# CookieHub - full text > The text of every product, feature and regulation page on https://www.cookiehub.com, in English. The index of all pages, including the blog and legal pages, is at https://www.cookiehub.com/llms.txt. ## CookieHub at a glance - Company: CookieHub ehf., Reykjanesbær, Iceland - Certifications: Google Certified CMP Partner, ISO 27001, IAB TCF Certification - Free trial: 14 days on any paid plan, no credit card required ([register](https://www.cookiehub.com/register)) - Regulations with dedicated guides: [GDPR (European Union)](https://www.cookiehub.com/gdpr), [CCPA (California)](https://www.cookiehub.com/ccpa), [CPA (Colorado)](https://www.cookiehub.com/cpa), [FDBR (Florida)](https://www.cookiehub.com/fdbr), [VCDPA (Virginia)](https://www.cookiehub.com/vcdpa), [LGPD (Brazil)](https://www.cookiehub.com/lgpd), [CNIL (France)](https://www.cookiehub.com/cnil), [POPIA (South Africa)](https://www.cookiehub.com/popia), [PDPL (Saudi Arabia)](https://www.cookiehub.com/pdpl) ### Pricing Monthly or annual billing, prices excluding VAT. Source: [https://www.cookiehub.com/pricing](https://www.cookiehub.com/pricing). - Starter, up to 5.000 sessions: €6/month or €66/year; $7/month or $77/year - Basic, up to 30.000 sessions: €10/month or €110/year; $12/month or $132/year - Business, up to 120.000 sessions: €30/month or €330/year; $35/month or $385/year - Business, up to 250.000 sessions: €55/month or €605/year; $65/month or $715/year - Business, up to 500.000 sessions: €85/month or €935/year; $100/month or $1100/year - Business, up to 1.000.000 sessions: €120/month or €1320/year; $140/month or $1540/year - Enterprise, from 1.000.000 sessions: custom pricing on request --- # CookieHub - Cookie Consent Management Platform (CMP) URL: https://www.cookiehub.com/ Last updated: September 24, 2026 ## We make it simple to stay compliant everywhere. Set up once, stay compliant globally. CookieHub automatically handles GDPR, CCPA, and 30+ other regulations so you can stop worrying and get back to building. ### Compliance on autopilot - so your team can focus on what matters Privacy regulations change constantly. CookieHub keeps you ahead of them automatically - no manual updates, no compliance anxiety. **Always know what's running on your site** Automate cookie scanning to identify the cookies and trackers you’re using and remove regulatory blind spots. - Automate cookie detection and categorization - Cut your compliance risk - Gain accuracy and visibility **Serve region-specific consent banners** Eliminate the guesswork on data privacy compliance and serve geo-targeted cookie banners across your global websites. - Serve correct location-based consent banner - Ensure full and effortless compliance - Customize banner language, layout, and behavior **Customize the consent experience with UI and branding** Support a consistent brand identity and user experience with customized consent UI and cookie consent banners. - Apply your branding to the consent experience - Create personalized user experiences - Improve trust and consent rates through customization Ready in minutes ### Get started with your favourite tools and platforms CookieHub is built to work with the tools you already trust. As a certified Google CMP partner, we offer seamless support for Google Tag Manager, Consent Mode V2, and IAB TCF v2.4 - helping you stay ahead of regulatory updates with minimal effort. Whether you manage your site through a CMS or deploy scripts via a tag manager, integrating CookieHub is as easy as pasting your custom code snippet into your site’s head or configuring it in GTM. **For Enterprise** Do you run high-traffic websites, multiple brands, or privacy operations across regions? **The CMP built for enterprise security and scale:** - ISO 27001 certified - Enterprise SSO with OIDC and SAML (Microsoft Entra ID, Google Workspace) - DSAR management for data subject requests - Configuration and advanced consent reports via API - Implementation, customization and optimization services - Trusted by monday.com, Semrush and Dealfront **For Publishers** Are you a digital publisher, content network, or media outlet focused on ad monetization? **The CMP focused on compliance & revenue retention:** - IAB TCF 2.4 support - Certified by IAB Europe - Automatic detection of ad tech vendors - Optimize fill rates and maintain user trust - Smart analytics to monitor consent drop-offs - Easy multi-property and language management **For Agencies** Do you manage multiple client websites or campaigns across regions? **The CMP designed for scale and control:** - Centralized dashboard to manage all clients - Whitelabel options for custom branding - Consent record archiving and audit-ready reporting - Quick deployment across multiple CMSs - Developer-friendly SDKs and APIs - 30% partner discount on every paid domain **For Developers** Are you building privacy-conscious apps, platforms, or websites? **The CMP built for developers who need full control:** - Lightweight, async-loaded scripts - Full compatibility with JavaScript and major Tag Managers - APIs for dynamic, real-time consent logic - Event-level consent triggers for granular control - Support for modern SPA frameworks (React, Gatsby) - Clear, developer-focused documentation ### Features Designed for Seamless Privacy Compliance All the tools you need CookieHub includes a wide range of built-in capabilities that make it easy to meet privacy regulations, optimize ad and analytics performance, and deliver a smooth user experience. From compliance to customization, every feature is designed to work together effortlessly—so you don’t have to worry about the details. **Built-in support for Google Consent Mode V2** Seamlessly manage user consent with native support for Google Consent Mode, ensuring regulatory compliance while keeping Google ads and analytics services running smoothly. **Microsoft UET Consent Mode support** Manage user consent for Microsoft Universal Event Tracking Consent Mode, optimizing Microsoft Ads and ad tracking while ensuring compliance with data privacy policies and regulations. **TCF 2.4 Compliance** Promote transparency by allowing users to make informed choices about data processing and advertising preferences. **Accessibility & WCAG 2.2 compliance** Provide an inclusive user experience with a consent banner that meets the latest WCAG 2.2 accessibility standards. **Enterprise SSO (OIDC & SAML)** Integrate CookieHub with enterprise identity providers using secure Single Sign-On authentication. **Geo-targeting & regional compliance** Ensure full regulatory compliance with a consent banner that automatically adapts to regional laws based on users’ geo location. **We speak your language** Reach global audiences with automatic support for 62 languages, delivering consent banners in the user’s preferred language. **Get detailed analytics & consent log** Gain insights into user behavior and compliance with in-depth analytics and a secure, exportable, and easily auditable consent log. **Auto-blocking for scripts & tags** Automatically prevents non-compliant scripts from firing before consent is given. **Multi-site & multi-environment management** Manage all your domains, staging environments, and regions from one unified dashboard. **High-performance, lightweight implementation** Designed for speed—adds minimal load time and ensures a smooth UX across devices. **Flexible, fully customizable designs** Brand everything exactly as you want: layouts, styles, transitions, messaging, and logic. ### Protect your ad revenue with a Google-certified CMP CookieHub is an official Google Certified CMP - meaning your Google Ads and Analytics data stays accurate even after users make consent choices. Don't let non-compliance silently drain your marketing ROI. --- # CookieHub Pricing | Global Privacy & Cookie Consent for 30,000+ Sites URL: https://www.cookiehub.com/pricing Last updated: September 24, 2026 **The Agency & Partner Program** **Scale your business with professional compliance tools and recurring discounts.** Specifically designed for web developers and agencies managing multiple client sites. CookieHub provides the flexibility to grow your margins while ensuring your clients stay compliant. - **30% Partner Discount:** Get an automatic 30% discount on every paid domain in your account. - **Mix & Match Plans:** Assign different tiers (Free, Starter, Basic, or Business) to different clients under one centralized dashboard. - **Bulk Configuration Management:** Apply compliance and configuration changes across multiple domains simultaneously. - **White-Label Branding:** Remove the "Powered by CookieHub" link and use custom CSS for a fully branded experience. - **Centralized Billing:** Manage your entire portfolio with one consolidated monthly or annual invoice. **Enterprise Privacy Platform** **Customized compliance and dedicated support for high-volume organizations.** Built for large-scale websites and organizations requiring advanced privacy operations, technical automation and enterprise-grade compliance infrastructure. - **Enterprise SSO: **Integrate with Microsoft Entra ID, Google Workspace and custom identity providers using OIDC or SAML. - **DSAR Management: **Streamline Data Subject Access Requests with centralized request handling, tracking and compliance workflows. - **Advanced Consent Reports: **Access granular data on user interactions, consent rates and regional performance. - **Full API Access: **Automate compliance workflows and manage configurations through our backend API. - **Dedicated Account Management: **Receive priority support, onboarding assistance and technical reviews. - **Custom Agreements: **Support for custom Master Service Agreements (MSA) and Service Level Agreements (SLA). #### Frequently Asked Questions **How are sessions calculated?** A session is counted when a visitor loads your website and the CookieHub widget initializes. A single visitor can browse multiple pages within one session without increasing your count, making our plans much more cost-effective than "per-pageview" models. **What happens if I exceed my monthly session limit?** - **Paid plans:** If your subscription exceeds its included session limit for two consecutive billing periods, it will automatically move to the appropriate plan. Your consent banner remains active. - **Enterprise:** We will contact you if your usage requires an adjustment to your plan. - **Free:** If you exceed the included session limit, the consent banner will stop showing until you upgrade to a paid plan. **What happens when my trial ends?** You can try any premium plan for free. When the trial expires, you can choose to subscribe to keep your premium features. If you decide not to upgrade, your account will automatically revert to the Free plan. **Is VAT included in the price?** All our prices are listed excluding VAT. Customers located outside Iceland will not be charged VAT and is subject to the reverse charge rule in the country of receipt. Icelandic companies and residents will be charged 24% VAT. **What payment methods do you accept?** We accept all major credit cards (Visa, Mastercard, American Express) and PayPal. For Enterprise customers, we also support bank transfers and manual invoicing upon request. **Can I cancel my subscription at any time?** Yes. You can cancel through your dashboard whenever you like. You will maintain access to your paid features until the end of your current billing period, after which the domain will revert to the Free plan. **How does the 30% Reseller discount work?** Approved partners receive an automatic **30% flat discount** on all premium domains. You have the flexibility to "Mix & Match" plans, assigning different tiers (Basic, Business, etc.) to different clients within one centralized dashboard. **Do you offer a discount for Non-Profit Organizations?** Registered non-profits receive a 50% lifetime discount on all premium plans - because good organizations deserve affordable compliance. Email our support team with your registration details to claim it. **How does CookieHub pricing compare with other consent platforms?** Each vendor counts something different: CookieHub and Usercentrics count sessions, Cookiebot subpages, iubenda and CookieYes page views, Termly banner views, Complianz licenses per site, and OneTrust prices on request. Our [comparison pages](https://www.cookiehub.com/compare) set out each vendor's published prices and plan features side by side, including where the other product is stronger. ### Official Google Certified CMP Experience the power of a Google-certified Consent Management Platform, engineered to meet the highest global standards for privacy and data accuracy. --- # About Us URL: https://www.cookiehub.com/about Last updated: July 2, 2026 ## About us CookieHub is a company that offers tools and services for managing cookies and online privacy. The company’s mission is to help website owners and publishers comply with privacy regulations and protect their visitors’ personal data. CookieHub offers a range of products and services, including a cookie consent banner and a cookie audit tool. These tools help website owners and publishers to meet their legal obligations, such as obtaining consent from visitors for the use of cookies, and to provide transparent and easily accessible information about their cookie policies. CookieHub was founded in 2018 and is based in Iceland. The team at CookieHub is dedicated to providing high-quality tools and services that make it easy for website owners and publishers to comply with privacy regulations and protect their visitors’ personal data. The company values innovation, transparency, and customer service, and is committed to helping its customers succeed online. **Company Information** **Postal address:** CookieHub ehf. Hafnargata 55 230 Reykjanesbær Iceland **Registration number:** 680121 1090 **VAT number:** IS-140256 --- # About Cookies URL: https://www.cookiehub.com/about-cookies Last updated: July 2, 2026 ## About Cookies Cookies are small pieces of data that are sent from a website and stored in your web browser’s memory. They are often used by websites to help them function properly, as websites are stateless and do not remember user information from one page to another. However, cookies can also be used to track user actions within a website or across multiple websites, in order to collect usage data and identify user interests and behavior. This information can then be used to display relevant advertisements to users. When websites use the CookieHub Consent Management Platform (CMP), they give users the option to allow or deny certain categories of cookies. This helps to protect users’ privacy. The most common categories of cookies are necessary cookies, preference cookies, analytical cookies, and marketing cookies. #### Necessary cookies Necessary cookies are used to make a website function properly, and are generally not used for tracking. They are often used for user authentication, so that a website can remember who is logged in when the user navigates to different pages or refreshes the site. Necessary cookies can also be used to keep track of items in a shopping cart, or to provide load balancing information. #### Preference cookies Preference cookies are used to remember information that customizes how a website looks or behaves for each user. This may include storing the user’s preferred language, region, currency, or color theme. #### Analytical cookies Analytical cookies are not essential, but they are used to collect valuable information on how a website is being used. This information can help identify issues and figure out what needs to be improved on the site, as well as what content is useful to users. In most cases, the information collected by analytical cookies is anonymous, but some analytics services may collect information that can be used to identify the user. #### Marketing cookies Marketing cookies are used to track users across multiple websites, in order to allow publishers to display relevant and engaging advertisements. These cookies are typically used by advertising networks to target users with advertisements that are likely to be of interest to them. **Get 14 days free!** Experience the benefits of our cookie management solutions risk-free! Sign up for any of our plans and receive the first 14 days free. **Compare our plans** CookieHub is a subscription service that offers flexible pricing plans to suit the needs of websites of all sizes. Find the plan that works for you. --- # CookieHub Affiliate Program | Earn 30% Recurring Commission URL: https://www.cookiehub.com/affiliate Last updated: April 1, 2026 ## Partner with CookieHub Deliver simple compliance to your audience while building a steady stream of recurring income. Promote the world’s most trusted CMP and earn a 30% lifetime commission on every referral. We handle the technical updates and support while you focus on growing your revenue. ### Why Partner with CookieHub? Simple, transparent, and built for long-term passive income. **30% Lifetime Commission:** We don't just pay you once. You receive 30% of the subscription fee for every month or year your referral stays with us—forever. **The "Give 10, Get 30" Advantage:** Every affiliate gets a unique coupon code. Your audience gets a 10% discount, and you get a 30% commission. It’s a win-win that drives higher conversion rates. **Hands-Off Income:** We take care of the heavy lifting. From technical support and security updates to global compliance tracking and billing, we handle everything while you collect the rewards. **Zero Barrier to Entry:** It’s free to join and takes seconds to set up. Whether you have a massive following or a niche blog, you can start earning immediately. **Trusted by 30,000+ Sites:** Recommend a product you can be proud of. CookieHub is a Google Certified CMP used by top agencies and developers worldwide. ### How it Works Start earning in three simple steps. Our affiliate system is built into your standard CookieHub account, making it easy to track your growth in real-time. **Join with One Click** Log into your CookieHub account, navigate to the **Affiliate** tab, and click "Join." Your unique referral link and 10% discount coupon will be generated instantly. **Share with Your Audience** Place your link in blog posts, newsletters, YouTube descriptions, or on your website. Use your custom coupon code to give your followers an extra incentive to sign up. **Collect Your Payouts** Track your clicks, sign-ups, and commissions through your dedicated affiliate portal. Once your balance reaches **€100**, you can request a payout via PayPal or Wire Transfer (IBAN/SWIFT). ### Who is this for? Our program is built for professionals and creators who want to offer their audience a high-performance compliance tool without the complexity. It is the perfect fit for anyone helping others navigate the modern web: - **Bloggers & Publishers:** Add value to your compliance or tech tutorials. - **Marketing Consultants:** Recommend a reliable CMP to your clients who prefer to handle their own billing. - **Influencers:** Share your link on social media or in your "Tools I Use" list. - **Course Creators:** Include CookieHub in your web development or digital marketing curriculum. #### Frequently Asked Questions **How do I track my referrals?** When a user clicks your link, a tracking cookie is placed in their browser. If they sign up for a paid plan—even if it's not immediately—the domain is permanently linked to your affiliate account. **Can I be both a Reseller and an Affiliate?** Absolutely. Many partners use the Reseller program for clients they manage directly and the Affiliate program for one-off referrals or followers who want to manage their own accounts. **When do I get paid?** Payouts are processed monthly upon request. Once your accumulated commission reaches €100, you can initiate a payout through your dashboard. **Is there a limit to how much I can earn?** No. There is no cap on the number of referrals you can bring in or the amount of commission you can earn. As long as your referrals remain active customers, you keep earning. **Can I use my affiliate link for my own domains?** The affiliate program is designed for referring new, third-party customers. For your own domains or domains you manage for clients, the [Reseller Program](https://www.cookiehub.com/reseller) is the best fit. --- # Amazon Consent Signal for Amazon Ads with CookieHub URL: https://www.cookiehub.com/amazon-consent-signal Last updated: October 12, 2026 ## Amazon Consent Signal with CookieHub The Amazon Consent Signal (ACS) is Amazon’s own format for telling Amazon Ads whether a visitor has consented to advertising. Amazon Ads only accepts personal data about visitors from the UK and the European Economic Area (EEA) when it comes with a valid consent signal. CookieHub supports the Amazon Consent Signal from version 2.9.1. Turn it on under Integrations in your domain’s settings, and CookieHub passes each visitor’s choice to Amazon Ads automatically. ### When you need the Amazon Consent Signal You need it if you use Amazon Ads, such as the Amazon Ad Tag, for visitors in the UK or the EEA, and your website does not use IAB TCF in those regions. Amazon accepts an IAB TCF consent string, a Global Privacy Platform (GPP) string or the Amazon Consent Signal, and only one is needed. If more than one is present, Amazon uses the TCF consent string. On websites that do not use IAB TCF, CookieHub sends the Amazon Consent Signal. ### What CookieHub sends to Amazon The Amazon Consent Signal has two parameters, each set to GRANTED or DENIED. CookieHub sets both from the visitor’s choice for the Marketing category: **amzn_ad_storage:** whether advertising cookies, or similar technologies, can be read and written on the visitor’s device. **amzn_user_data:** whether Amazon can process the visitor’s personal data, such as advertising identifiers, for advertising. **DENIED until the visitor chooses:** both parameters stay DENIED until the visitor makes a choice. The Analytics, Preferences and Necessary categories are not used by Amazon. ### How to set it up **If CookieHub is installed with its script tag:** 1. Add the CookieHub script to the head section of your website. 1. Enable Amazon Consent Signal under Integrations in your domain’s Settings tab, and click Save & publish. Consent signals are then applied automatically when visitors accept or reject cookies. **If CookieHub is installed with Google Tag Manager:** 1. In your GTM container, add a new tag and choose the CookieHub CMP template from the Community Template Gallery. 1. Enter your CookieHub domain code. 1. Set the trigger to Consent Initialization - All Pages, then save and publish. 1. Enable Amazon Consent Signal under Integrations in your domain’s Settings tab, and click Save & publish. You do not need to change your Amazon Ad Tag. If your website uses a Content Security Policy, allow scripts from https://c.amazon-adsystem.com. ### Websites that use IAB TCF In regions where IAB TCF applies, CookieHub does not send the Amazon Consent Signal, because Amazon reads the TCF consent string instead. If you use [IAB TCF 2.4](https://www.cookiehub.com/iab-tcf-v24), make sure Amazon is one of the vendors in your IAB TCF settings. ### Frequently asked questions **Does CookieHub support the Amazon Consent Signal?** Yes, from CookieHub version 2.9.1. Enable it under Integrations in your domain’s Settings tab, and CookieHub sends the signal to Amazon Ads automatically. **Do I need the Amazon Consent Signal if I already use IAB TCF?** Not in the regions where you use IAB TCF. Amazon accepts the TCF consent string instead, and uses it when both are present. Make sure Amazon is one of the vendors in your IAB TCF settings. **Which CookieHub category controls the Amazon Consent Signal?** Marketing. When a visitor accepts Marketing cookies, CookieHub grants both Amazon Consent Signal parameters. Until the visitor makes a choice, both are denied. **Do I need to change my Amazon Ad Tag?** No. Once the integration is enabled, CookieHub passes the consent signals to Amazon Ads without changes to your Amazon Ad Tag. **Does it work with Google Tag Manager?** Yes. Load CookieHub with the CookieHub CMP template from the GTM Community Template Gallery on the Consent Initialization - All Pages trigger, then enable Amazon Consent Signal in your domain’s settings. ### Documentation - [Amazon Consent Signal setup guide](https://docs.cookiehub.com/integrations/amazon-consent-signal) - [Domain settings: Integrations](https://docs.cookiehub.com/configure/domain-settings#integrations) - [Content Security Policy](https://docs.cookiehub.com/reference/csp) - [Amazon Ads: Consent signal requirements](https://advertising.amazon.com/resources/ad-policy/consent-signal-requirements) Related: [IAB TCF 2.4](https://www.cookiehub.com/iab-tcf-v24), [Microsoft UET Consent Mode](https://www.cookiehub.com/microsoft-uet-consent-mode), [Google Consent Mode v2](https://www.cookiehub.com/google-consent-mode-v2). --- # CookieHub Blog | Cookie Compliance & Consent URL: https://www.cookiehub.com/blog Last updated: December 4, 2025 ## CookieHub Blog **The CookieHub blog: your go-to resource for navigating the evolving intersection of data privacy and global privacy regulations, cookie compliance, and consent management.