scope provisions when reviewing the starting point with your adviser.

The European journey: a choice before relevant tracking

Consider an illustrative furniture shop using optional analytics and remarketing. A European visitor arrives with no saved consent. The site presents the relevant choices and controls the tools according to the selected setup.

The visitor allows analytics but refuses advertising. The implementation must preserve that distinction. A single “accepted” label that starts every vendor is not enough.

European cookie rules include national implementation and exemptions. Avoid copying a country-specific analytics exemption into every market. The EDPB consent guidelines provide the broader consent framework; local rules still need attention.

The California journey: make the opt-out work

Now imagine a covered business whose advertising practices involve sale or sharing as defined by the CCPA. A visitor uses the site's opt-out mechanism. The relevant downstream processing needs to respond; displaying a “Do Not Sell or Share” link alone is not the result.

Test the browser, tag manager and server-side destinations involved in that activity. Keep ordinary service functions separate from the advertising use so your team can explain what the choice changes.

The visitor who has already signalled a preference

Global Privacy Control, or GPC, lets a browser communicate an opt-out preference. California's Attorney General says covered businesses must honour it as a valid request to stop sale or sharing. See the official GPC explanation.

For your technical test, use a browser with GPC enabled and compare the relevant behaviour with a session without that signal. Do not assume that an on-page button is the only way a request arrives.

What geo-targeting can and cannot decide

Geo-targeting can select a banner or configuration based on an estimated location. It cannot decide your entire legal position, identify every sensitive use or guarantee that location detection is correct.

Document what happens when the location is unknown. Test that fallback, as well as the regions you expect to serve. Do not silently interpret an unknown location as permission for unrestricted tracking.

Also keep language separate. A visitor's preferred language does not establish which jurisdiction applies.

A practical brief for your developer

Write one short rule per visitor journey: expected banner, initial consent state, supported choices, affected vendors and expected behaviour after a change. Add a separate test for GPC where relevant.

For Google tags, specify Basic or Advanced Consent Mode rather than asking vaguely for “EU tracking”. Follow the Consent Mode guide for marketers and the four-state test to check the implementation.

Passiro includes geo-targeting and GPC support on Free. IAB GPP support is listed on paid plans. The plan overview helps you distinguish those capabilities; they are not interchangeable.