US vs EU Cookie Consent Requirements: What Your Cookie Policy Needs to Say

A site with visitors on both sides of the Atlantic is, legally, running two different cookie regimes at once, and the two regimes do not just differ in wording. They start from opposite defaults. EU and UK law treats a cookie as off until a visitor turns it on. Most US state privacy law treats a cookie as on until a visitor turns it off. A cookie policy written for one default and shipped to both audiences is either over-blocking for US visitors or under-consenting for EU ones, and neither mistake is cosmetic.

The EU Standard: Consent Before the Cookie Fires

The EU’s cookie rule does not actually come from the GDPR. It comes from a narrower, older law: the ePrivacy Directive (2002/58/EC, as amended by 2009/136/EC), often called the “cookie law.” Article 5(3) requires consent before storing or accessing information on a visitor’s device, with a single exemption for cookies that are strictly necessary to deliver a service the visitor explicitly requested, a login session or a shopping cart, for example. Everything else, analytics, advertising, personalization, needs consent obtained before the cookie sets, not after.

GDPR supplies the definition of what counts as valid consent under that rule: freely given, specific, informed, and unambiguous, given through a clear affirmative action (Article 4(11) and Article 7). A pre-ticked checkbox does not meet that bar. The Court of Justice of the EU settled this directly in the Planet49 case (C-673/17, 2019), ruling that consent obtained through a box that was checked by default is not valid consent, because the visitor never actually did anything to grant it.

The European Data Protection Board has gone further on how the choice has to be presented, not just how it is recorded. Its guidance on “cookie walls” says a site generally cannot make accepting cookies a condition of accessing the content, and several national regulators, including France’s CNIL, have fined companies for making “reject” require more clicks than “accept.” In 2022, CNIL fined Google and Facebook a combined 210 million euros specifically for that asymmetry: an accept button in one click, a reject path buried several steps deeper. The UK runs a near-identical rule post-Brexit through the Privacy and Electronic Communications Regulations (PECR), enforced by the ICO, so a banner built to satisfy GDPR and ePrivacy generally satisfies UK visitors too without a separate build.

The US Standard: Disclose, Then Let People Opt Out

There is no federal law in the US that regulates cookies the way ePrivacy does. The FTC can act against deceptive or unfair practices under Section 5 of the FTC Act, and COPPA imposes an opt-in-style verifiable consent requirement specifically for sites directed at children under 13, but neither is a general cookie-consent statute. The operative rules instead come from the growing list of state comprehensive privacy laws, California’s CCPA and its CPRA amendments, Virginia’s CDPA, Colorado’s CPA, Connecticut’s CTDPA, and the states that followed them, and nearly all of them share the same structural choice: opt-out, not opt-in.

Under this model, a business can generally let analytics and advertising cookies fire without asking first. What the law requires instead is disclosure of what is collected and why, plus a working mechanism for a visitor to opt out of having their data “sold” or “shared” for targeted advertising, a definition broad enough in most of these statutes to cover the kind of third-party ad and analytics cookies a cookie policy already lists. California’s CCPA is explicit about the interface for this: a covered business has to post a “Do Not Sell or Share My Personal Information” link (or the newer combined “Your Privacy Choices” link) rather than gate the site behind a consent screen.

The newer state laws have added one wrinkle that pushes the US model slightly closer to the EU one without actually becoming opt-in: recognition of Universal Opt-Out Mechanisms. Colorado’s CPA and Connecticut’s CTDPA both require covered businesses to honor a browser-level opt-out signal, most commonly the Global Privacy Control (GPC), as a valid opt-out request the moment it is received, no separate visit to a preferences page required. That is still a visitor turning cookies off after the fact, not consenting before they turn on, but it does mean a US-facing cookie policy increasingly needs a sentence explaining that the site reads and honors GPC signals, not just a link to a manual opt-out form.

Why the Same Banner Can’t Serve Both Audiences

A banner built to the US opt-out standard, cookies fire immediately, a footer link lets a visitor opt out later, does not meet the EU bar for an EU visitor, because analytics and advertising cookies were already reading and writing to that visitor’s device before any choice was offered. Run the reverse: a banner built to the EU opt-in standard, blocking every non-essential cookie until a visitor actively accepts, is not required for a US visitor, but it is not a violation either. It is simply stricter than the law demands, since opt-in consent satisfies an opt-out requirement by definition, a visitor who never lands on the accept button has, functionally, opted out of everything.

That asymmetry is what makes the EU-style banner the common default for sites that would rather build once than build twice: an opt-in-everywhere banner is over-compliant for US traffic but never under-compliant for it. The tradeoff is friction. Blocking analytics for every visitor, including the ones under no legal obligation to see a blocking screen, costs a business real data, and it is a cost some sites decide is not worth carrying to avoid a second banner configuration.

The two paths that matter operationally are the geotargeted one, showing the EU-style blocking banner only to visitors detected in the EU or UK and the lighter US flow to everyone else, and the single global one, applying the EU-style flow to every visitor regardless of location. Geotargeting is more work to build and maintain, and it fails safely only if the fallback for an undetected or VPN-masked location defaults to the stricter path rather than the looser one.

What the Cookie Policy Document Itself Needs to Say Differently

The banner is the mechanism; the cookie policy is the disclosure that has to describe it accurately, and the two audiences need different sentences even when the underlying cookies are identical. An EU-facing section has to name the legal basis (consent), state that consent can be withdrawn at any time as easily as it was given, and describe what happens to already-set cookies once consent is withdrawn. A US-facing section instead has to name the specific right (to opt out of sale or sharing), explain how GPC signals are honored if the business recognizes them, and link to wherever the Do Not Sell/Share or Your Privacy Choices mechanism actually lives on the site. A policy that only speaks the EU’s consent language leaves US-specific rights undocumented, and a policy that only speaks the US opt-out language reads, to an EU regulator, like it never obtained consent at all.

Our Cookie Policy generator builds both sections from the same set of questions about what your site actually sets, so the finished document names the EU consent mechanism and the US opt-out rights separately instead of collapsing them into one paragraph that satisfies neither regulator fully. If you are still deciding whether a standalone cookie policy is the right document at all, or whether a shorter cookie section inside your privacy policy covers it, see Cookie Policy vs. Privacy Policy.

Putting It Together

Getting this right starts with knowing which cookies actually fire and when, not with picking banner software first. Audit the site the same way you would for any cookie policy, tool by tool, using the categories and testing method in Cookie Policy Requirements for Google Analytics and Ad Pixels, then decide whether geotargeting the banner is worth the added maintenance or whether applying the stricter EU-style opt-in flow everywhere is the simpler long-term choice. Whichever route a site takes, the cookie policy has to describe the actual mechanism a visitor in each audience will see, not a generic paragraph that assumes one set of rules covers both.