\ \ ** Whether you seek insights on the latest GDPR, CCPA, LGPD, and other data privacy laws, or looking to understand the intricacies of cookie management and consent management, this blog is the place for you. Our blog offers coverage of privacy laws and information on the latest regulations, including the GDPR, CCPA, LGPD, and CNIL. Stay informed on the latest developments in cookie compliance right here. We empower marketers, developers and business leaders to stay compliant, build trust, and future-proof digital experiences for users everywhere. --- # Clarity Consent API v2 Integration URL: https://www.cookiehub.com/clarity-consent-api Last updated: April 1, 2026 ## Implement Clarity Consent API v2 ##### Microsoft Clarity consent integration made easy Keep your analytics running smoothly and ensure seamless session recording, heatmaps, and user behavior tracking — all fully consent-aware with CookieHub as your CMP. ### Clarity Consent API v2 made easy As of 31 October, 2025, Clarity will enforce consent signals for traffic from the EEA, UK, and Switzerland. Here’s how you can easily [get started by activating Clarity Consent API v2 using CookieHub](https://support.cookiehub.com/article/550-clarity-consent-api-v2) by enabling the Clarity Consent integration (v2), ensure you have the latest version of CookieHub, and use the built-in CookieHub script to pass consent to Clarity. Because CookieHub handles this in your CMP layer, you don’t have to manually handle the logic or timing. ### Why Clarity Consent API v2 matters Clarity’s Consent API v2 lets websites explicitly communicate user consent decisions to Microsoft Clarity’s tracking logic — a necessity in privacy‐first environments. **Valid consent, better data\ ** Without valid consent, Clarity disables its cookie-based tracking, session linking, and cookie persistence in the EEA, UK, and Switzerland. With granted consent, Clarity can resume full session tracking, heatmaps, funnels, and full analytics features. This ensures that you remain compliant with privacy laws while still gaining insights from user behavior. **Standardize consent across the Clarity tool with CookieHub\ \ ** CookieHub’s integration with the Clarity Consent API standardizes consent and enables accurate tracking in Microsoft Clarity, improving the reliability of your Clarity insights. ### CookieHub CMP: Your Clarity Consent solution + benefits **User-friendly, robust, and future-ready** CookieHub makes integrating Clarity’s Consent API v2 intuitive across CMSs, GTM, or custom environments. **Certified and maintained** As a strong privacy partner, CookieHub ensures continuous compatibility as Clarity or regulatory standards evolve. **Compliance you can trust** CookieHub automates scanning, blocking, audits, and logs so you can manage global privacy obligations without manual overhead. #### FAQ about Clarity Consent API v2 **What is Clarity Consent API v2?** Clarity Consent API is Microsoft’s JavaScript consent interface that replaces the older window.clarity('consent') API. It enables passing explicit, differentiated consent states (for ads and analytics) to Clarity. **Why has Microsoft introduced this?** Starting October 31, 2025, Clarity will enforce consent signals for traffic from the EEA, UK, and Switzerland. Without valid calls to consentv2, features like session linking, funnels, and recordings may be disabled. **How does Clarity Consent API v2 work?** It operates by listening for the window.clarity('consentv2', …) call with the user’s consent states. When CookieHub triggers that call (based on banner interaction), Clarity adjusts tracking behavior accordingly, either enabling cookies, session linking, and full analytics, or disabling them. **Who needs the Clarity Consent API?** If your website uses Microsoft Clarity and reaches users in the EEA, UK, or Switzerland, you must implement this API to maintain full Clarity functionality. If not, default Clarity may still work, but session linking and advanced features will degrade. **How does Clarity API improve campaign insights?** By preserving session continuity, heatmaps, funnels, and detailed user journey data — now in a privacy-aware way. Even if users withhold ad tracking consent, analytics can still run if granted. **What jurisdictions does this affect?** Clarity Consent API is primarily relevant for the EEA, UK, and Switzerland, where explicit, prior consent is required for non-essential cookies (like analytics and ad storage). Clarity will enforce this in those regions from October 31, 2025. Even outside those zones, using consent-aware practices improves transparency and future-proofs your setup. **Is Clarity GDPR / privacy-compliant by itself?** No. While Clarity Consent API v2 helps align Clarity’s behavior with consent signals, compliance requires your overall consent strategy, records, legal notices, and user choices to be sound. CookieHub offers the infrastructure to help assure full compliance — but you still need to manage policy, disclosures, and governance. **Do I need to implement the Clarity Consent API?** If you use Microsoft Clarity in regions with privacy laws (EEA, UK, Switzerland), yes — to maintain full tracking features. If you don’t have users from those regions, it’s still recommended to adopt a consent-aware approach. --- # Compare CookieHub With Other Consent Management Platforms URL: https://www.cookiehub.com/compare Last updated: September 24, 2026 ## Compare CookieHub with other consent platforms Every major consent management platform can block cookies before consent, and most are certified by Google and registered with the IAB TCF. What differs is how they charge, what each plan includes and what else comes in the box. Each comparison below uses the other vendor's own pricing page and documentation. It says where they are stronger as well as where we are, and it is dated so you know how current it is. ### CookieHub vs **Cookiebot** Pricing by sessions vs by subpages per domain, and which suits your site. **OneTrust** A focused CMP with public prices vs an enterprise trust suite priced on request. **iubenda** Visits vs page views, and a consent platform vs a legal document suite. **Termly** Languages, TCF and proof of consent vs a policy generator with a CMP. **CookieYes** Visits vs page views, and which plan includes GPC and the TCF. **Complianz** A hosted CMP for any website vs a WordPress plugin licensed per site. **Usercentrics** Two session-priced CMPs: sessions and domains per euro, web vs web, apps and TV. ### What every comparison checks - **What the price is based on:** sessions, page views, subpages, banner views or daily visitors. The unit decides who pays more as a site grows. - **Which plan includes what:** Google Consent Mode v2, the IAB TCF, languages, proof of consent and scan frequency. - **Scope:** a consent platform only, or a suite that also writes policies or runs privacy operations. - **Where the other product is stronger:** every page lists it. CookieHub's own plans are all on the [pricing page](https://www.cookiehub.com/pricing). --- # Complianz Alternative: CookieHub vs Complianz Compared URL: https://www.cookiehub.com/complianz-alternative Last updated: September 24, 2026 ## Complianz alternative: CookieHub vs Complianz Complianz is a WordPress plugin. It runs on your own server, is licensed per site and has no traffic limits. CookieHub is a hosted consent platform that works on any website, with a WordPress plugin for WordPress sites. Both are Google-certified CMPs registered with the IAB Transparency & Consent Framework. The choice mostly comes down to whether all your sites run on WordPress. This page compares the two using each vendor's own website, checked on 24 September 2026. ### The short version - **Choose Complianz** if your sites all run on WordPress and you want a flat yearly price per site with no traffic limits, consent records stored on your own server, and privacy statements and other legal documents generated inside WordPress. - **Choose CookieHub** if not all your sites run on WordPress, or you want one dashboard for WordPress, Shopify, Wix, Webflow and custom-built sites alike, with 62 banner languages built in rather than supplied through translation plugins. ### CookieHub vs Complianz at a glance As published by each vendor on 24 September 2026, in US dollars, excluding tax. Complianz sells yearly licences; CookieHub prices are monthly. CookieHub Complianz How it runs Hosted script on any website; WordPress plugin available WordPress plugin on your own server; a separate app for Shopify Price based on Sessions per month, per domain Number of sites per yearly licence, with no traffic limits Free option Free plan up to 1,000 sessions a month Free plugin, without Premium features Paid entry Starter: $7 a month Personal: $59 a year for one site Google-certified CMP true true Google Consent Mode v2 All plans Listed as a Premium feature IAB TCF Business ($35 a month) and Enterprise Premium Global Privacy Control All plans Premium Records of consent All plans, stored by CookieHub Premium, stored in your WordPress database Banner languages 62, built in, on Basic and above Translated through WordPress language packs and translation plugins Legal documents Free privacy policy generator and a cookie declaration Cookie policy in the free plugin; privacy statements, Impressum and disclaimer in Premium Support Ticket support on every plan Community forum for the free plugin; premium support with a licence ### Pricing **Complianz** sells yearly licences by number of sites: Personal is $59 a year for one site, Professional $179 for five and Agency $399 for 25. Traffic and consent records are not limited. If you do not renew, the plugin keeps running, but you can no longer change its configuration or legal documents, and the TCF stops working. **CookieHub** is priced per domain by sessions: Starter $7 a month for 5,000 sessions, Basic $12 for 30,000, Business $35 for 120,000. Paying yearly gets you 12 months for the price of 11. For a single WordPress site, Complianz Premium costs less, especially if you need the IAB TCF: $59 a year, against $385 a year for CookieHub Business. The difference narrows, or reverses, if you have sites on other platforms, which Complianz does not cover with the same product, or if you would rather not run and update the consent layer inside WordPress itself. ### Where Complianz is stronger A fair comparison has to include these: **Price for WordPress sites:** A flat yearly licence per site, with no limit on traffic or consent records. **Data on your own server:** Complianz runs inside WordPress, and records of consent are stored in your own database. **Legal documents:** Premium generates privacy statements for several regions, an Impressum, a disclaimer and more, inside WordPress. **WordPress ecosystem:** More than a million active installations on wordpress.org, and integrations with over 250 plugins and services. ### When CookieHub is the better fit **Sites on more than one platform:** One account and one dashboard for WordPress, Shopify, Wix, Webflow, Squarespace and custom-built sites. **Languages built in:** 62 professionally translated banner languages, with automatic detection, from Basic. No translation plugin needed. **Consent features on the free plan:** Google Consent Mode v2, Global Privacy Control and a consent log are included on every CookieHub plan, the Free plan included. **Consent handled outside WordPress:** The banner, scanner and consent log are hosted, so a WordPress update or plugin conflict does not affect them. The CookieHub WordPress plugin supports the WP Consent API. ### Switching from Complianz CookieHub builds its own cookie list from a scan, so there is nothing to export first. **Create an account:** Start the free trial and add your domain. CookieHub scans the site and sorts the cookies it finds into categories. **Review the categories and design:** Check the categorization, pick a banner template and set your colours and languages. **Swap the script:** Replace the Complianz script with the CookieHub script, or use the CookieHub template in Google Tag Manager. Remove Complianz completely so two banners never run at once. **Check the result:** Run the Google Consent Mode checker to confirm consent signals reach Google. **Expect one new prompt:** Consent stored by Complianz is kept in its own cookie, which CookieHub cannot read. Returning visitors are asked once more. Further reading: [the 62 supported languages](https://www.cookiehub.com/languages), [the consent log](https://www.cookiehub.com/consent-log), [the JavaScript API](https://www.cookiehub.com/javascript-api), [the Google Consent Mode checker](https://www.cookiehub.com/google-consent-mode-checker), [the free privacy policy generator](https://www.cookiehub.com/privacy-policy-generator). ### Frequently asked questions **Does CookieHub work on WordPress?** Yes. The CookieHub plugin is on wordpress.org and supports the WP Consent API. You can also add the CookieHub script to your theme or through Google Tag Manager. **Is Complianz only for WordPress?** The Complianz plugin is only for WordPress. Complianz also sells a separate app for Shopify. CookieHub works on any website. **Are both Google-certified CMPs?** Yes. Both are on Google's list of certified CMPs: Complianz under TCF CMP ID 332, CookieHub under ID 354. **Will my visitors have to consent again after switching?** Yes, once. Each platform stores consent in its own cookie, so CookieHub cannot read choices a visitor made in the Complianz banner. ### Sources Every fact about a competitor on this page comes from that vendor's own website, from Google's list of certified CMPs or from IAB Europe's CMP list. All of it was checked on 24 September 2026. Prices exclude VAT. - [Google: certified CMPs](https://support.google.com/admanager/answer/13554116) - [IAB Europe: CMP list](https://iabeurope.eu/cmp-list/) - [CookieHub pricing](https://www.cookiehub.com/pricing) - [CookieHub JavaScript API](https://docs.cookiehub.com/advanced/javascript-api) - [Complianz pricing](https://complianz.io/pricing/) - [Complianz on wordpress.org](https://wordpress.org/plugins/complianz-gdpr/) - [Complianz: browser privacy controls (GPC)](https://complianz.io/help/wordpress/configuration/browser-privacy-controls/) - [Complianz: records of consent](https://complianz.io/help/wordpress/configuration/records-of-consent/) - [CookieHub on wordpress.org](https://wordpress.org/plugins/cookiehub/) Vendors change their plans. If something here is out of date, [tell us](https://www.cookiehub.com/contact-us) and we will correct it. --- # Computermusen er ambassadør for Cookiehub i Danmark URL: https://www.cookiehub.com/computermusen Last updated: September 24, 2026 ## Computermusen er ambassadør for Cookiehub i Danmark CookieHub giver alt hvad du behøver for at begynde at indsamle besøgendes samtykke, herunder en automatisk cookiescanner, en brugergrænseflade, der kan tilpasses, og forskellige integrationsmetoder. **Cookie skanner** Scanner dit websted og registrerer cookies, der er i brug for dig. **Cookie-deklaration** Genererer automatisk en detaljeret liste over cookies, der er i brug. **Forhåndssamtykke** Sikrer en brugers privatliv, indtil deres samtykke er givet. **Responsivt design** Din tilpassede widget ser godt ud på enhver skærmstørrelse. ### Tilpas til dig Med CookieHub-widgetten har du mulighed for enten at bruge et foruddesignet tema eller tilpasse knapperne, farverne og placeringen fuldt ud på din hjemmeside. Du kan nemt indstille din cookie compliance, så den matcher dit brands farver. Betalte abonnementer giver mulighed for at tilføje brugerdefineret CSS, så du kan tilpasse til dine specifikke behov og præferencer. ### Kraftfulde funktioner inkluderet i vores betalte planer Hvis du abonnerer på en af vores betalte planer, får du adgang til en fuld pakke af fantastiske funktioner. **Geolokalisering** Viser automatisk den korrekte samtykkeramme afhængigt af brugerens placering. **62 sprog** Ændrer sprog baseret på webstedsindhold, browserpræferencer eller URL-præfiks. **Rapporter** Detaljerede rapporter om samtykkesvar, sessioner og en masse nyttige oplysninger. **Kundesupport** Hurtig og let tilgængelig support her for at hjælpe med eventuelle spørgsmål, du har. ### Bevis dit samtykke Har du brug for at dokumentere, at du har indsamlet det nødvendige samtykke fra dine brugere i overensstemmelse med forskellige love om beskyttelse af personlige oplysninger? Det kan du nemt gøre med CookieHubs samtykkelog. Du kan til enhver tid tilgå din samtykkehistorik via dashboardet. Vælg det datointerval, du har brug for, fra dashboardet, og download nemt samtykke-loggen. --- # Ensure Compliance with User Consent Records URL: https://www.cookiehub.com/consent-log Last updated: July 2, 2026 ## Consent Log ##### Ensure Compliance with User Consent Records When the consent log feature is enabled, CookieHub logs and stores user consents along with necessary information required to look up user choices in case you’ll have to demonstrate consents to authorities. This feature is only available for premium subscriptions. ### Why should I use consent log? To comply with GDPR, website owners must be able to demonstrate that they have obtained user consent for data processing activities. This requirement is articulated in [**recital 42 of the GDPR**](https://gdpr-info.eu/recitals/no-42/), which states: “Where processing is based on the data subject’s consent, the controller should be able to demonstrate that the data subject has given consent to the processing operation” In practice, this means that businesses must keep clear records of when and how consent was obtained. These records should include details such as the date and time of consent, the specific data processing activities consented to, and any methods used to obtain consent. Ensuring this documentation is in place not only helps in compliance with GDPR but also enhances transparency and trust with users, demonstrating a commitment to protecting their privacy rights. #### What information is stored? CookieHub only stores necessary data required to demonstrate user choices. Below is a complete list of data stored: ##### Token A random string stored in the CookieHub cookie in the users browser along with the settings for the cookie categories. In case you need to demonstrate the consent, you’ll have to request this token from the subject to find the entry from the consent log. ##### Anonymized IP address The IP address of the client. The last part of the IP address is replaced with 0 as IP address could be considered personal information. ##### Date and time The date and time of consent. ##### Url The full url that the user was viewing when he configured consents using the CookieHub widget. ##### Country The registered country code for the IP address. When using geolocation this can be useful to identify if the user consented or didn’t get any choices. ##### User agent The user agent usually contains the browser and operating string information. **Get 14 days free!** Experience the benefits of our cookie management solutions risk-free! Sign up for any of our plans and receive the first 14 days free. **View our getting started guide** Our step-by-step instructions and screenshots will guide you through every step of the process, making it easy to use CookieHub to its fullest potential. ### CookieHub Features Take control of your cookie privacy with confidence. Explore our features designed for simplicity and built for reliability. **Cookie Scanner** Scans your website for you and detects the cookies that are in use. **Cookie Declaration** Automatically generates a detailed list of the cookies in use on your site. **Pre-Consent** Gain your customers trust by ensuring their privacy is taken seriously. **Consent Log** Log and store user consents along with necessary information required... **Consent Mode Scanner** Ensure Google Consent Mode V2 is correctly implemented on your site. **Geolocation** Automatically shows the correct consent framework depending on the users location. **Accessibility** CookieHub has fully embraced Web Content Accessibility Guidelines (WCAG) standards. **62 Languages** Changes language based on website content, browser preferences or URL prefix. **Reports** Detailed reports on consent responses, sessions and a lot of useful information. **Customer support** Fast and easily accessible support here to assist with any questions you have. **CCPA Compliance** CookieHub helps you protect your users privacy in California by complying to strict cookie consent laws. **TCF 2.4 Compliance** Promote transparency by allowing users to make informed choices about data processing and advertising preferences. **Google Consent Mode V2** As an advertiser, you can collect user data with the rights of users to maintain their privacy. **Google Certified CMP** We’re proud to announce our Google certification, solidifying our position as a trusted CMP for web managers. --- # Contact Us URL: https://www.cookiehub.com/contact-us Last updated: September 21, 2026 --- # Free Cookie Checker URL: https://www.cookiehub.com/cookie-checker Last updated: July 2, 2026 ## Scan for cookies To scan for cookies on your website, simply enter your website URL into our scanner and hit enter. Our completely free tool will generate a detailed list of all cookies currently in use, along with valuable information about their purpose. ### What are cookies? Cookies are tiny data files sent by websites to help websites function correctly. Cookies are stored in your web browser’s memory. Since websites cannot remember user information from one page to the next, cookies help fill this gap. The most frequently encountered cookie categories are essential cookies, preference cookies, analytics cookies, and marketing cookies. However, cookies may also be employed to trace user activities within a website or across various websites, gathering usage data and pinpointing user preferences and actions. The collected data can be leveraged to tailor advertisements to users based on their behaviour and interests. ### The Importance of Website Cookie Compliance Website cookie compliance is important because it protects user privacy, ensures legal compliance, fosters user trust, allows for personalized experiences, and helps improve website performance. By utilizing the CookieHub Consent Management Platform (CMP), websites can provide users with the ability to grant or deny consent for specific cookie categories selectively. This measure helps protect users’ privacy and stay up-to-date with compliance regulations. ### Cookie regulations Cookies play a critical role in the functioning of modern websites, but their usage is strictly regulated by a number of laws and guidelines, such as the EU’s General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA). These regulations have been enacted to protect users’ privacy and right to consent, ensuring that website owners are transparent about their use of cookies and allow users to make informed decisions about which cookies to accept. While many cookie policies may appear similar on the surface, website owners must carefully consider the nuances of each regulation to ensure they are fully compliant. For example, the GDPR requires companies to obtain explicit consent from users before collecting and processing their personal data, while the CCPA mandates that businesses provide users with the option to opt out of the sale of their personal information. In addition to these regulations, numerous other privacy laws and guidelines have been established worldwide, each with its unique requirements for cookie compliance. As such, it is important for website owners to stay up-to-date with the latest laws and guidelines and to implement robust cookie policies that adhere to these regulations. By doing so, they can help protect their users’ privacy and security while also ensuring that they are operating in a legally compliant manner. #### Questions **How do you check cookies?** In just a few seconds, you can obtain a cookie report for your website by entering its domain into our Cookie checker. **What is a cookie checker?** A cookie checker is a tool that scans a website to identify and analyze the cookies it uses. It helps website owners to ensure compliance with privacy regulations and provide transparency to website users regarding the cookies that are stored on their device. **What types of website cookies are there?** There are several types of website cookies, including session cookies, persistent cookies, first-party cookies, and third-party cookies. Session cookies are temporary cookies that are deleted when you close your browser **Does my website use cookies?** Enter the URL of your website above in our Cookie checker to run an instant cookie scan and get a list of cookies in use on your website and the purpose of each cookie. **What are the benefits of using a Cookie checker?** The benefits of using a Cookie checker can for example help website owners identify and categorize the cookies used on their site, provide transparency to website users about the use of cookies and their purpose, ensure compliance with privacy regulations, such as GDPR and CCPA, reduce the risk of legal action or penalties for non-compliance and improve website performance by identifying and removing unnecessary cookies. --- # Cookie Declaration URL: https://www.cookiehub.com/cookie-declaration Last updated: July 2, 2026 ## Cookie Declaration After CookieHub’s handy Cookie Scanner has detected all the cookies your site uses, it will take that information to create a tailored Cookie Declaration. In this Cookie Declaration, which is required under most regulations, users will be able to find a list of the cookies you use along with important details about each of those cookies, like the expiration date, originating domain and purpose. ### **Sample cookie declaration** Cookies used on the site are categorized and below you can read about each category and allow or deny some or all of them. When categories than have been previously allowed are disabled, all cookies assigned to that category will be removed from your browser. Additionally you can see a list of cookies assigned to each category and detailed information in the cookie declaration. [Learn more](https://www.cookiehub.com/about-cookies) #### **Necessary cookies** Some cookies are required to provide core functionality. The website won't function properly without these cookies and they are enabled by default and cannot be disabled. ```html
Necessary cookies
NameHostnameVendorExpiry
cookiehub.cookiehub.comCookieHub365 days

Used by CookieHub to store information about whether visitors have given or declined the use of cookie categories used on the site.

_lscache_varywww.cookiehub.comCookieHub2 days

Used by Litespeed to determine if a cached page should be served or not.

wp-wpml_current_languagewww.cookiehub.comCookieHubSession

This cookie is set by WPML and it stores the current language settings.

litespeed_docrefCookieHubSession
_GRECAPTCHAwww.google.comGoogle180 days

Used by Google reCaptcha for risk analysis

_grecaptchaGooglePersistent

This cookie is set by Google reCAPTCHA, which protects the site against spam enquiries on contact forms.

XSRF-TOKEN.dash.cookiehub.comCookieHub2 hours

This cookie is written to help with site security in preventing Cross-Site Request Forgery attacks.

cookiehub_.dash.cookiehub.comCookieHub2 hours

Used by CookieHub to store information about whether visitors have given or declined the use of cookie categories used on the site.

PHPSESSIDwww.cookiehub.comCookieHubSession

Cookie generated by applications based on the PHP language. This is a general purpose identifier used to maintain user session variables. It is normally a random generated number, how it is used can be specific to the site, but a good example is maintaining a logged-in status for a user between pages.

al.cookiehub.comCookieHub30 days

Used by CookieHub to link affiliate to registrations

ch_referer.cookiehub.comCookieHub365 days

Used by CookieHub to attribute origin of registration to channel

alcookiehub.comCookieHubPersistent

Used by CookieHub to link affiliate to registrations

ch_referercookiehub.comCookieHubPersistent

Used by CookieHub to attribute origin of registration to channel

NRBA_SESSIONNew Relic Inc.Persistent

Used by New relic to collect telemetry data such as page load times, JavaScript errors, and other performance metrics.

``` #### **Analytical cookies** Analytical cookies help us improve our website by collecting and reporting information on its usage. ```html
Analytical cookies
NameHostnameVendorExpiry
_ga.cookiehub.comGoogle400 days

Contains a unique identifier used by Google Analytics to determine that two distinct hits belong to the same user across browsing sessions.

_gid.cookiehub.comGoogle1 day

Contains a unique identifier used by Google Analytics to determine that two distinct hits belong to the same user across browsing sessions.

CLIDwww.clarity.msMicrosoft365 days

Identifies the first-time Clarity saw this user on any site using Clarity.

_clck.cookiehub.comMicrosoft365 days

Persists the Clarity User ID and preferences, unique to that site, on the browser. This ensures that behavior in subsequent visits to the same site will be attributed to the same user ID.

SM.c.clarity.msMicrosoftSession

This cookie is installed by Clarity. The cookie is used to store non-personally identifiable information. The cookie is used in synchronizing the MUID (Microsoft unique user ID) across Microsoft domains.

MUID.clarity.msMicrosoft390 days, 1 hour

Microsoft User Identifier tracking cookie used by Bing Ads. It can be set by embedded microsoft scripts. Widely believed to sync across many different Microsoft domains, allowing user tracking.

_clsk.cookiehub.comMicrosoft1 day

Connects multiple page views by a user into a single Clarity session recording.

_cltkMicrosoftSession

This cookie is installed by Microsoft Clarity tool and stores information about how visitors use the website

_hjSessionUser_.cookiehub.comHotjar365 days

Hotjar cookie. This cookie is set when the customer first lands on a page with the Hotjar script. It is used to persist the Hotjar User ID, unique to that site on the browser. This ensures that behavior in subsequent visits to the same site will be attributed to the same user ID.

_hjSession_.cookiehub.comHotjar1 hour

Used by Hotjar to hold current session data.

MUID.bing.comMicrosoft390 days

Microsoft User Identifier tracking cookie used by Bing Ads. It can be set by embedded microsoft scripts. Widely believed to sync across many different Microsoft domains, allowing user tracking.

_ga_.cookiehub.comGoogle400 days

Contains a unique identifier used by Google Analytics 4 to determine that two distinct hits belong to the same user across browsing sessions.

_gat_.cookiehub.comGoogle1 hour

Used by Google Analytics to throttle request rate (limit the collection of data on high traffic sites)

MR.c.bing.comMicrosoft7 days

Used by Microsoft Clarity to indicate whether to refresh MUID.

MR.c.clarity.msMicrosoft7 days, 1 hour

Used by Microsoft Clarity to indicate whether to refresh MUID.

hjActiveViewportIdsHotjarPersistent

User by Hotjar to store user active viewports IDs and an expirationTimestamp that is used to validate active viewports on script initialization.

hjViewportIdHotjarSession

Used by Hotjar to store information about the user viewport such as size and dimensions.

_clskwww.cookiehub.comMicrosoft1 day

Connects multiple page views by a user into a single Clarity session recording.

``` #### **Marketing cookies** Marketing cookies are used to track visitors across websites to allow publishers to display relevant and engaging advertisements. By enabling marketing cookies, you grant permission for personalized advertising across various platforms. ```html
Marketing cookies
NameHostnameVendorExpiry
_lfa.cookiehub.comDealfront365 days

Used by Leadfeeder to collect behavioral data of all website visitors. This includes: pages viewed, visitor source and time spent on the site.

_fbp.cookiehub.comMeta Platforms90 days

Facebook Pixel advertising first-party cookie. Used by Facebook to track visits across websites to deliver a series of advertisement products such as real time bidding from third party advertisers.

_lfaDealfrontPersistent

Used by Leadfeeder to collect behavioral data of all website visitors. This includes: pages viewed, visitor source and time spent on the site.

_lfa_expiryDealfrontPersistent
_gcl_au.cookiehub.comGoogle Advertising Products90 days

Used by Google AdSense to understand user interaction with the website by generating analytical data.

IDE.doubleclick.netGoogle Advertising Products390 days

Used by Google's DoubleClick to serve targeted advertisements that are relevant to users across the web. Targeted advertisements may be displayed to users based on previous visits to a website. These cookies measure the conversion rate of ads presented to the user.

bcookie.linkedin.comLinkedIn Ireland Unlimited Company365 days

This is a Microsoft MSN 1st party cookie for sharing the content of the website via social media.

lidc.linkedin.comLinkedIn Ireland Unlimited Company1 day

Used by LinkedIn for routing.

li_gc.linkedin.comLinkedIn Ireland Unlimited Company180 days

Used by LinkedIn to store consent of guests regarding the use of cookies for non-essential purposes

lastExternalReferrerTimeMeta PlatformsPersistent

Detects how the user reached the website by registering their last URL-address.

lastExternalReferrerMeta PlatformsPersistent

Detects how the user reached the website by registering their last URL-address.

MSPTC.bing.comMicrosoft390 days
AnalyticsSyncHistory.linkedin.comLinkedIn Ireland Unlimited Company30 days

Used by LinkedIn to store information about the time a sync with the lms_analytics cookie took place for users in the Designated Countries

UserMatchHistory.linkedin.comLinkedIn Ireland Unlimited Company30 days

Contains a unique identifier used by LinkedIn to determine that two distinct hits belong to the same user across browsing sessions.

bscookie.www.linkedin.comLinkedIn Ireland Unlimited Company365 days

Used by the social networking service, LinkedIn, for tracking the use of embedded services.

SRM_B.c.bing.comMicrosoft390 days

This cookie is installed by Microsoft Bing. Identifies unique web browsers visiting Microsoft sites.

ANONCHK.c.clarity.msMicrosoft1 hour

Used to store session ID for a users session to ensure that clicks from adverts on the Bing search engine are verified for reporting purposes and for personalisation

_uetsid.cookiehub.comMicrosoft1 day

This is a cookie utilised by Microsoft Bing Ads and is a tracking cookie. It allows us to engage with a user that has previously visited our website.

_uetvid.cookiehub.comMicrosoft390 days

This is a cookie utilised by Microsoft Bing Ads and is a tracking cookie. It allows us to engage with a user that has previously visited our website.

_uetsid_expMicrosoftPersistent

This is a cookie utilised by Microsoft Bing Ads and is a tracking cookie. It allows us to engage with a user that has previously visited our website.

_uetvidMicrosoftPersistent

This is a cookie utilised by Microsoft Bing Ads and is a tracking cookie. It allows us to engage with a user that has previously visited our website.

_uetvid_expMicrosoftPersistent

This is a cookie utilised by Microsoft Bing Ads and is a tracking cookie. It allows us to engage with a user that has previously visited our website.

_uetsidMicrosoftPersistent

This is a cookie utilised by Microsoft Bing Ads and is a tracking cookie. It allows us to engage with a user that has previously visited our website.

_gcl_lsGoogle Advertising ProductsPersistent

Used by Google AdSense to understand user interaction with the website by generating analytical data.

``` ### CookieHub Features Take control of your cookie privacy with confidence. Explore our features designed for simplicity and built for reliability. **Cookie Scanner** Scans your website for you and detects the cookies that are in use. **Cookie Declaration** Automatically generates a detailed list of the cookies in use on your site. **Pre-Consent** Gain your customers trust by ensuring their privacy is taken seriously. **Consent Log** Log and store user consents along with necessary information required... **Consent Mode Scanner** Ensure Google Consent Mode V2 is correctly implemented on your site. **Geolocation** Automatically shows the correct consent framework depending on the users location. **Accessibility** CookieHub has fully embraced Web Content Accessibility Guidelines (WCAG) standards. **62 Languages** Changes language based on website content, browser preferences or URL prefix. **Reports** Detailed reports on consent responses, sessions and a lot of useful information. **Customer support** Fast and easily accessible support here to assist with any questions you have. **CCPA Compliance** CookieHub helps you protect your users privacy in California by complying to strict cookie consent laws. **TCF 2.4 Compliance** Promote transparency by allowing users to make informed choices about data processing and advertising preferences. **Google Consent Mode V2** As an advertiser, you can collect user data with the rights of users to maintain their privacy. **Google Certified CMP** We’re proud to announce our Google certification, solidifying our position as a trusted CMP for web managers. --- # Free Cookie Scanner URL: https://www.cookiehub.com/cookie-scanner Last updated: July 2, 2026 ## Cookie Scanner | Scan Your Site for Cookies One of the most important feature included in CookieHub is the cookie scanner. It enables the platform to remove cookies when cookie categories are blocked and allows us to automatically generate a cookie declaration for your website. ### **How does it work?** When a domain is created in the CookieHub Dashboard and cookie scanning is enabled, our scanners will crawl your website and collect information on cookies used on the website along with details like expiration, hostname and path. Each cookie is then automatically assigned to the correct category based on our Cookie Database. Cookies that do not exist in our Cookie Database will be assigned to the Uncategorised category. Once every month your website is automatically crawled to check if there have been any changes to the cookies used on the website and any change is automatically published to your cookie declaration. #### **Scan report** Domains with active Basic, Business or Enterprise subscriptions are automatically validated to check if cookies are correctly set up and not set before the user has consented. The scan report is sent to all users linked to the account once a scan has been completed with details about the actions required and the current status of the cookie configuration. #### **Cookie Database** We maintain a database of cookies detected, categorize them and provide details on the purpose of each cookie. You can easily change category assignments and descriptions about each cookie in the CookieHub Dashboard by clicking the Cookies tab for each domain. **View our getting started guides** To begin using CookieHub, you can view our getting started guides to learn the basics and get up and running. ### CookieHub Features Take control of your cookie privacy with confidence. Explore our features designed for simplicity and built for reliability. **Cookie Scanner** Scans your website for you and detects the cookies that are in use. **Cookie Declaration** Automatically generates a detailed list of the cookies in use on your site. **Pre-Consent** Gain your customers trust by ensuring their privacy is taken seriously. **Consent Log** Log and store user consents along with necessary information required... **Consent Mode Scanner** Ensure Google Consent Mode V2 is correctly implemented on your site. **Geolocation** Automatically shows the correct consent framework depending on the users location. **Accessibility** CookieHub has fully embraced Web Content Accessibility Guidelines (WCAG) standards. **62 Languages** Changes language based on website content, browser preferences or URL prefix. **Reports** Detailed reports on consent responses, sessions and a lot of useful information. **Customer support** Fast and easily accessible support here to assist with any questions you have. **CCPA Compliance** CookieHub helps you protect your users privacy in California by complying to strict cookie consent laws. **TCF 2.4 Compliance** Promote transparency by allowing users to make informed choices about data processing and advertising preferences. **Google Consent Mode V2** As an advertiser, you can collect user data with the rights of users to maintain their privacy. **Google Certified CMP** We’re proud to announce our Google certification, solidifying our position as a trusted CMP for web managers. --- # Cookiebot Alternative: CookieHub vs Cookiebot Compared URL: https://www.cookiehub.com/cookiebot-alternative Last updated: September 24, 2026 ## Cookiebot alternative: CookieHub vs Cookiebot Cookiebot and CookieHub are both Google-certified consent management platforms registered with the IAB Transparency & Consent Framework, and both block cookies until a visitor consents. The real difference is how you pay. Cookiebot prices each domain by the number of subpages it has. CookieHub prices by sessions, however many pages the site has. This page compares the two using each vendor's own pricing and documentation, checked on 24 September 2026. ### The short version - **CookieHub usually costs less** for sites with many pages and moderate traffic, and for sites that need several languages on a budget: 62 languages from €10 a month. - **Cookiebot usually costs less** for small sites with a lot of traffic, because its entry plan covers up to 50 subpages whatever the traffic. Cookiebot also includes the IAB TCF on every Premium plan, and through its parent company Usercentrics it covers mobile apps and connected TV as well as websites. ### CookieHub vs Cookiebot at a glance Plans and prices as published by each vendor on 24 September 2026, monthly billing, excluding VAT. CookieHub Cookiebot Price based on Sessions per month, per domain Subpages per domain Free plan Up to 1,000 sessions a month Up to 50 subpages, one domain, one language Entry paid plan Starter: €6 a month, 5,000 sessions Premium Lite: €7 a month, up to 50 subpages Site with 1,000 pages and about 20,000 visits a month Basic: €10 a month Premium Medium: €30 a month Google-certified CMP true true Google Consent Mode v2 All plans All plans IAB TCF Business and Enterprise (from €30 a month) Premium plans Global Privacy Control All plans All plans Banner languages 62, on Basic and above 47+ on Premium, according to its pricing page Automated scans Monthly; weekly on Enterprise Monthly; daily for €99 a month extra Subdomains Scanned, with consent shared between them, on Business and above Each subdomain is billed as a separate domain JavaScript API true true Support Ticket support on every plan, answered within 4 business days, 2 on Basic and Business, 24 hours on Enterprise Help centre on Free; email support on Premium Platforms Websites Websites; apps and connected TV through Usercentrics ### How the pricing works **Cookiebot** counts the subpages on each domain, and its scanner sets the plan automatically from the number of pages it finds. As a site publishes more pages, it moves up a plan. Premium Lite covers up to 50 subpages for €7 a month, Premium Medium up to 3,500 for €30, Premium Large up to 7,000 for €50 and Premium XLarge more than that for €90, each per domain. Premium Small (up to 350 subpages, €15) has only been available to accounts with four or more domains since August 2025. Subdomains such as shop.example.com are billed as separate domains. **CookieHub** counts sessions. A session starts when a visitor loads the site and the banner initializes, and it covers every page they view on that visit. The number of pages makes no difference to the price. Starter is €6 a month for 5,000 sessions, Basic €10 for 30,000, Business €30 for 120,000 and Enterprise €100 from 1,000,000. Paying yearly gets you 12 months for the price of 11. **A worked example.** A company blog with 1,000 pages and about 20,000 visits a month needs Premium Medium at Cookiebot, which is €30 a month. On CookieHub it fits in Basic, which is €10 a month and includes all 62 languages. One caveat: CookieHub's Basic plan scans up to 100 pages. The banner still runs on every page, and the scanner stops at the limit. Templates repeat, so most cookies show up well before then. If you want the full 1,000 pages scanned, that takes Business. **When Cookiebot costs less.** A 40-page site with 100,000 visits a month fits in Cookiebot Premium Lite at €7 a month. On CookieHub it needs Business, at €30 a month. If your site is small and busy, compare the two for your own numbers. ### Where Cookiebot is stronger A fair comparison has to include these: **Apps and connected TV:** Usercentrics, which owns Cookiebot, offers consent SDKs for mobile apps and connected TV. CookieHub is registered as a web CMP. **TCF on cheaper plans:** Cookiebot includes the IAB TCF on every Premium plan. CookieHub includes it from Business, at €30 a month. **Daily scans:** Cookiebot offers daily scanning as a paid add-on. CookieHub scans weekly at most, on Enterprise. **Small, busy sites:** Traffic does not affect Cookiebot's price, so a small site with heavy traffic can cost less there. ### When CookieHub is the better fit **Sites that keep growing:** Publishing more pages never changes what you pay, so blogs, shops and documentation sites do not move up a plan as they grow. **Several subdomains:** On Business and above, CookieHub scans subdomains and shares consent between them. **Many languages:** All 62 languages, with automatic detection, are included from Basic at €10 a month. **Proof of consent on every plan:** Every plan includes a consent log, including Free. **Developer control:** A documented JavaScript API with events on every plan, and a Management API for configuring the CMP on Enterprise. ### Switching from Cookiebot CookieHub builds its own cookie list from a scan, so there is nothing to export first. **Create an account:** Start the free trial and add your domain. CookieHub scans the site and sorts the cookies it finds into categories. **Review the categories and design:** Check the categorization, pick a banner template and set your colours and languages. **Swap the script:** Replace the Cookiebot script with the CookieHub script, or use the CookieHub template in Google Tag Manager. Remove Cookiebot completely so two banners never run at once. **Check the result:** Run the Google Consent Mode checker to confirm consent signals reach Google. **Expect one new prompt:** Consent stored by Cookiebot is kept in its own cookie, which CookieHub cannot read. Returning visitors are asked once more. Further reading: [the 62 supported languages](https://www.cookiehub.com/languages), [the consent log](https://www.cookiehub.com/consent-log), [the JavaScript API](https://www.cookiehub.com/javascript-api), [the Management API](https://www.cookiehub.com/management-api), [the Google Consent Mode checker](https://www.cookiehub.com/google-consent-mode-checker), [the free privacy policy generator](https://www.cookiehub.com/privacy-policy-generator). ### Frequently asked questions **Is CookieHub cheaper than Cookiebot?** It depends on your site. Cookiebot prices by the number of pages and CookieHub by the number of visits, so CookieHub usually costs less for sites with many pages and moderate traffic, and Cookiebot for small sites with heavy traffic. The worked example above uses both vendors' published prices. **Are both Google-certified CMPs?** Yes. Both are on Google's list of certified CMPs: Cookiebot under TCF CMP ID 134, CookieHub under ID 354. Both support Google Consent Mode v2. **Do both support the IAB TCF?** Yes. Both are registered on IAB Europe's CMP list and support the TCF. Cookiebot includes it on Premium plans; CookieHub on Business and Enterprise. **Will my visitors have to consent again after switching?** Yes, once. Each platform stores consent in its own cookie, so CookieHub cannot read choices a visitor made in Cookiebot's banner. **Can I try CookieHub before switching?** Yes. Any plan can be tried free for 14 days without a credit card. If you do not subscribe, the domain moves to the Free plan. ### Sources Every fact about a competitor on this page comes from that vendor's own website, from Google's list of certified CMPs or from IAB Europe's CMP list. All of it was checked on 24 September 2026. Prices exclude VAT. - [Google: certified CMPs](https://support.google.com/admanager/answer/13554116) - [IAB Europe: CMP list](https://iabeurope.eu/cmp-list/) - [CookieHub pricing](https://www.cookiehub.com/pricing) - [CookieHub JavaScript API](https://docs.cookiehub.com/advanced/javascript-api) - [Cookiebot pricing](https://www.cookiebot.com/en/pricing/) - [Cookiebot: Premium Small for accounts with four or more domains](https://support.cookiebot.com/hc/en-us/articles/20167285180188) - [Cookiebot: how subdomains are counted](https://support.cookiebot.com/hc/en-us/articles/360004051134) - [Cookiebot developer documentation](https://www.cookiebot.com/en/developer/) Vendors change their plans. If something here is out of date, [tell us](https://www.cookiehub.com/contact-us) and we will correct it. --- # CookieYes Alternative: CookieHub vs CookieYes Compared URL: https://www.cookiehub.com/cookieyes-alternative Last updated: September 24, 2026 ## CookieYes alternative: CookieHub vs CookieYes CookieYes is a consent platform best known for its WordPress plugin, with apps for Shopify, Wix and HubSpot. CookieHub is a consent platform for any website, with its own WordPress plugin and Shopify and Wix apps. Both are Google-certified CMPs registered with the IAB Transparency & Consent Framework, and both block cookies until a visitor consents. The differences are in how each counts your traffic and which plan includes what. This page compares the two using each vendor's own pricing and documentation, checked on 24 September 2026. ### The short version - **Choose CookieHub** if you need Global Privacy Control without moving up a plan: CookieHub honors it on every plan, CookieYes from Pro at $25 a month. CookieHub also suits sites where visitors view many pages per visit, because it counts visits, not page views. - **Choose CookieYes** if you need the IAB TCF on a smaller budget (from Pro, $25 a month, against $35 on CookieHub), you want the widest choice of banner languages, or your visitors view only a few pages per visit. ### CookieHub vs CookieYes at a glance Plans and prices as published by each vendor on 24 September 2026, monthly billing, in US dollars, excluding tax. CookieHub CookieYes Price based on Sessions (visits) per month, per domain Page views per month and pages per scan, per domain Free plan 1,000 sessions a month, 50 pages scanned 5,000 page views a month, 100 pages per scan Entry paid plan Starter: $7 a month, 5,000 sessions, 100 pages scanned Basic: $10 a month, 100,000 page views, 600 pages per scan Going over the limit on a paid plan Moves to the right plan after two billing periods over; the banner keeps running $0.30 per 1,000 extra page views on Basic and Pro Google-certified CMP true true Google Consent Mode v2 All plans All plans IAB TCF Business ($35 a month) and Enterprise Pro ($25 a month) and Ultimate Global Privacy Control All plans Pro and Ultimate Banner languages 62, on Basic and above More than 175, 41 with automatic translation, on Basic and above Consent log All plans All plans Scheduled scans Monthly; weekly on Enterprise Monthly on Pro; weekly on Ultimate JavaScript API true true Support Ticket support on every plan, answered within 4 business days, 2 on Basic and Business, 24 hours on Enterprise Email on every plan; chat from Basic ### Visits vs page views **CookieYes** counts page views. Basic covers 100,000 a month for $10, Pro 300,000 for $25 and Ultimate unlimited page views, subject to a fair-use policy, for $55. On Basic and Pro, extra page views cost $0.30 per 1,000. **CookieHub** counts sessions. A session starts when a visitor loads the site and the banner initializes, and it covers every page they view on that visit. Starter is $7 a month for 5,000 sessions, Basic $12 for 30,000, Business $35 for 120,000. **A worked example.** Take a site with 20,000 visits a month that needs its banner in several languages. At five pages per visit that is 100,000 page views: CookieYes Basic at $10 a month costs a little less than CookieHub Basic at $12. At eight pages per visit it is 160,000 page views, which moves CookieYes to Pro at $25 (Basic plus overage would be $28). CookieHub stays at $12, because the number of visits has not changed. If the site also has to honor Global Privacy Control for US visitors, CookieYes needs Pro whatever the traffic. CookieHub includes it on every plan, the Free plan included. ### Where CookieYes is stronger A fair comparison has to include these: **Languages:** CookieYes says its banner supports more than 175 languages, 41 of them with automatic translation. CookieHub supports 62. **TCF for less:** The IAB TCF is included from Pro at $25 a month. CookieHub includes it from Business at $35. **Deeper scans on cheaper plans:** CookieYes Basic scans up to 600 pages per scan, against 100 on CookieHub Basic. **Few pages per visit:** When visitors view only a few pages each, a page-view price can work out lower than a session price. **Agency discounts:** CookieYes offers partner discounts of up to 50% for agencies with 100 or more sites. CookieHub's partner discount is 30%. ### When CookieHub is the better fit **US visitors and GPC:** Global Privacy Control is honored on every CookieHub plan, including Free. **Sites with long visits:** You pay for visits, not page views, so shops, documentation and content sites with many pages per visit pay the same however much each visitor reads. **Predictable bills:** There are no metered charges. A domain over its limit for two billing periods moves to the right plan, and the banner keeps running. **Developers:** A documented JavaScript API with events on every plan, and a Management API for configuring the CMP on Enterprise. ### Switching from CookieYes CookieHub builds its own cookie list from a scan, so there is nothing to export first. **Create an account:** Start the free trial and add your domain. CookieHub scans the site and sorts the cookies it finds into categories. **Review the categories and design:** Check the categorization, pick a banner template and set your colours and languages. **Swap the script:** Replace the CookieYes script with the CookieHub script, or use the CookieHub template in Google Tag Manager. Remove CookieYes completely so two banners never run at once. **Check the result:** Run the Google Consent Mode checker to confirm consent signals reach Google. **Expect one new prompt:** Consent stored by CookieYes is kept in its own cookie, which CookieHub cannot read. Returning visitors are asked once more. Further reading: [the 62 supported languages](https://www.cookiehub.com/languages), [the consent log](https://www.cookiehub.com/consent-log), [the JavaScript API](https://www.cookiehub.com/javascript-api), [the Management API](https://www.cookiehub.com/management-api), [the Google Consent Mode checker](https://www.cookiehub.com/google-consent-mode-checker), [the free privacy policy generator](https://www.cookiehub.com/privacy-policy-generator). ### Frequently asked questions **Is CookieHub cheaper than CookieYes?** It depends on how many pages your visitors view. CookieYes counts page views and CookieHub counts visits, so CookieYes tends to cost less when visitors view a few pages each, and CookieHub when they view many. If you need Global Privacy Control, CookieHub includes it on every plan and CookieYes from Pro. **Are both Google-certified CMPs?** Yes. Both are on Google's list of certified CMPs: CookieYes under TCF CMP ID 401, CookieHub under ID 354. Both support Google Consent Mode v2 on every plan. **Does CookieHub have a WordPress plugin?** Yes. The CookieHub plugin is on wordpress.org and supports the WP Consent API. You can also add the CookieHub script to your theme or through Google Tag Manager. **Will my visitors have to consent again after switching?** Yes, once. Each platform stores consent in its own cookie, so CookieHub cannot read choices a visitor made in CookieYes's banner. ### Sources Every fact about a competitor on this page comes from that vendor's own website, from Google's list of certified CMPs or from IAB Europe's CMP list. All of it was checked on 24 September 2026. Prices exclude VAT. - [Google: certified CMPs](https://support.google.com/admanager/answer/13554116) - [IAB Europe: CMP list](https://iabeurope.eu/cmp-list/) - [CookieHub pricing](https://www.cookiehub.com/pricing) - [CookieHub JavaScript API](https://docs.cookiehub.com/advanced/javascript-api) - [CookieYes pricing](https://www.cookieyes.com/pricing/) - [CookieYes: pageview-based pricing](https://www.cookieyes.com/documentation/pageview-pricing/) - [CookieYes: banner languages](https://www.cookieyes.com/documentation/banner-languages/) - [CookieYes: IAB TCF](https://www.cookieyes.com/documentation/iab-tcf-v2-2-compliance-with-cookieyes/) - [CookieYes: agency discounts](https://www.cookieyes.com/documentation/agency-discounts-and-billing/) Vendors change their plans. If something here is out of date, [tell us](https://www.cookiehub.com/contact-us) and we will correct it. --- # Drupal Cookie Consent Solution | Data Privacy Compliance with CookieHub URL: https://www.cookiehub.com/drupal Last updated: April 1, 2026 ## Cookie Consent for Drupal Drupal sites often serve complex use cases: custom modules, enterprise analytics, marketing integrations, and third-party embeds — all of which can introduce cookies without user consent. CookieHub provides a robust, CMS-agnostic consent layer that works seamlessly with Drupal’s theming system and keeps your site compliant with modern data-privacy regulations. ### Effortless Compliance, Designed for Drupal CookieHub integrates directly at theme level in Drupal, ensuring consent is enforced before tracking scripts are allowed to run. Once installed, CookieHub blocks non-essential cookies, records user preferences, and keeps your compliance posture up to date — without requiring custom module development. For step-by-step installation, see the official [Drupal implementation guide](https://support.cookiehub.com/article/429-how-to-install-cookiehub-in-drupal). **Key Benefits:** - Automatic blocking of non-essential cookies before consent - Centralized consent management across all pages - Cookie scanner to detect cookies set by modules and external scripts - Dynamic cookie declaration for transparency - Fully customizable consent banner - Lightweight, CMS-agnostic implementation - No Drupal module installation required ### Why Use CookieHub with Drupal Drupal offers flexibility and power, but native cookie-consent handling is limited — especially when scripts are injected by modules, themes, or external services. CookieHub fills that gap by enforcing consistent consent logic across your entire site, regardless of how or where cookies are introduced. **What CookieHub Adds to Drupal** **Regulatory compliance** with GDPR, CCPA, LGPD, and similar laws **Automatic Cookie Blocking** to prevent premature tracking **Consent logging** for audit and compliance evidence **Cookie discovery** for third-party scripts and integrations **Full visual customization** to match your Drupal theme **Simple maintenance** No need to update code when cookies change ### How It Works CookieHub integrates cleanly at theme level in Drupal. No custom modules. No backend logic. No heavy customization. Setup takes only a few steps — follow the [implementation guide](https://support.cookiehub.com/article/429-how-to-install-cookiehub-in-drupal). **1. Get Your CookieHub Integration Code** In the CookieHub dashboard, create your domain and copy the implementation snippet from the _Inline HTML tag_ setup. **2. Open Your Drupal Theme Settings** Log into Drupal and go to **Appearance**. Select the theme you want to use and click **Settings**. **3. Insert CookieHub into the Header Code** Open the **Advanced Settings** tab and paste the CookieHub code into the **Header code** field. **4. Save & Enforce Compliance** Save your configuration. CookieHub now manages cookie consent, blocks tracking until approval, and records user preferences automatically. #### Frequently Asked Questions **Do I need to install a Drupal module to use CookieHub?** No. CookieHub works by inserting a script at theme level, so no Drupal module installation is required. **Will CookieHub block cookies added by Drupal modules?** Yes. CookieHub blocks non-essential cookies regardless of whether they are introduced by modules, themes, or external scripts. **Can I customize the consent banner to match my Drupal theme?** Yes. CookieHub provides full control over layout, colors, text, and placement. **Does CookieHub work with Drupal multisite setups?** Yes. You can configure each domain separately in the CookieHub dashboard and apply the appropriate configuration per site. **Can I add a cookie declaration page in Drupal?** Yes. CookieHub generates a dynamic cookie declaration that can be embedded into any Drupal page or content type. **Does CookieHub support multilingual Drupal sites?** Yes. CookieHub supports multiple languages and can automatically adapt the banner based on the visitor’s browser language. --- # DSAR Management Platform - Secure, Encrypted Request Handling URL: https://www.cookiehub.com/dsar-management Last updated: May 20, 2026 ## DSAR Management Platform A complete DSAR management platform with built-in verification, workflow automation, and encrypted disclosure delivery. Designed for teams that need control, not just compliance. ### Structured request handling without manual overhead This is not a form builder. It is a controlled intake and validation layer that behaves predictably in production environments. **Step 1: Embed the widget** Deploy a lightweight script on any page. The widget runs in isolation to avoid conflicts and supports multilingual environments out of the box **Step 2: Verify identity** Requests remain inactive until verified. Email-based confirmation ensures only legitimate requests enter your workflow and defines when compliance timelines begin. **Step 3: Manage requests centrally** Track requests across domains, filter by type, and assign internal systems. Deadlines are visible and enforced within the workflow. **Step 4: Deliver encrypted disclosures** Files are collected, encrypted, and delivered through expiring download links. No manual file handling or insecure transfers. ### Built for Developers, Designed for Control This is not a form builder. It is a controlled intake and validation layer that behaves predictably in production environments. **Isolation by default** Runs inside a Shadow DOM component to prevent layout or styling conflicts. **Localization support** Automatically adapts to page language with override options when needed. **Structured request intake** Collects all required data, including support for on-behalf requests such as legal representatives. **Request validation pipeline** CSRF protection, origin validation, and domain key matching ensure only valid requests are accepted. ### Operational control over every request Most DSAR tools stop at submission. This system is built for handling what comes after. **System-based workflows** Attach internal systems such as billing, infrastructure, or HR tools to each request and track completion per system. **Blind-index search** Search encrypted personal data without exposing it. Names and emails are indexed securely, allowing retrieval without decryption. **Deadline enforcement** Track standard response windows with built-in support for extensions within regulatory limits. **Resolution standardization** Use templates to maintain consistent responses across request types. **Audit logging** Every action is recorded with timestamps, user attribution, and request history. ### Zero-trust handling of personal data The system is designed to reduce exposure at every stage, not just protect stored data. **End-to-end encryption** All personal data and files are encrypted using AES-256-GCM during storage and transfer. **S3 vault storage** Disclosure files are stored in a dedicated encrypted vault. Use the default secure setup or connect your own S3-compatible storage. **Data minimization** Files are not retained longer than necessary. Expired disclosures are automatically removed from storage. **Abuse prevention** Built-in protections including honeypot detection, rate limiting, and strict API validation reduce spam and automated misuse. #### Frequently Asked Questions **How does identity verification work?** After submission, the user receives a verification email. Only verified requests move forward, ensuring invalid or fraudulent submissions are filtered out. **How do you prevent unauthorized or fraudulent requests?** Requests are validated through multiple layers including CSRF protection, origin checks, API key validation, and rate limiting. Automated abuse and spam are actively blocked. **How are disclosure files delivered securely?** Files are encrypted, bundled, and stored in a secure vault. Data subjects receive time-limited download links, and files are deleted after the retention period. **Can we customize workflows for internal systems?** Yes. You can define internal systems and attach them to each request, ensuring a consistent process for collecting and reviewing data. **Can we use our own storage?** Yes. You can connect your own S3-compatible storage to control where files are stored and how long they are retained. **Does this replace manual DSAR processes or integrate with them?** It can replace manual workflows entirely or be integrated into existing processes depending on how your team operates. --- # Enterprise Consent Management Platform URL: https://www.cookiehub.com/enterprise Last updated: October 8, 2026 ## Enterprise consent management ##### ISO 27001 certified, hosted in the EU, and built to run consent across large sites and many brands CookieHub Enterprise adds single sign-on, DSAR management, API configuration and advanced consent reports to the platform, with dedicated account management, priority support and custom agreements. Consent data is stored and processed within the EEA, on Amazon Web Services. ### What Enterprise adds **Single sign-on** Sign in through Google Workspace, Microsoft Entra ID or any SAML 2.0 identity provider, such as Okta, Ping, ADFS or OneLogin. Users are created on their first sign-in, and access is managed in your identity provider. **DSAR management** Handle data subject access requests in one place, with centralized request handling, tracking and compliance workflows. **Full API access** Automate compliance workflows and manage configurations through the CookieHub [Management API](https://www.cookiehub.com/management-api). **Advanced consent reports** Granular data on user interactions, consent rates and regional performance across your domains. **Dedicated account management** Priority support, onboarding assistance and technical reviews, with implementation, customization and optimization services. **Custom agreements** Custom master service agreements and service level agreements, and a signed or customized data processing agreement on request. ### Security and data protection CookieHub is [ISO 27001 certified](https://www.cookiehub.com/blog/cookiehub-is-now-iso-27001-certified), and SOC 2 compliance is in progress. As a data processor under Article 28 GDPR, CookieHub applies the same technical and organizational measures to every customer. Read the full [security and data protection practices](https://docs.cookiehub.com/getting-started/data-and-security/security-practices). **Hosted in the EU:** Application data, the consent log and encrypted backups are stored and processed within the EEA, on Amazon Web Services. **Delivered worldwide, stored in the EEA:** The CookieHub script is served from Bunny CDN and Amazon CloudFront close to each visitor, while the consent data itself stays in the EEA. **Pseudonymous visitor data:** CookieHub does not intentionally collect directly identifiable visitor data. Consent log entries keep an anonymized IP address and are deleted automatically after 12 months. **Documented processing:** A data processing agreement under Article 28 GDPR, a published list of sub-processors, and Standard Contractual Clauses where data leaves the EEA. **Built for high traffic** Enterprise plans start at 1,000,000 sessions a month, include scanning of up to 10,000 pages, and are configured by the CookieHub team around your requirements. **Every region, every framework** Geolocation applies the right consent rules in each region, with IAB TCF 2.4, Google Consent Mode v2 and the IAB Global Privacy Platform supported, and the consent dialog available in 62 languages. CookieHub is a Gold Google Certified CMP. #### Enterprise FAQ **Is CookieHub ISO 27001 certified?** Yes. CookieHub is [ISO 27001 certified](https://www.cookiehub.com/blog/cookiehub-is-now-iso-27001-certified), and SOC 2 compliance is in progress. **Where is our data stored?** Within the EEA, on Amazon Web Services. Content delivery and network protection run worldwide, but the consent data stays in the EEA. Every provider and its country is listed under [sub-processors](https://docs.cookiehub.com/getting-started/data-and-security/sub-processors). **Can we have our own DPA, MSA or SLA?** Yes. The standard data processing agreement is part of the Terms of Service, and Enterprise customers can request a signed or customized version. Enterprise also supports custom master service agreements and service level agreements. One DPA term is the same for every customer: CookieHub's general authorization to engage sub-processors. **Which identity providers does SSO support?** Google Workspace, Microsoft Entra ID, and any SAML 2.0 identity provider, such as Okta, Ping, ADFS or OneLogin. SSO is available on Enterprise plans; see the [SSO documentation](https://docs.cookiehub.com/account/sso). **How long is consent data kept?** Consent log entries are kept for 12 months and then deleted automatically. The period is the same for every subscription. Deleted data remains in encrypted backups for at most 90 days. **How is Enterprise priced?** Enterprise starts at 1,000,000 sessions a month. Book a demo or contact sales for a quote based on your traffic and requirements. --- # Florida FDBR Cookie Consent and Compliance URL: https://www.cookiehub.com/fdbr Last updated: June 16, 2026 ## Florida FDBR Cookie Consent and Compliance The Florida Digital Bill of Rights (FDBR) establishes a framework for how personal data must be handled in Florida and sets out obligations for businesses while giving consumers greater control over their information. Are you ready to comply? ### What your business needs to know about FDBR The Florida Digital Bill of Rights (FDBR) is one of many different state-level privacy laws in the United States. Coming into effect in 2024, the FDBR strengthens consumer privacy and data protection rights for Florida residents and is comparable to similar laws in other states. It also establishes data protection obligations for businesses that interact with Florida residents or conduct business in the state. ### What does FDBR compliance require? FDBR requires organizations to ensure: **Data security:** Implement measures to protect data from unauthorized access **Data minimization:** Only collect the data necessary to do the discrete, stated task **Transparency:** Provide clear privacy notices **Third-party service provider management:** Ensure vendor contracts are in line with FDBR and that third parties will support the obligation to meet and comply with FDBR ### Who needs to comply with FDBR? The bill only applies to larger businesses with over 1 billion USD in revenue or those that derive half their revenue from digital ad sales, operate digital distribution platforms, or home virtual assistants. The law requires these firms to deliver annual privacy notices outlining the sale of any sensitive or biometric data, giving consumers a clear picture of what personal data is being sold. Privacy laws frequently change, so it is prudent to align and comply regardless of whether it is required. ### Consumer rights under the FDBR The FDBR is similar to other state-level privacy legislation, granting Florida residents the right to: **The right to know** Confirm whether and how a business is processing their data **The right to delete** Request the deletion of personal data **The right to correct** Correct inaccuracies in their personal information **The right to access** Obtain a copy of their personal data **The right to opt out** Consumers can opt out of the collection or processing of sensitive data, such as precise geolocation information; they can also opt out of targeted advertising, data sales, or profiling based on their personal data ### Why cookies as part of FDBR compliance Under FDBR, businesses must obtain clear and informed user consent for cookies. Consent must be freely given and unambiguous, meaning pre-ticked boxes or implied consent won’t meet compliance standards. Cookie banners require clear visibility and simple language to explain cookie use and purposes, with users given the options to accept, reject, or manage their cookie preferences. It’s for this reason that consent management platforms like CookieHub are an essential tool to keep businesses on the right side of Florida’s regulations. ### Penalties for FDBR non-compliance Penalties for failure to comply are more severe than in comparable state legislation, with fines up to 50,000 USD per violation, which can be tripled if the violation involves children’s data, a refusal to correct or delete personal data, or continued selling of data after an opt-out request. The law makes no provision for consumers to sue for violations; enforcement is undertaken by the state attorney general’s office. While most state privacy laws provide a cure period to give businesses time to rectify violations, the 45-day cure period in Florida is discretionary. ### How to comply with the FDBR Businesses can also take additional steps to ensure compliance and a consent-first mindset: **Conduct data audits:** Review current data practices to identify areas that need adjustment to align with FDBR **Update privacy policies:** Revise privacy notices to clearly outline data practices, consumer rights, and how to exercise those rights **Implement consent management:** Get effective management and control of cookie use with a comprehensive consent management platform like CookieHub **Employee training:** Offer staff education programs on the importance of data privacy and FDBR compliance #### Frequently Asked Questions **What is the scope of the Florida Digital Bill of Rights (FDBR)?** The FDBR applies to businesses and organizations that collect, process, or handle the personal data of Florida residents. It sets standards to protect digital privacy and consumer rights in the state of Florida. **What is personal data under FDBR?** Personal data refers to any information that can identify, relate to, describe, or be linked to an individual living in Florida. This includes names, addresses, email addresses, phone numbers, and other identifying details. **What is sensitive data according to the FDBR?** Sensitive data is a specific subset of personal data that includes highly private information such as social security numbers, financial account details, health records, biometric data, and precise geolocation information. **Who is the regulatory authority for Florida’s FDBR?** The Florida Attorney General’s office is the primary regulatory authority responsible for enforcing the Florida Digital Bill of Rights and overseeing compliance. **Who is exempt from FDBR rules?** Certain entities such as government agencies, non-profit organizations, and businesses with minimal data processing activities may be exempt from some or all FDBR requirements. Specific exemptions are detailed in the law. **Where can I get more information about the Florida Digital Bill of Rights?** For more details, visit the official Florida Attorney General’s website or the dedicated FDBR page provided by the Florida government. --- # Supported Privacy Frameworks | GPC, IAB TCF & Consent Mode URL: https://www.cookiehub.com/frameworks Last updated: September 25, 2026 ## Future-Ready Privacy Framework Support Keep pace with shifting privacy requirements. CookieHub includes built-in support for today’s most important consent and privacy frameworks, so your consent signals reach the right partners, browsers, and ad platforms in the right format. ### Close the gap between privacy compliance and measurable results Modern compliance is not just a cookie banner. It is the way your site communicates consent choices to the wider advertising, analytics, and data ecosystem. CookieHub acts as the hub that interprets user choices and passes them on consistently across the tools, platforms, and regulatory standards your business depends on. ### Key Signals for Advertising and Analytics Preserve conversion measurement and audience capabilities in Google Ads and GA4 while aligning with requirements like the Digital Markets Act (DMA). Send consent status to Bing Ads and Microsoft Advertising to support attribution and campaign performance while staying compliant. Only enable heatmaps and session recordings when permitted, so you can learn from user behavior without overstepping privacy expectations. Tell Amazon Ads whether UK and EEA visitors consented to advertising, so it accepts their data on websites that do not use IAB TCF. ### Global Compliance Standards A widely adopted standard for programmatic advertising in Europe, helping ensure your consent signals are understood by a large vendor ecosystem. One technical framework designed to support compliance across multiple US state privacy laws and other emerging requirements. Automatically honor Global Privacy Control, the browser signal for opting out of the sale or sharing of personal information, recognized under the CCPA/CPRA and a growing number of US state privacy laws. ### Native Platform Integrations A tight integration with Shopify’s privacy system to manage tracking and consent behavior across your storefront. A common language that helps WordPress plugins coordinate consent status, keeping your site experience consistent. Sync consent choices into HubSpot by updating contact records and tracking behavior based on real-time user decisions. --- # Geo-Targeted Cookie Consent URL: https://www.cookiehub.com/geo-targeting Last updated: July 2, 2026 ## Stay Compliant, Everywhere Tailor your website’s cookie consent behavior based on geographic location with CookieHub’s powerful “Geo-targeting” feature. Stay compliant with varying global data privacy regulations and provide a seamless user experience for your audience. ### Why Geo-Targeting Matters With data privacy laws differing by region, CookieHub enables you to create specific cookie consent methods for each region. Whether it’s country-specific, US states, or a group of countries, CookieHub offers the flexibility to stay compliant across the globe. #### **Optimize Your User Experience** Geo-targeting feature to automatically adjust cookie consent dialogs based on the user’s location. Show consent options only in countries where they are legally required, ensuring minimal user distraction. - **Automatic Compliance:** Keep your site compliant with privacy laws like GDPR. - **Seamless User Experience:** Services and tags will load uninterrupted in regions without cookie laws. - **Premium Feature:** Geo-targeting is available with CookieHub’s premium subscriptions, allowing you to tailor cookie behavior based on geographic locations #### **Pre-Defined Regions** CookieHub comes with several pre-defined groups, simplifying the compliance process for you: - Europe (EU and EEA member states, United Kingdom and Switzerland). - Countries with laws requiring explicit consent. - US states that require cookie notices and opt-out options. - Countries where opt-out methods may be sufficient. - [**See full list of regions here.**](https://docs.cookiehub.com/features/regions) **Get 14 days free!** Select any plan and get the first 14 days free so you can try it out and see how we can help you manage your websites cookies. **Compare our plans** CookieHub is a subscription service that offers flexible pricing plans to suit the needs of websites of all sizes. Find the plan that works for you. ### CookieHub Features Take control of your cookie privacy with confidence. Explore our features designed for simplicity and built for reliability. **Cookie Scanner** Scans your website for you and detects the cookies that are in use. **Cookie Declaration** Automatically generates a detailed list of the cookies in use on your site. **Pre-Consent** Gain your customers trust by ensuring their privacy is taken seriously. **Consent Log** Log and store user consents along with necessary information required... **Consent Mode Scanner** Ensure Google Consent Mode V2 is correctly implemented on your site. **Geolocation** Automatically shows the correct consent framework depending on the users location. **Accessibility** CookieHub has fully embraced Web Content Accessibility Guidelines (WCAG) standards. **62 Languages** Changes language based on website content, browser preferences or URL prefix. **Reports** Detailed reports on consent responses, sessions and a lot of useful information. **Customer support** Fast and easily accessible support here to assist with any questions you have. **CCPA Compliance** CookieHub helps you protect your users privacy in California by complying to strict cookie consent laws. **TCF 2.4 Compliance** Promote transparency by allowing users to make informed choices about data processing and advertising preferences. **Google Consent Mode V2** As an advertiser, you can collect user data with the rights of users to maintain their privacy. **Google Certified CMP** We’re proud to announce our Google certification, solidifying our position as a trusted CMP for web managers. --- # Global Privacy Control (GPC): What It Is and How to Honor It URL: https://www.cookiehub.com/global-privacy-control Last updated: September 24, 2026 ## Global Privacy Control (GPC): what it is and how to honor it Global Privacy Control is a browser signal that tells a website “do not sell or share my personal information”. A growing number of US state privacy laws require or recognise universal opt-out signals such as GPC, and in many of those states a manual opt-out link alone is not enough. This page explains what the signal is, where honoring it is required by law, which browsers send it, how to check your own, and what CookieHub does when a visitor arrives with it switched on. ### What Global Privacy Control is GPC is a single yes-or-no signal. When a visitor turns it on, their browser adds a **Sec-GPC: 1** header to supported requests and sets **navigator.globalPrivacyControl** to true in JavaScript. The preference itself is binary and means **“do not sell or share my personal information”**. It carries nothing else. It does not say which law applies to the visitor, which vendors they object to, or whether they consent to analytics. It is not a consent string like the IAB TCF or GPP formats. It is a preference that the site must handle in accordance with applicable law. GPC was developed by a group of browser makers, publishers and privacy organisations, building on Do Not Track. The main difference is legal weight. Do Not Track never acquired comparable legal standing and was largely ignored by websites. GPC, by contrast, was designed to fit, among other things, the opt-out mechanisms of the California Consumer Privacy Act as amended by the CPRA, and it is now recognised by several US privacy laws. ### Where honoring GPC is required by law The legal force of GPC in the United States depends on each state’s laws. Twelve states currently have GPC or universal opt-out provisions in their privacy laws: - [California](https://www.cookiehub.com/ccpa) - [Colorado](https://www.cookiehub.com/cpa) - [Connecticut](https://www.cookiehub.com/ctdpa) - Delaware - Maryland - Minnesota - Montana - Nebraska - New Hampshire - New Jersey - Oregon - Texas The obligations are not identical. Colorado formally recognises GPC as a valid universal opt-out mechanism, and New Jersey requires covered controllers to honor universal opt-out mechanisms. Maryland works differently. A controller can satisfy certain opt-out obligations using either a conspicuous opt-out link or an opt-out preference signal. More states are following. Louisiana’s law, effective January 1, 2027, includes browser- and device-based opt-out provisions with its own conditions, while Vermont’s Act 145 adds an opt-out preference signal requirement from 2028. California has enforced GPC for several years. In 2022, Sephora reached a USD 1.2 million settlement with the California Attorney General in a case that involved, among other things, failing to process GPC signals. Where the law requires it, honoring GPC means treating the signal itself as the visitor’s opt-out request. A “Do Not Sell or Share” link that the visitor has to find and click will generally not satisfy that requirement on its own. #### What about the GDPR? **GPC does not replace consent required under the GDPR or ePrivacy rules.** European regulators have not formally recognised GPC as a universal substitute for cookie consent. Websites in the EU and UK therefore still need an appropriate opt-in mechanism before using non-essential tracking technologies. GPC may nevertheless be relevant in some circumstances as an expression of a user’s objection or withdrawal of consent. ### Which browsers send GPC Support varies significantly between browsers: **Brave:** GPC is enabled by default on desktop and Android. On iOS, Brave exposes the JavaScript signal but does not currently send the HTTP header. **DuckDuckGo:** Its browsers and browser extension enable GPC by default. **Firefox:** Built in and available under Privacy & Security. It is enabled automatically in Private Browsing. **Chrome and Edge:** No native GPC support in current stable releases. Compatible extensions can add it, so most Chrome and Edge traffic will not carry the signal. **Safari:** No native GPC support in the current stable release. ### How to check whether GPC is on in your browser You can check whether your browser exposes or sends GPC in a few seconds: **Open the developer console:** On any page, open your browser’s developer tools, switch to the Console tab and type navigator.globalPrivacyControl. If it prints true, your browser exposes GPC. If it prints false or undefined, it does not. **Or visit globalprivacycontrol.org:** The GPC project’s own site detects the signal and tells you whether your browser is sending it. **Then turn it on, if you want it:** In Firefox, look under Privacy & Security for the option to tell websites not to sell or share your data. In Brave and DuckDuckGo it is already on. In Chrome or Edge, install a compatible extension. Safari does not currently offer native support. **To test your own website:** Turn GPC on, clear your cookies, and load your site as a visitor from California. You should not be required to make a second opt-out request, and your advertising and marketing setup should respect the opt-out. Depending on your setup, that can mean preventing relevant tags from firing or putting supported vendors into their applicable opt-out or restricted-processing mode. ### What honoring GPC means for your website The details vary by state, and California’s regulations are among the most specific. When a visitor arrives with GPC on, your site should: **Treat it as an opt-out of sale and sharing:** For that visitor, processing that constitutes sale, sharing or targeted advertising under the applicable law must stop or operate in the relevant opt-out or restricted mode. Depending on your setup, that may mean blocking advertising cookies and pixels entirely or passing the opt-out state downstream so vendors restrict their processing. **Not require a second opt-out request:** The browser signal itself must be processed as the visitor’s request. You should not require them to click another “Do Not Sell or Share” button or provide additional information before honoring it. **Confirm that the signal was honored:** California’s regulations require covered businesses to display whether an opt-out preference signal has been processed as a valid request to opt out of sale or sharing. **Pass the opt-out downstream:** Your advertising, analytics and other relevant vendors need to receive the appropriate signal. The IAB GPP string carries a GPC flag together with sale and sharing opt-out information for this purpose. Some vendors also act directly on the signal. Google, for example, applies restricted data processing when it receives GPC from visitors in several applicable US states. **Not require an account or extra steps:** Honoring GPC cannot depend on the visitor logging in, verifying their identity or filling in a form. It applies to the browsing session as it arrives. **Take earlier preferences into account:** If a visitor previously allowed sale or sharing on your site and later arrives with GPC enabled, California’s regulations allow you to notify them of the conflict and offer them the opportunity to consent specifically. The choice must remain theirs and must not result from a pre-ticked box or dark pattern. ### How CookieHub handles GPC GPC support is built into the CookieHub widget and is always on. There is nothing to enable: **Detected automatically** The widget reads the GPC signal when the page loads, in every region. No configuration, extra script or per-region switch is required. **Treated as Do Not Sell or Share** A visitor sending GPC gets the same sale-and-sharing opt-out as someone who clicked your “Do Not Sell or Share My Personal Information” link. The opt-out is exposed to Google Tag Manager so your tags can respond to it. Where the region uses the IAB GPP or US Privacy frameworks, the opt-out and GPC flag are written into the strings your vendors read. **No standard opt-out banner for California** CookieHub processes the signal automatically without asking a California visitor to make another opt-out request. Instead of the standard banner, the privacy settings show that the signal was honored. **Other US states keep their configured banner** Visitors from other states continue to see the banner you have configured, with the GPC opt-out already applied. **Optionally switch off cookie categories** If you want GPC to do more than signal vendors, configure the preference center so that an opt-out also disables selected cookie categories such as Marketing or Analytics. ### Frequently asked questions about Global Privacy Control **What does GPC mean?** GPC stands for Global Privacy Control. It is a browser setting that sends websites a signal meaning “do not sell or share my personal information”. Businesses covered by US state privacy laws containing opt-out preference signal provisions generally need to process that signal in accordance with the applicable law, without requiring the visitor to find an additional opt-out link or fill in a form. **What is the difference between GPC and Do Not Track?** Both are signals sent by the browser, but their legal weight is very different. Do Not Track never obtained comparable legal recognition and was largely ignored by websites. GPC was designed to fit, among other things, the opt-out provisions of the CCPA/CPRA, and it is now recognised or required under the privacy laws of a growing number of US states. **Is honoring GPC mandatory?** For many businesses covered by these laws, yes. Twelve states currently have GPC or universal opt-out provisions: California, Colorado, Connecticut, Delaware, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon and Texas. Louisiana follows in 2027 and Vermont in 2028. The details differ. Most require or recognise processing universal opt-out signals, while Maryland also allows certain obligations to be met with a conspicuous opt-out link. Each law has its own criteria for determining which businesses are covered. **Does GPC apply under the GDPR?** Not as a substitute for consent. European regulators have not formally recognised GPC as a replacement for cookie consent. In the EU and UK, you therefore still need an appropriate opt-in mechanism before using non-essential tracking technologies. The W3C specification indicates that GPC may nevertheless be relevant under the GDPR as an expression of a user’s objection or withdrawal of consent. European regulators have not yet established a general legal effect for GPC in that context. **Does GPC affect my analytics?** It depends on how the analytics data is used. Analytics that involves sale, sharing, cross-context behavioural advertising, or a provider using the data for its own advertising purposes may be affected by GPC. First-party measurement that does not involve those activities may fall outside the GPC opt-out, depending on the applicable state law and your vendor setup. If you want a cleaner rule, you can also configure CookieHub to disable the Analytics category for visitors sending GPC. **How do I enable GPC in CookieHub?** You do not need to. GPC detection is always on. A visitor sending the signal is treated as if they had clicked the “Do Not Sell or Share” link. The opt-out is exposed to Google Tag Manager, and where the region uses IAB GPP or US Privacy, the relevant opt-out state is passed to supported vendors. If you also want the signal to disable specific cookie categories, open the region’s preference center settings in the Dashboard and select the categories to switch off on opt-out. **How do I test that my website honors GPC?** Turn GPC on in your browser, clear your cookies for the site, and visit it as a California visitor, using a VPN if necessary. You should not be required to make another opt-out request. The privacy settings should confirm that the signal was honored, and your advertising setup should respect the opt-out, either by preventing relevant tags from firing or by putting supported vendors into their applicable opt-out or restricted-processing mode. If you use IAB GPP, check the string through the __gpp API. The GPC flag and applicable sale and sharing opt-outs should be set. **What does “Opt-out preference signal honored” mean?** California’s regulations require covered businesses to display whether they have processed an opt-out preference signal as a valid request to opt out of sale or sharing. “Opt-out preference signal honored” tells the visitor that the site’s privacy mechanism has recognised and processed the preference sent by their browser. CookieHub displays this automatically to California visitors in the privacy settings. --- # Google Certified CMP URL: https://www.cookiehub.com/google-certified-cmp Last updated: October 8, 2026 ## CookieHub is a Gold Google Certified CMP Discover the Power of CookieHub – Your Google Certified Consent Management Platform (CMP)! At CookieHub, we’re proud to announce our Google certification, solidifying our position as a trusted CMP for web managers. ### Google’s New CMP Requirements - Publishers using AdSense, Ad Manager or AdMob must use a Google-certified CMP integrated with the TCF when serving personalized ads to users in the EEA, the UK and Switzerland. - Google-certified CMPs are assessed against Google certification criteria, primarily focusing on TCF (Transparency and Consent Framework) compliance. - Publishers who use the TCF and also work with ad technology providers not registered with the TCF are supported by Google through the Additional Consent specification. - Google's CMP assessments ensure that CMPs supporting the Additional Consent specification can implement it correctly. ### CookieHub Features Take control of your cookie privacy with confidence. Explore our features designed for simplicity and built for reliability. **Cookie Scanner** Scans your website for you and detects the cookies that are in use. **Cookie Declaration** Automatically generates a detailed list of the cookies in use on your site. **Pre-Consent** Gain your customers trust by ensuring their privacy is taken seriously. **Consent Log** Log and store user consents along with necessary information required... **Consent Mode Scanner** Ensure Google Consent Mode V2 is correctly implemented on your site. **Geolocation** Automatically shows the correct consent framework depending on the users location. **Accessibility** CookieHub has fully embraced Web Content Accessibility Guidelines (WCAG) standards. **62 Languages** Changes language based on website content, browser preferences or URL prefix. **Reports** Detailed reports on consent responses, sessions and a lot of useful information. **Customer support** Fast and easily accessible support here to assist with any questions you have. **CCPA Compliance** CookieHub helps you protect your users privacy in California by complying to strict cookie consent laws. **TCF 2.4 Compliance** Promote transparency by allowing users to make informed choices about data processing and advertising preferences. **Google Consent Mode V2** As an advertiser, you can collect user data with the rights of users to maintain their privacy. **Google Certified CMP** We’re proud to announce our Google certification, solidifying our position as a trusted CMP for web managers. --- # Google Consent Mode Checker URL: https://www.cookiehub.com/google-consent-mode-checker Last updated: July 2, 2026 ### What the scanner does? Our scanner checks your webpage to see if Google Consent Mode is set up correctly. It verifies whether consent signals are properly sent to Google services (such as Google Analytics, Google Ads, and other tracking scripts) and detects any errors or misconfigurations affecting compliance and tracking accuracy. If issues are found, we provide actionable fixes to help you stay compliant. ### CookieHub Features Take control of your cookie privacy with confidence. Explore our features designed for simplicity and built for reliability. **Cookie Scanner** Scans your website for you and detects the cookies that are in use. **Cookie Declaration** Automatically generates a detailed list of the cookies in use on your site. **Pre-Consent** Gain your customers trust by ensuring their privacy is taken seriously. **Consent Log** Log and store user consents along with necessary information required... **Consent Mode Scanner** Ensure Google Consent Mode V2 is correctly implemented on your site. **Geolocation** Automatically shows the correct consent framework depending on the users location. **Accessibility** CookieHub has fully embraced Web Content Accessibility Guidelines (WCAG) standards. **62 Languages** Changes language based on website content, browser preferences or URL prefix. **Reports** Detailed reports on consent responses, sessions and a lot of useful information. **Customer support** Fast and easily accessible support here to assist with any questions you have. **CCPA Compliance** CookieHub helps you protect your users privacy in California by complying to strict cookie consent laws. **TCF 2.4 Compliance** Promote transparency by allowing users to make informed choices about data processing and advertising preferences. **Google Consent Mode V2** As an advertiser, you can collect user data with the rights of users to maintain their privacy. **Google Certified CMP** We’re proud to announce our Google certification, solidifying our position as a trusted CMP for web managers. --- # Google Consent Mode v2 Made Easy | CookieHub CMP Integration URL: https://www.cookiehub.com/google-consent-mode-v2 Last updated: June 16, 2026 ## Implement Google Consent Mode v2 ##### Easily integrate CookieHub CMP with Google Consent Mode v2 Keep your campaigns running smoothly and ensure seamless ad tracking and analytics with a certified Google CMP partner. ### Easy CookieHub Consent Mode setup Here’s how you can easily get started by activating Google Consent Mode in CookieHub: To use Consent Mode v2 with CookieHub, ensure your platform is updated to version 2.8.0 or later. This version includes support for the new consent signals and integration capabilities with Google services. **With Google Tag Manager** [Follow the steps in our detailed documentation](https://docs.cookiehub.com/installation/google-tag-manager) to install Google Consent Mode with Consent Mode with Google Tag Manager. CookieHub offers a convenient Google Tag Manager template that comes with integrated consent mode support, making it easy and hassle-free to implement into your existing Google Tag Manager container. **Without Google Tag Manager** If you’re not using Google Tag Manager (GTM) to integrate CookieHub, you can still enable consent mode v2 through the CookieHub dashboard by [following the steps in the CookieHub documentation](https://docs.cookiehub.com/installation/consent-mode-v2#without-google-tag-manager). ###### Basic or advanced Consent Mode implementation options You can implement Consent Mode on your website or app using either of two methods – a [basic or an advanced implementation](https://docs.cookiehub.com/installation/consent-mode-v2#basic-consent-mode). **Basic implementation**: Prevents Google tags from loading until a user interacts with a consent banner. No data is transmitted to Google before user interaction. When the user consents, Google tags load and send the consent states to Google. If the user does not consent, no data is sent to Google, and tags are blocked from firing. **Advanced implementation**: Google tags load when a user opens the website or app, setting default consent states (usually denied). The tags send cookieless pings until the user interacts with the banner. When consent is granted, the tags send full measurement data. This enables improved, advertiser-specific modeling compared to the basic implementation. ### Why Google Consent Mode matters Google Consent Mode is a tool that allows websites to adjust how Google services behave based on user consent. User consent is now table stakes for doing digital business – but there is balance to be struck between protecting user privacy and enabling non-intrusive, personalized advertising. **Better data, easier consent\ ** Before Google Consent Mode, digital analytics data suffered from being not quite complete because tracking required explicit user consent before any data could be collected. But by integrating your Google-certified CookieHub CMP with Google Consent Mode, accurate insights and conversion measurements from Google Ads, Google Analytics, and Google Tag Manager are just a click away – and compliant with relevant data privacy policies. **Google Consent Mode is a must\ ** As of early 2024, Google Consent Mode has been required to access measurement, ad personalization, and remarketing features for users in the European Economic Area and the UK. Aligning with Google’s EU user consent policy means you gather all this valuable data, even in the absence of consent. ### Activate Google Consent Mode v2 for your Google-certified CookieHub CMP Consent mode is designed to help advertisers and publishers comply with data privacy laws. It works by enabling users to specify their consent preferences for tracking and analytics before any data is sent to Google’s servers. Once consent preferences are set, consent mode determines which tags should be loaded, ensuring only authorized tags collect data. **Simple, seamless integration:** CookieHub’s user-friendly interface simplifies the integration process with Consent Mode v2 and any CMS and easily integrates with Google Tag Manager. **Work with a Google-certified CMP partner:** CookieHub is a Google-certified consent management platform (CMP) **Future-proof compliance:** Stay ahead of evolving data privacy regulations with automatic updates and ongoing support, automating consent management from scanning to cookie blocking to audits. ### CookieHub CMP consent solution benefits **Achieve effortless compliance with GDPR, ePrivacy, and the Digital Markets Act** CookieHub is a trusted consent management platform (CMP) that helps you meet the latest data privacy requirements with ease. Automate consent collection, stay fully compliant, and keep your digital business running smoothly in Europe and around the world. **Collect and activate consent-driven data for higher-quality data** Safeguard your ad revenue through consent-forward, privacy-compliant marketing data and the opportunities it opens. CookieHub integrates seamlessly with Google Consent Mode and offers flexible customization to ensure you capture and transmit user consent with precision. **Drive user consent with built-in Consent Mode trust** Create deeper trust and connections with users, and a more trustworthy user experience for your website visitors while maintaining flexible control over customization and design. Stand out among competitors and build trust to drive engagement and revenue. #### FAQ about Google Consent Mode v2 Understanding the why and how behind Google Consent Mode doesn’t have to be hard – here are some of the most frequently asked questions to get to the heart of Google Consent Mode. **What is Google Consent Mode v2?** Google introduced the Consent Mode tool on September 3, 2020, as a way to bridge the gap between data privacy requirements and effective digital marketing. At its core, Consent Mode allows businesses to continue measuring website activity and ad conversions in a compliant manner even without explicit user consent, ensuring analytics remain valuable while respecting user choices. Since the introduction of stricter privacy regulations worldwide, such as the EU’s GDPR, organizations have been required to obtain user permission before collecting or processing personal information. That means nearly every website operator and data controller must take consent seriously. By integrating Google Consent Mode with CookieHub, companies can still gather reliable insights for their marketing teams without running afoul of data privacy laws. The result is a consent-driven model without undermining marketing efforts or business growth. From a technical standpoint, Google Consent Mode lets websites convey a user’s consent status directly to a website, enabling tags to adjust their behavior. Consent mode is integrated directly into a consent management platform, like CookieHub, to adapt the behaviors of Google solutions, such as Google Analytics, Google Ads, and other third-party tags based on user consent selections. **What are the differences between the old Google Consent Mode and the new Google Consent Mode v2?** Google Consent Mode v2 is an update to the first generation Consent Mode that aims to respect user privacy and comply with the EU’s data privacy regulations. There are several critical differences between the old and new Google Consent Mode versions. **Original Google Consent Mode**: - Optional and used to enable modeling - A Google-certified CMP was optional - Measurement only begins once users has consented via Google or third-party services **Google Consent Mode v2**: - Consent Mode now required for tracking - A Google-certified CMP is mandatory to be able to use Consent Mode - Measurement only begins if the user has consented, and the corresponding signal has been received by Google via Google Consent Mode. (This will occur if your consent mode signals are correctly implemented.) - New parameter inclusions: ad\_user\_data and ad\_personalisation. These give websites the ability to manage and align with user consent preferences. **How does Google Consent Mode work?** Consent Mode is a tool, an API, that receives users’ consent choices from your cookie banner or widget, dynamically adapting the behavior of Google Analytics, Google Ads, and third-party tags that create or read cookies. This feature preserves a visitor’s consent state across different pages they visit, ensuring consistent application of their choices. Consent Mode operates by adding an extra parameter to requests sent to Google’s servers, indicating user consent status for ad personalization and analytics. Initially, when no consent is given, Google receives limited information (e.g., IP address, page URL). Once consent is provided, the parameter updates to reflect the user’s choice, influencing subsequent data requests. What does this look like in practice? It can vary depending on whether you already use CookieHub or not, and whether you are using Google Tag Manager. Here are generic implementation steps; however, [please refer to our Consent Mode documentation](https://docs.cookiehub.com/installation/consent-mode-v2) for detailed instructions. 1. Create your consent banner 1. Implement CookieHub CMP on your website 1. Enable Consent Mode v2 1. Get the data and insight you need thanks to Consent Mode **What are Consent Mode parameters/tag settings?** Consent Mode introduces two tag settings – one for cookie management for analytics (analytics\_storage) and the other for cookie management for advertisement (ad\_storage). Google Consent Mode v2 adds two more tag settings – one for consent for sending user data to Google for online ad purposes (ad\_user\_data), and the other to set consent for personalized advertising (ad\_personalization). **analytics\_storage** Google Consent Mode regulates analytics cookies in relation to user consent with the analytics\_storage tag. Google Analytics adjusts the collection of data based on user’s consent. When consent is withheld, your site will still receives basic and non-identifying measurement data, including timestamps of site visits, whether users landed on your site, see how a user landed on your page, and so on. **ad\_storage** Google Consent Mode manages marketing cookies on your site based on user consent using the ad\_storage tag. Without user consent to marketing or advertising cookies, Google’s Consent Mode will not use these marketing cookies. Instead your site will still be able to display contextual ads based on anonymous data, not targeted, personal advertising. Google Consent Mode enables your site to record and measure conversions in aggregate to offer some insight to website owners while still ensuring GDPR compliance and enhanced marketing performance despite the missing individual-level data. Google Consent Mode also adapts Google tags’ behavior based on the user’s region, so if certain cookies may be set without consent for US users, for example, but the same cookies would require consent from EU users, Google Consent Mode handles this. **ad\_user\_data\ ** In Google Consent Mode v2, users give grant permission for their data to be collected and used specifically for ads. The parameter ad\_user\_data governs this. This consent covers things like demographic information, browsing behavior, and interaction with ads. Granting this consent, users allow Google to gather and analyze their data to enhance the relevance of the advertisements they see across the web. **ad\_personalization\ ** The tag ad\_personalization related to advertisements being customized to target users based on their preferences and behavior. This consent gives Google the permission to use users’ data to personalize the ads they see across Google’s services and the broader internet – both to serve relevant display ads and to irrelevant or repetitive ads. This tag is important for enabling a tailored online ad experience for users. **For whom is Google Consent Mode relevant and important?** Any business using Google ad and analytics services should consider Consent Mode important. More specifically, Consent Mode is most relevant for publishers, advertisers, marketing agencies and teams, web agencies, and any companies that implement consent banners and use Google Analytics and Google Ads. For advertisers, Consent Mode enables effective tracking of ad performance and better insight into ad campaign spend to improve ad bidding strategies. For marketers, Consent Mode allows for the continued collection of important user data in order to continue gathering and using insights that help deliver better marketing results. For website operators and owners, Consent Mode can facilitate a better understanding of user journeys and conversions on their sites. **How does Google Consent Mode help with conversions and better ad campaigns?** Google Consent Mode helps improve conversions** **and ad campaign performance in the following ways: **Preserves measurement accuracy** - Even if users decline certain cookies, Consent Mode uses modeling to fill gaps in conversion data. - This means you still see accurate reports of how ads are performing, without losing insights due to consent restrictions. **Improves conversion tracking** - With consent signals, Google Ads and Analytics know whether they can use cookies. - If cookies aren’t allowed, Consent Mode sends _cookieless pings_ to keep tracking essential actions (like purchases or sign-ups). **Better campaign optimization** - By recovering conversion data with modeling, Google Ads’ machine learning has more complete information. - This helps Smart Bidding optimize campaigns more effectively, leading to higher ROI. **Compliance + performance balance** - You remain GDPR and ePrivacy compliant while still keeping campaign insights. - This avoids the common trade-off of either respecting consent or losing conversion data. **How can I determine if Google Consent Mode is activated?** There are a number of ways to tell if Consent Mode is activated. If you are using a Google-certified CMP, which you should be, there should be a dashboard or setting that confirms Consent Mode is firing correctly. With [CookieHub’s Consent Mode Checker](https://www.cookiehub.com/google-consent-mode-checker), you can check whether Consent Mode is implemented properly. **What data privacy regulatory frameworks does Google Consent Mode pertain to? Is Google Consent Mode GDPR compliant?** Not every jurisdiction in the world is subject to a data privacy regulations that make Google Consent Mode essential. But for the most part, locations that do impose data protection regulations place demanding rules on how user data is collected, processed, and managed. In particular, GDPR in the EU and the EU User Consent Policy (a Google policy that requires Google users to disclose cookie use on their websites and apps to get user consent) are particularly relevant to Google Consent Mode. Note that using Google Consent Mode does not make a website or app GDPR (or any other data privacy regulation) compliant. **Do I need Google Consent Mode?** As of 2024, Google Consent Mode has been required if you collect and process user data and serve Google ads to users in the European Economic Area. **Does my business have to implement Google Consent Mode?** If your business is collecting and processing user data and serve Google ads to users in the European Economic Area, Google Consent Mode must be used. **What is the difference between a Google-certified CMP and a non-certified CMP?** At the most basic level, a Google-certified CMP (consent management platform) has been officially approved by Google to integrate with Consent Mode v2, ensuring compliance with Google’s ad and analytics requirements. What does it mean to be a [certified CMP Google Partner](https://support.google.com/admanager/answer/13554116?hl=en)? Google puts its certified partners through a rigid vetting process, evaluating a platform’s capability to manage user consent effectively, with particular attention paid to its abilities vis-à-vis Google’s advertising and analytics services. Platforms that achieve certification status have shown an adherence to industry best practices in data privacy. Certified CMP Google Partnership serves as the benchmark for websites, assuring users and businesses of a platform’s proficiency in handling consent management meticulously. A non-certified CMP may still collect and manage consent but isn’t verified by Google, so it might not fully support Consent Mode v2 or guarantee compatibility with Google Ads and Analytics. **Is CookieHub a Google-certified CMP?** Yes, CookieHub is proud to be a Google-gold certified content management platform. #### CookieHub is a Google Certified CMP Discover the Power of CookieHub – Google Certified Consent Management Platform (CMP) --- # Google Tag Gateway and Consent Mode with CookieHub URL: https://www.cookiehub.com/google-tag-gateway Last updated: October 12, 2026 ## Google Tag Gateway and CookieHub Google tag gateway (GTG) serves Google tags through your own domain instead of Google’s. It can be set up through a supported content delivery network (CDN) such as Cloudflare, a load balancer or your own infrastructure, and it may improve how durable your tags are and how reliable your measurement is. CookieHub is compatible with Google tag gateway. Because GTG can change the order in which scripts load, it can also change when Google tags receive consent information, so how you deploy it matters. This page explains the setups CookieHub recommends and how CookieHub flags the late consent signals a wrong setup can cause. ### How Google tag gateway affects Consent Mode Google Consent Mode depends on consent defaults being set before Google tags begin processing measurement that depends on consent. With GTG, a Google tag can load and initialize earlier than before, sometimes before CookieHub or Google Tag Manager has set those defaults. When that happens, Google may report a **late consent signal**: the tag started measuring, and the consent information arrived afterwards. Google reports these in Tag Assistant and in Google Ads and Google Analytics diagnostics. The cause is almost always load order. It is most likely with one-click CDN setups, where the CDN injects and starts the Google tag itself, which often leaves you no control over when it loads relative to your consent script. ### Setups CookieHub recommends Which setup to use depends on how CookieHub and your Google tag are loaded: **CookieHub and the Google tag both in Google Tag Manager (recommended):** The right choice for most sites. GTM controls the initialization order, so consent defaults are in place before measurement starts, and problems are easier to trace. **CookieHub loaded directly on the page (recommended):** CookieHub runs early in the page while GTG serves the Google tag, so consent defaults are usually available in time and you depend less on GTM’s load order. **Automatic Google tag setup through a CDN (use with caution):** Some CDN integrations configure and start the Google tag on their own. If CookieHub is loaded through GTM, the tag can begin measuring before CookieHub has set consent defaults. In that case, let GTM manage the Google tag instead. **A GTM container ID as the GTG tag (not recommended):** Configure GTG with a Google tag ID. Other identifiers can behave unexpectedly, depending on the implementation. ### Use advanced Consent Mode for tags enrolled in GTG Where a Google tag stays enrolled in GTG instead of being managed through GTM, CookieHub recommends advanced Consent Mode. It lets Google tags load and receive consent updates after they initialize while still respecting the consent defaults, so it works with a manual GTG setup where you control the order in which scripts load. ### How CookieHub catches late consent signals CookieHub checks your Consent Mode setup during website scans, looking at the order in which tags initialize, when consent state becomes available and how Consent Mode is configured. When it finds a likely late consent signal, it: **Warns you in the Action Center:** The issue appears as a warning, with guidance specific to your deployment where it is available. **Records it in your scan reports:** The finding is included in your website scan reports, alongside the rest of the scan results. **Points to the likely cause:** Common causes are a Google tag that starts before consent defaults are set, automatic Google tag setup through GTG while CookieHub loads through GTM, and Consent Mode deployed in the wrong order. ### If Google reports a late consent signal First confirm that the tag really is served through GTG (see below). Then use one or more of these, depending on your setup: - **Advanced Consent Mode**, so tags can receive consent updates after they initialize. - **Global Consent Defaults**, which set default consent states before the visitor interacts with the banner. - **Data Transmission Controls**, for more control over how data is sent to Google services. - **Google tags managed through GTM**, so consent defaults are applied before measurement begins. - **A manual GTG setup**, which gives you more control over the order in which scripts initialize. ### How to check that GTG is active Use Google Tag Assistant, which shows what actually happens in the browser: 1. Open Tag Assistant and connect to your website. 1. Select the Google tag or container you want to check. 1. On the Summary view, look at the Source field in the Tag Details panel. When GTG is active, your GTG provider’s icon appears beside the source, and hovering over it shows the platform and measurement path. To review the configuration itself, open your Google tag settings from Google Tag Manager, Google Ads, Google Analytics or Campaign Manager 360, go to Admin and open Google tag gateway for advertisers. Google recommends checking through these tools, and says it cannot vouch for results from the browser’s Network tab or third-party tools. ### Frequently asked questions **Does CookieHub support Google tag gateway?** Yes. CookieHub is compatible with Google tag gateway and supports Google Consent Mode and Google Tag Manager. How you deploy GTG still affects consent, so check the recommended setups above before you enable it. **Why would I use Google tag gateway?** GTG serves Google tags through your own domain instead of Google’s, which may improve how durable your tags are and how reliable your measurement is. It can be set up through a supported CDN, a load balancer or your own infrastructure. **Can I keep loading CookieHub through Google Tag Manager?** Yes. That is the setup CookieHub recommends for most sites, with the Google tag also managed in GTM. Avoid letting a CDN set up the Google tag automatically while CookieHub loads through GTM, because the tag can then start measuring before consent defaults are set. **What is a late consent signal?** A Google tag started processing measurement before consent information was available, usually because of the order in which scripts load. Google reports it in Tag Assistant and in Google Ads and Google Analytics diagnostics, and CookieHub flags likely cases in the Action Center and in scan reports. **Should I use basic or advanced Consent Mode with GTG?** For Google tags that stay enrolled in GTG, CookieHub recommends advanced Consent Mode, because it lets tags receive consent updates after they initialize while respecting the consent defaults. **Which ID should I use when setting up GTG?** A Google tag ID. Using a GTM container ID as the GTG tag is not recommended, because other identifiers can behave unexpectedly, depending on the implementation. ### Documentation - [Google tag gateway overview](https://docs.cookiehub.com/reference/google-tag-gateway) - [Deployment recommendations](https://docs.cookiehub.com/reference/google-tag-gateway/deployment) - [Understanding late consent signals](https://docs.cookiehub.com/reference/google-tag-gateway/late-consent-signals) - [Troubleshooting](https://docs.cookiehub.com/reference/google-tag-gateway/troubleshooting) Related: [Google Consent Mode v2](https://www.cookiehub.com/google-consent-mode-v2), [Google Tag Manager integration](https://www.cookiehub.com/google-tag-manager), [Google Consent Mode checker](https://www.cookiehub.com/google-consent-mode-checker). --- # CookieHub for GTM: Cookie Consent & GDPR Compliance URL: https://www.cookiehub.com/google-tag-manager Last updated: April 1, 2026 ## Cookie Consent for Google Tag Manager Implement GDPR, CCPA, and global privacy compliance directly within Google Tag Manager. With **CookieHub for GTM**, you gain full control over cookie consent and data privacy — no code changes, no manual configuration, no compliance gaps. ### Effortless Compliance, Centralized Control CookieHub’s official **Google Tag Manager template** makes it simple to deploy cookie consent and data privacy controls across all your Google tags. Enable **Consent Mode**, synchronize user preferences with your GTM container, and ensure all tags behave correctly according to user consent — instantly. **Key Benefits:** - Streamlined setup through GTM — no coding or complex configuration. - Automatic tag governance with built-in Google Consent Mode support. - Centralized management across multiple domains and regions. - Continuous compliance updates to align with global privacy laws. - Professional, user-friendly consent banner that builds trust. ### Why Use CookieHub with Google Tag Manager Managing cookie consent manually through scripts or plugins is time-consuming, inconsistent, and error-prone. By integrating **CookieHub with Google Tag Manager**, you centralize consent management, automate tag behavior based on user choices, and ensure global privacy compliance — all from a single, scalable setup. It’s the simplest way to make every GTM tag compliant without rewriting code or risking non-compliance. **Compliance Made Simple** Configure GTM tags to comply with GDPR, CCPA, ePrivacy Directive, and other global privacy regulations. CookieHub handles consent logic so you don’t have to. **Consent Mode by Default** Google Analytics, Google Ads, and other tags automatically respect user preferences without custom scripting or manual tag edits. **Seamless Integration** Install the CookieHub GTM template directly inside your existing container — fast, intuitive, and fully compatible with your setup. **Dynamic Control via Data Layer Events** Use CookieHub’s data layer events and variables to create advanced tag triggers, tailoring how scripts fire depending on user interactions. **Multi-Domain Flexibility** Manage multiple domains using one GTM code. Simply add each domain in your CookieHub dashboard and configure the tag to load the correct domain ID. **Smart Display Controls** Exclude the cookie banner on pages like your privacy policy or legal disclaimers to ensure visitors can access key content without interruption. ### How It Works Implementing CookieHub with Google Tag Manager takes only a few minutes and doesn’t require code changes. You’ll configure consent logic once — then GTM handles it automatically across all your tags and domains. For the full step-by-step setup, see the [CookieHub GTM implementation guide](https://docs.cookiehub.com/installation/google-tag-manager). **1. Add CookieHub to Your GTM Container** Install the official CookieHub template from the GTM gallery and follow the detailed implementation guide. **2. Configure Domain and Consent Settings** Connect your CookieHub domain and define consent categories (e.g., necessary, analytics, marketing). **3. Enable Consent Mode** Tags with built-in Consent Mode (e.g., Google Analytics, Google Ads) automatically adjust behavior based on user consent choices. **4. Deploy, Monitor, and Stay Compliant** Publish your GTM container and monitor compliance through CookieHub’s dashboard — effortless updates, full transparency. #### Frequently Asked Questions **Do I need to modify my existing GTM tags after installing CookieHub?** No. Tags that already support Google Consent Mode (e.g., GA4, Google Ads) will automatically respect user consent once CookieHub is configured. **Can I use one CookieHub setup for multiple domains?** Yes, but each top-level domain must be created in your CookieHub dashboard. Configure your GTM tag to use the correct domain code dynamically based on the domain being viewed. **Can I hide the cookie banner on specific pages?** Absolutely. You can exclude the CookieHub dialog on pages like privacy policies or legal disclaimers through simple GTM trigger configuration. **What if I’m using non-Google tags?** CookieHub provides data layer events you can use to conditionally fire any tag — not just Google tags — ensuring full consent enforcement across all vendors. **Does CookieHub automatically update to reflect new cookies or scripts?** Yes. CookieHub regularly scans your website and classifies new cookies automatically, keeping your consent configuration up-to-date. **What must I do if I embed tracking scripts directly in my HTML instead of via Google Tag Manager (GTM)?** If you load scripts directly in your page’s HTML (rather than through GTM) the automatic blocker in CookieHub cannot intercept them — meaning you may still deploy cookies before consent. The recommended approach is to load all tracking or marketing tags via GTM so that CookieHub’s consent logic can properly control them. **How do I configure region-specific consent defaults in GTM for different jurisdictions?** If you operate in multiple regions (for example EU + US states), within your GTM container you can define region codes (like FR, DE or US-CA) under the CookieHub CMP tag’s “Consent Mode Defaults” settings. Then, assign distinct consent defaults per region so that you’re compliant under each area’s data-privacy laws. **How can I check which tags in GTM already support consent and which don’t?** Use GTM’s Consent Overview feature: enable it via Admin → Container Settings in GTM. Then, in the Tags section click the Consent Overview icon. You’ll see which tags have built-in consent mode support and which still require additional configuration. This audit helps catch non-compliant tags before they fire. **Some tags don’t support Google Consent Mode natively — what’s the solution for those?** For tags without native support (e.g., custom marketing/tracking scripts), you should enable “Require additional consent” in the tag’s Consent Settings in GTM. Then specify the relevant cookie consent category (like analytics\_storage) and add a trigger (e.g., cookiehub\_modified) so that the tag only fires after the user has given consent. **Which tags automatically adjust based on user consent because they support Consent Mode natively?** Tags such as Google Analytics 4 (GA4), Google Ads, Floodlight, and Conversion Linker support Google’s Consent Mode out of the box — meaning once you implement CookieHub and connect with GTM, these tags will respect consent without additional custom logic. Tags that don’t must be managed manually. --- # HubSpot Consent API Integration URL: https://www.cookiehub.com/hubspot-consent-api Last updated: April 1, 2026 ## Connect HubSpot Consent API ##### Consent-Aware HubSpot Tracking Made Simple Easily connect the CookieHub consent management platform with the **HubSpot Consent API** to ensure HubSpot only loads tracking services after valid user consent has been granted. This integration helps you meet evolving global privacy requirements while keeping HubSpot analytics and marketing tools aligned with real user choices — all with minimal setup. ### Easy CookieHub HubSpot Consent API Setup CookieHub acts as the consent authority and automatically sends consent signals to HubSpot. No manual JavaScript configuration or API calls are required. CookieHub integrates natively with **HubSpot Consent API v2** (supported as of CookieHub version **2.8.13**), allowing HubSpot to adjust its tracking behavior automatically based on real user consent. Learn more about the setup and configuration in the HubSpot Consent API documentation: [https://support.cookiehub.com/article/552-hubspot-consent-api](https://support.cookiehub.com/article/552-hubspot-consent-api) **HTML implementation** Load CookieHub directly in your site’s header so consent signals reach HubSpot before any tracking is allowed to start. - Add the CookieHub script to your site’s - Enable **HubSpot Consent API** under **Settings → Integrations** in the CookieHub dashboard - Consent signals are applied automatically when users accept or reject cookies HubSpot will only start tracking once the required consent has been granted. **Google Tag Manager (GTM) implementation** Use GTM to initialize CookieHub early, ensuring HubSpot receives consent signals before HubSpot tags are triggered. - Use the **CookieHub CMP template** from the GTM Community Template Gallery - Enter your CookieHub domain code - Set the trigger to **Consent Initialization – All Pages** - Save and publish This ensures HubSpot receives consent signals **before** any HubSpot tracking begins. ### Why the HubSpot Consent API Matters Modern websites rely on HubSpot for analytics, marketing automation, and advertising, but without proper consent signaling these services can start tracking visitors before consent is given, creating compliance risks. The HubSpot Consent API provides a standardized way for HubSpot to receive consent signals and prevent tracking technologies from running until consent exists. CookieHub acts as the consent authority, supplying HubSpot with accurate, real-time consent data and keeping tracking behavior aligned with user preferences. This approach simplifies compliance, reduces regulatory exposure, and ensures HubSpot tracking remains both privacy-aware and technically reliable. ### Activate HubSpot Consent API Integration for CookieHub The HubSpot Consent API enables HubSpot to respect user consent preferences before collecting data. CookieHub makes this process seamless: **Simple and Flexible Integration:** Enable the HubSpot Consent API directly in the CookieHub dashboard. No custom JavaScript or API work is required. CookieHub automatically sends consent signals to HubSpot and keeps them synchronized across both HTML and Google Tag Manager implementations. **Supported Consent Parameters:** Enable the HubSpot Consent API directly in the CookieHub dashboard. No custom JavaScript or API work is required. CookieHub automatically sends consent signals to HubSpot and keeps them synchronized across both HTML and Google Tag Manager implementations. **Automatic Parameter Mapping:** CookieHub maps its consent categories directly to HubSpot’s consent fields. Marketing maps to advertising, analytics maps to analytics, and necessary cookies are always allowed for HubSpot’s core functionality. No manual mapping is needed. ### CookieHub CMP + HubSpot Consent API Benefits Integrating CookieHub with the HubSpot Consent API gives you: **Accurate consent-driven tracking** HubSpot only loads tracking services once the correct consent has been granted, improving compliance and data integrity. **Automated, hands-off compliance** Consent signals are sent automatically and stay in sync with CookieHub categories at all times. **Flexible deployment options** Works seamlessly with both HTML implementations and Google Tag Manager setups. #### FAQ about HubSpot Consent API **What is the HubSpot Consent API?** The HubSpot Consent API allows HubSpot to adjust how it tracks visitors based on consent, preventing tracking technologies from running until consent has been granted. **Does CookieHub require custom JavaScript to integrate with HubSpot?** No. CookieHub automatically sends the required consent signals to HubSpot once the integration is enabled in the dashboard. **Does this work with both HTML and Google Tag Manager setups?** Yes. CookieHub supports both direct HTML integration and Google Tag Manager using the official CookieHub CMP template. **Which HubSpot tracking types are affected by consent?** HubSpot analytics and advertising-related tracking respect the analytics and advertisement consent parameters managed by CookieHub. Essential functionality remains allowed. **When should I enable HubSpot Consent API v2?** You should enable it if you use HubSpot for analytics, marketing, or to load additional tracking services and need consent-aware session tracking. **Are consent changes reflected in real time?** Yes. Whenever a user updates their consent preferences, CookieHub immediately updates the consent parameters sent to HubSpot. --- # CookieHub: IAB GPP Framework for Global Compliance URL: https://www.cookiehub.com/iab-gpp Last updated: April 1, 2026 ## IAB Global Privacy Protocol framework ##### IAB GPP for standardizing privacy preferences Comply with evolving data privacy regulations, such as CCPA, other US state-based privacy regulations, as well as other regional laws by adopting a standardized approach to collecting, managing, and transmitting user privacy and consent data in advertising. Of particular relevance to digital publishers and advertisers, the IAB Global Privacy Platform (GPP) enables unified consent signaling across jurisdictions, ensuring transparency and user control. **Easy IAB GPP setup** CookieHub manages [IAB GPP implementation](https://docs.cookiehub.com/features/iab-gpp) for you. Once enabled, no additional setup or customization is required. CookieHub ensures your consent dialogs and privacy strings comply with IAB GPP specifications. When you enable the GPP framework for a region, the correct privacy sections (known as “Sections” in GPP terminology) are displayed automatically. If Google or other major vendors require IAB GPP signaling, CookieHub automatically enables the appropriate consent mode integrations. **When to use GPP** Use the IAB Global Privacy Platform if: - You need to comply with US state privacy laws, such as CPA, CPA, CTDPA, UCPA, VCDPA - You work with vendors, advertising partners, ad exchanges that require GPP or US Privacy signals - You serve ads or collect data from users in multiple jurisdictions (e.g., EU, UK, US, Brazil, Canada) - You need a single framework to manage and transmit regional privacy strings (e.g., GDPR, CCPA, US National) - You want CookieHub to manage opt-out signaling automatically - If you do not work with vendors that require GPP signaling, you can use CookieHub’s regional consent options instead for simplified category-based consent. ### Why IAB GPP compliance matters The IAB Global Privacy Platform (GPP) is an industry-standard framework developed by the Interactive Advertising Bureau (IAB) to simplify and standardize the transmission of user privacy and consent signals across multiple global jurisdictions. Prioritizing IAB GPP compliance in your consent management posture helps you: **Standardize privacy signaling globally\ ** Provide a consistent, machine-readable format for collecting and communicating user privacy preferences across multiple frameworks, such as GDPR, CCPA, LGPD, and more. **Promote transparency\ ** Empower users to make informed decisions about data processing and advertising preferences, with clear disclosures about which frameworks apply to them. **Facilitate better communication\ ** IAB GPP provides a unified mechanism for websites and apps to transmit user consent and privacy choices consistently to ad vendors and technology partners. ### Enable IAB GPP in CookieHub It’s easy to enable IAB GPP in CookieHub. With CookieHub CMP, you can meet IAB GPP standards and adapt easily as global privacy frameworks evolve, delivering clear and consistent privacy choices to users. **What CookieHub provides:** **Out-of-the box GPP support:** Privacy management ready to use immediately offering vendor alignment and automated opt-out signaling **Transparent options:** Offer users standardized, structured choices per framework and clear information about who processes their data and why **Ongoing compliance updates:** Stay current with evolving global privacy frameworks (GDPR, CCPA, CPRA, US state laws, and more) ### CookieHub CMP solution benefits **Effortless transparency** CookieHub helps you display relevant privacy disclosures and vendor information depending on users’ regional frameworks. **Capture high-quality, consented data** Store and transmit user choices in standardized IAB GPP strings that can be shared across global ad and data ecosystems. **Trust-centric user experience** Ensure that users’ privacy and consent preferences are respected and communicated consistently to all participating vendors. #### FAQ about IAB GPP **What is IAB GPP?** The IAB Global Privacy Platform (GPP) is a technical standard that enables publishers, advertisers, and technology partners to collect, manage, and share user privacy and consent signals in a consistent, interoperable format across global privacy frameworks such as GDPR, CCPA, and others. It is particularly relevant for US-based data privacy laws. **Why did IAB introduce the GPP?** With privacy regulations expanding worldwide, the IAB developed the GPP to replace fragmented, region-specific consent frameworks. It provides a unified way to represent privacy choices, reducing complexity for publishers and vendors operating across multiple jurisdictions. The GPP defines how websites collect, store, and communicate user privacy preferences to vendors, ensuring those vendors process personal data only under valid legal bases and within the applicable framework’s boundaries. It informs users about: - Why their data is being used (purposes) - Which vendors and frameworks apply - What data is collected - How long it’s retained All privacy and consent choices are standardized, structured, and transmitted in a single machine-readable GPP string. **How does consent signaling work?** When GPP is enabled for a region, CookieHub: - Displays the appropriate GPP section(s) based on regional rules (e.g., GDPR, CCPA, or US specific) - Retrieves the latest framework definitions and vendor lists - Allows users to accept or reject specific purposes, disclosures, or vendors - Generates a GPP string containing user preferences and legal bases - Stores and transmits that string to participating vendors via the IAB GPP API Each GPP string includes: - Applicable regional section IDs - Consent and opt-out preferences per framework - User and vendor-level privacy choices **Is IAB GPP mandatory?** While not legally mandatory, GPP is often required by major ad platforms and vendors for consistent privacy signaling. For example, Google and other ad tech providers now support or require IAB GPP strings to ensure global compliance and interoperability. **For whom is IAB GPP relevant?** Use the IAB Global Privacy Platform if: - You serve users in multiple jurisdictions with differing privacy laws, especially relevant in the fragmented data privacy space of the US. - You need to transmit structured privacy strings to multiple ad tech partners - Your advertising vendors or header bidding providers require IAB GPP support **How does IAB GPP help conversions and ad campaigns?** IAB GPP helps maintain compliance while supporting data-driven advertising efficiency: - **Preserve measurement:** Even when users opt out, GPP’s standardized privacy strings allow consistent handling of consent signals, reducing attribution loss. - **Improve ad tracking:** When users grant consent, vendors can process privacy strings to enable compliant tracking, remarketing, and conversion measurement. - **Optimize within compliance:** Consent-based data enables platforms to refine ad delivery and performance ethically. - **Compliance + performance balance:** CookieHub’s GPP integration provides structured privacy signaling so you stay compliant without losing essential analytics or advertising data. **How can I enable IAB GPP in CookieHub?** 1. Go to **Dashboard → Domain list** 1. Click on the domain you want to configure 1. Click **Settings** Under **Regional settings:** 1. Set the framework to **IAB GPP** 1. Choose your desired consent type (Explicit consent / Opt-in) 1. Save your changes The GPP interface will appear automatically for users in the selected regions, and privacy strings will be generated and shared with vendors. **What data privacy frameworks does IAB GPP pertain to?** The IAB GPP is designed to unify consent and privacy signaling across major global privacy laws, including: - **GDPR (EU/UK):** Governs data processing and consent for personal data. - **CCPA/CPRA (California):** Defines consumer rights, opt-outs, and data sharing rules. - **US National & State Frameworks:** Supports emerging laws in Virginia, Colorado, Connecticut, and more. - **LGPD (Brazil):** Addresses lawful processing of personal data in Brazil. - **Other international frameworks:** Including PIPEDA (Canada) and upcoming APAC regulations. **Is IAB GPP GDPR compliant?** Using IAB GPP with CookieHub supports GDPR compliance and helps align your consent practices globally. The framework standardizes how consent and privacy signals are formatted and transmitted, but complete GDPR compliance still requires: - Transparent privacy notices - Purpose limitation and data minimization - Mechanisms to withdraw consent - Proper documentation and accountability CookieHub’s GPP integration ensures privacy signals are structured and communicated correctly, a foundational step toward full compliance across multiple privacy laws. --- # CookieHub: IAB TCF v2.4 Compliance & Consent Management URL: https://www.cookiehub.com/iab-tcf-v24 Last updated: September 25, 2026 ## IAB TCF 2.4 compliance, handled ##### CookieHub implements IAB Europe's Transparency and Consent Framework v2.4 and Policies v5.0.b TCF v2.4 shipped to CookieHub domains almost a month ahead of the IAB's 23 October 2026 deadline for web environments. If your widget updates automatically, you are already running TCF v2.4 - the new disclosures appear on your site with nothing to configure and nothing to migrate. ### What's new in your consent dialog **Features, clearly disclosed** The second layer of the consent dialog now includes a Features section: the IAB's standard explanation and all three TCF Features with their official illustrations, each one expandable. Features carry no consent choice under the framework, and the dialog now presents them that way. **Complete disclosure** CookieHub now also discloses Special Purpose 3 alongside the other special purposes, and every purpose, feature and stack name comes straight from the current Global Vendor List - including the updated name for Special Feature 2, "Identify devices based on information actively requested". **Your existing choices stay where they are** Existing dialogs keep the same purposes and controls in the same order. The new TCF disclosures are added without reshuffling the choices visitors already know. ### You decide what your dialog presents The Dashboard has a new TCF settings section. Choose which purposes, special features and stacks your dialog presents - individually or bundled as IAB stacks - and manage your vendor list and legitimate-interest settings in the same place. **Your set is yours:** Existing domains keep exactly the set of purposes, special features and stacks they present today. **Personalised advertising, when you want it:** Select purposes 3 and 4, or Stack 10, and the ad_personalization Consent Mode signal becomes grantable. **Purpose 1 stays required:** CookieHub keeps Purpose 1 required, because removing it would deny several Consent Mode signals at once. **Consent signals you can defend** The TC string reflects the purposes and vendors your dialog disclosed and the choices your visitors made. Purposes your configuration does not present are never signalled as consented, the disclosed-vendors segment records which vendors were shown, and every change in this release was verified by decoding real consent strings against the live Global Vendor List. **Consent Mode, documented** How CookieHub derives each Google Consent Mode signal is now published, both for category-based setups and for TCF: [Google Consent Mode v2 mapping](https://docs.cookiehub.com/compliance/frameworks/google-consent-mode-v2). The tables describe what each signal requires and apply to widget version 2.9.1 and later. #### FAQ about IAB TCF v2.4 **What is IAB TCF v2.4?** The IAB Transparency and Consent Framework (TCF) is a technical standard that allows publishers and advertisers to collect, manage, and share user consent signals for compliance with the General Data Protection Regulation (GDPR) and ePrivacy Directive in the European Union. The v2.4 Technical Specifications were published on 23 July 2026, following the release of TCF Policies v5.0.b in May. It primarily improves how the framework's Features are explained to users - with standard texts and illustrations from the Global Vendor List - and introduces policy changes such as multi-device consent provisions and the renaming of Special Feature 2. Web CMPs must implement the new disclosures by 23 October 2026. **Do I need to do anything for TCF 2.4?** Not if your widget updates automatically on the latest generation. If updates are disabled or you run an earlier generation, update to the 2.4 release before the 23 October 2026 web deadline - CookieHub no longer supports TCF 2.3. **Why does my dialog show a new Features section, and why can't visitors toggle it?** TCF v2.4 requires CMPs to disclose the framework's three Features with the IAB's standard explanation and illustrations. Features carry no consent choice under the framework, so there is nothing to toggle. **Where did my vendor list and legitimate-interest settings go?** They moved from the Customize dialog to the new TCF settings section in the Dashboard, with their values unchanged. **How do I enable personalised advertising?** In TCF settings, present purposes 3 and 4 - individually or via Stack 10. Visitors are asked again, and the ad\_personalization signal becomes grantable once they consent. **What happens to consent I have already collected if I change my purpose set?** Nothing. Stored consent is never altered by a configuration change; newly added purposes read as denied until the visitor is asked again. **Why can't I remove Purpose 1?** CookieHub keeps Purpose 1 required by design: several Consent Mode signals depend on it, so removing it would deny them all at once. **Why did IAB introduce the TCF?** In preparing for the launch of the GDPR, IAB Europe launched a collaborative effort to deliver, maintain and iterate an industry standard, the TCF, in an attempt to meet the needs of users, industry and regulators. Since 2018, it has gone through several iterations to ensure that it meets the needs of the industry while still complying with the regulation. The most recent version, TCF v2.4, was published in July 2026. The framework defines how websites collect and store user consent preferences and communicate those preferences to third-party vendors that process personal data, such as ad networks, analytics providers, and retargeting platforms. It ensures that vendors can only access or process personal data with a valid legal basis (such as consent). It also ensures that users are clearly informed about: - Why their data is being used (purposes) - Which vendors are involved - What data is collected - How long data is retained Consent choices are standardized, structured, and passed in a machine-readable format. **Is IAB TCF mandatory?** IAB TCF is not itself a law, and GDPR does not require websites to use it. However, some advertising platforms and publishers require it as part of their consent infrastructure. For example, Google requires publishers using AdSense, Ad Manager or AdMob to use a Google-certified CMP integrated with TCF when serving personalized ads to users in the EEA, UK and Switzerland. You might also want to use TCF if you need to provide structured, vendor-level consent to a wide range of ad tech providers, or if your advertising partners or header bidding providers require a valid TC string. **How can I enable IAB TCF in CookieHub?** 1. Go to Dashboard → Domain list 1. Click on the domain you want to configure 1. Click Settings Under Regional settings: 1. Set the framework to IAB TCF 2.4 1. Set the consent type to Explicit consent / opt-in 1. Save your changes The TCF interface will appear automatically for users in the selected region(s), and the consent string will be generated and shared with vendors. To manage your vendor list and the purposes, special features and stacks your dialog presents, open the IAB TCF section in the Dashboard menu. **Is IAB TCF v2.4 GDPR compliant?** Using IAB TCF v2.4 with CookieHub supports GDPR compliance, but it does not guarantee full compliance on its own. The framework standardizes how consent is collected, stored, and shared with vendors. However, full GDPR compliance requires a broader privacy strategy that includes: - Clear user notices and privacy disclosures - Data minimization and purpose limitation - Honoring user withdrawal of consent - Maintaining up-to-date records in your CookieHub CMP CookieHub's TCF v2.4 implementation ensures that your consent signals are correctly formatted and transmitted to vendors, a key step toward compliance and ethical data use in digital advertising. --- # Implement Cookie Consent URL: https://www.cookiehub.com/implementation Last updated: July 2, 2026 ## Implementing CookieHub Effortlessly implement CookieHub into your website by copying and pasting your personalised code to your website head or use Google Tag Manager. Give your visitors control over their data privacy and stay compliant with the latest regulations. Start protecting your users today! ### Implementation methods #### Implement CookieHub to Google Tag Manager with ease. Effortlessly import our prebuilt Google Tag Manager template. With built-in Google Consent Mode support, our template eliminates the need for creating variables, triggers, and tags from scratch. #### Insert our script directly into your website Implement our custom production code from your domain in the CookieHub dashboard. Manually insert the code into the head of your website. The steps of implementing CookieHub to your website are few and simple. ### Cookie Consent for WordPress CookieHub empowers website owners to gain full transparency and control over the cookies used on their WordPress sites. With just a few simple steps, you can effortlessly create a comprehensive cookie consent banner, allowing visitors to provide or withhold their consent for different types of cookies. Setting up CookieHub for your WordPress website is extremely simple and takes hardly anytime. The first thing you need to do is download the CookieHub plugin. Once installed, activate it for your WordPress website to start the process. --- # Website & CMS Integrations | Connect CookieHub to Your Stack URL: https://www.cookiehub.com/integrations Last updated: May 26, 2026 ## Seamless Connections for Your Tech Stack CookieHub works with a wide range of platforms and tools so you can automate consent management without custom engineering. Whether your site runs on a major content management system or a custom application, integrations make setup fast and reliable. ### Flexible Deployment for Every Setup No matter what kind of site you operate, CookieHub fits into your stack. Use native plugins, tag manager templates, or code libraries to connect consent controls to the systems you already rely on. ### Tag Managers ### Content Management Systems and Builders ### Developer Frameworks --- # iubenda Alternative: CookieHub vs iubenda Compared URL: https://www.cookiehub.com/iubenda-alternative Last updated: September 24, 2026 ## iubenda alternative: CookieHub vs iubenda iubenda is a legal compliance suite: privacy and cookie policy generators, terms and conditions, a consent database and a cookie banner. CookieHub is a consent management platform only. Both are Google-certified CMPs registered with the IAB Transparency & Consent Framework. The main differences are what each product covers and how each one counts your traffic. This page compares the two using each vendor's own website, checked on 24 September 2026. ### The short version - **Choose iubenda** if you want terms and conditions and other legal documents generated alongside your banner, or you need consent for mobile apps as well as websites. - **Choose CookieHub** if what you need is a consent platform, especially for a site where visitors view several pages per visit: CookieHub counts visits, not page views. For your privacy policy there is a [free privacy policy generator](https://www.cookiehub.com/privacy-policy-generator). ### CookieHub vs iubenda at a glance Plans and prices as published by each vendor on 24 September 2026, monthly billing, excluding VAT. CookieHub iubenda Price based on Sessions (visits) per month, per domain Page views per month, per site Free plan Up to 1,000 sessions a month; above that the banner stops until you upgrade Up to 5,000 page views a month; above that the banner stops for the rest of the month Entry paid plan Starter: €6 a month, 5,000 sessions Essentials: €5.99 a month, 25,000 page views, one language Going over the limit on a paid plan Moves to the right plan after two billing periods over; the banner keeps running €0.05 per 1,000 extra page views Google-certified CMP true true Google Consent Mode v2 All plans All plans IAB TCF Business and Enterprise Paid plans Global Privacy Control All plans true Banner languages 62, on Basic and above One on Essentials; all on Advanced and above Legal document generators Free privacy policy generator Privacy and cookie policies, terms and conditions, and more Consent log Every plan, including Free Consent Database add-on, €5 a month per 1,000 consents Platforms Websites Websites and mobile apps ### Visits vs page views **iubenda** counts page views. Essentials covers 25,000 a month for €5.99, Advanced 50,000 for €21.99 and Ultimate 150,000 for €89.99, per site. Above the quota, paid plans are charged €0.05 per 1,000 extra page views. **CookieHub** counts sessions. A session starts when a visitor loads the site and the banner initializes, and it covers every page they view on that visit. Starter is €6 a month for 5,000 sessions, Basic €10 for 30,000, Business €30 for 120,000. **A worked example.** Take a site with 20,000 visits a month at five pages per visit, which is 100,000 page views. It also needs its banner in English, French and German. On iubenda, languages beyond one require Advanced: €21.99 for the first 50,000 page views plus €2.50 for the other 50,000, so €24.49 a month. On CookieHub the 20,000 visits fit in Basic, which is €10 a month and includes all 62 languages. The fewer pages people view per visit, the smaller that gap gets. Compare both for your own traffic. ### Where iubenda is stronger A fair comparison has to include these: **Legal documents:** iubenda generates privacy and cookie policies in 27 languages, terms and conditions and other documents. CookieHub offers a free privacy policy generator and a cookie declaration, but no terms and conditions. **Mobile apps:** iubenda is registered on the IAB list for mobile apps as well as the web. CookieHub is registered for the web. **More compliance tools:** iubenda also offers a GDPR records-of-processing tool, a whistleblowing tool and an accessibility add-on. **Cheap entry for single-language sites:** Essentials is €4.99 a month billed yearly for 25,000 page views. ### When CookieHub is the better fit **Multilingual sites:** All 62 languages, with automatic detection, from Basic at €10 a month. **Sites where visitors view several pages per visit:** You pay for visits, not page views, and there is no charge per extra page view. **Proof of consent without add-ons:** Every plan includes a consent log, including Free. **No per-page-view charges:** On a paid plan, going over your limit adds no metered charge. After two billing periods over, the domain moves to the right plan, and the banner keeps running throughout. **Developers:** A documented JavaScript API with events on every plan and a Management API on Enterprise. ### Switching from iubenda CookieHub builds its own cookie list from a scan, so there is nothing to export first. **Create an account:** Start the free trial and add your domain. CookieHub scans the site and sorts the cookies it finds into categories. **Review the categories and design:** Check the categorization, pick a banner template and set your colours and languages. **Swap the script:** Replace the iubenda script with the CookieHub script, or use the CookieHub template in Google Tag Manager. Remove iubenda completely so two banners never run at once. **Check the result:** Run the Google Consent Mode checker to confirm consent signals reach Google. **Expect one new prompt:** Consent stored by iubenda is kept in its own cookie, which CookieHub cannot read. Returning visitors are asked once more. Further reading: [the 62 supported languages](https://www.cookiehub.com/languages), [the consent log](https://www.cookiehub.com/consent-log), [the JavaScript API](https://www.cookiehub.com/javascript-api), [the Management API](https://www.cookiehub.com/management-api), [the Google Consent Mode checker](https://www.cookiehub.com/google-consent-mode-checker), [the free privacy policy generator](https://www.cookiehub.com/privacy-policy-generator). ### Frequently asked questions **Can CookieHub write my privacy policy like iubenda?** Partly. CookieHub has a free privacy policy generator: you answer a questionnaire and download the policy to publish on your site. It also generates a cookie declaration from its scan. It does not generate terms and conditions or other legal documents; iubenda does. **Are both Google-certified CMPs?** Yes. Both are on Google's list of certified CMPs: iubenda under TCF CMP ID 123, CookieHub under ID 354. **What happens when I exceed my limit?** On iubenda's paid plans you pay €0.05 per 1,000 extra page views; on its free plan the banner stops for the rest of the month. On a paid CookieHub plan, a domain over its session limit for two consecutive billing periods moves to the right plan, and the banner keeps working. On CookieHub's Free plan the banner stops until you upgrade. **Will my visitors have to consent again after switching?** Yes, once. Each platform stores consent in its own cookie, so CookieHub cannot read choices a visitor made in iubenda's banner. ### Sources Every fact about a competitor on this page comes from that vendor's own website, from Google's list of certified CMPs or from IAB Europe's CMP list. All of it was checked on 24 September 2026. Prices exclude VAT. - [Google: certified CMPs](https://support.google.com/admanager/answer/13554116) - [IAB Europe: CMP list](https://iabeurope.eu/cmp-list/) - [CookieHub pricing](https://www.cookiehub.com/pricing) - [CookieHub JavaScript API](https://docs.cookiehub.com/advanced/javascript-api) - [iubenda pricing](https://www.iubenda.com/en/pricing/) - [iubenda pricing FAQ](https://www.iubenda.com/en/help/6633-pricing-faqs) - [iubenda free plan limitations](https://www.iubenda.com/en/help/379-free-plan-limitations/) - [iubenda Cookie Solution, advanced configuration](https://www.iubenda.com/en/help/1205-how-to-configure-your-cookie-solution-advanced-guide-2/) Vendors change their plans. If something here is out of date, [tell us](https://www.cookiehub.com/contact-us) and we will correct it. --- # Javascript API & Events Documentation URL: https://www.cookiehub.com/javascript-api Last updated: April 1, 2026 ## Javascript API: Frontend Control and Compliant Script Integration Extend CookieHub's functionality, conditionally load third-party scripts based on user consent, and manage the dialog experience directly from your client-side code. ### Understanding the Javascript API The **CookieHub Javascript API** provides a flexible set of public methods and events that enable **Front-End Developers** to interact with and control the CMP widget directly on the website. This API is essential for ensuring robust compliance by allowing you to manually verify a user's consent status before executing any third-party marketing, analytics, or functional scripts. All functionality is accessed via the global window.cookiehub object, which becomes available once the CookieHub tag is initialized. ### Why Use the Javascript API? Using the API ensures your website is compliant, dynamic, and offers a smooth user experience. **Conditional Script Loading** Use the hasConsented() method to load third-party tags (e.g., Google Analytics, Facebook Pixel) only if the user has provided the required consent category. **Real-Time Integration** Utilize events like cookiehub_onStatusChange to trigger scripts or update your data layer the moment a user changes their preferences, without requiring a page refresh. **Custom User Experience** Create custom buttons or links that programmatically open the consent dialog (openDialog()) or settings panel (openSettings()) from anywhere on your site. **Developer Flexibility** Provides simple methods like allowAll() or denyAll() for advanced integration scenarios where you need manual control over consent states. ### How It Works The Javascript API functionality is separated into two main groups: **Public Methods** (for querying status and control) and **Events** (for reacting to changes). To ensure the API object is available, the standard CookieHub tag must be injected into your website's : **Installation Guide:** [Information on the script to inject - CookieHub Tag](https://docs.cookiehub.com/installation/tag) **Public Methods (Control and Query)** These methods allow you to actively check the user's consent status or control the appearance of the dialog. - **hasConsented(category)** **Purpose:** The most critical method. Checks if the user has allowed the specified cookie category (e.g., "analytics", "marketing"). _Example:_ if (window.cookiehub.hasConsented("analytics")) \{ loadAnalytics(); \} - **hasAnswered()** **Purpose:** Returns true if the user has previously made a choice by allowing all or saving settings. - **openSettings(tab)** **Purpose:** Opens the settings dialog. You can optionally specify a tab (e.g., "declaration"). _Example:_ window.cookiehub.openSettings('declaration'); - **openDialog()** **Purpose:** Programmatically opens the main consent dialog. - **allowAll() / denyAll()** **Purpose:** Programmatically grants or revokes consent for all categories. Useful for implementing custom controls outside the main dialog. **Events (Reaction to Changes)** Events are crucial for running code _after_ the user interacts with the CMP. Listen for these events using the standard document.addEventListener. - **cookiehub\_onInitialise** **Trigger:** Fired when CookieHub has loaded and the user's existing consent status is known. _Key Use Case:_ Executing initial page logic that depends on prior consent. - **cookiehub\_onStatusChange** **Trigger:** Fired whenever the user modifies their cookie preferences (e.g., clicks "Save Settings" or "Allow All"). _Key Use Case:_ **The most reliable event for re-firing GTM or scripts after consent is updated.** - **cookiehub\_onAllow** **Trigger:** Fired when a user specifically allows a category that was previously disallowed. _Key Use Case:_ Loading a single, category-dependent script at the moment of consent. - **cookiehub\_onRevoke** **Trigger:** Fired when a user specifically revokes consent for a previously allowed category. _Key Use Case:_ Stopping execution of a specific tracking script. #### Frequently Asked Questions **How do I access the API functions?** All public methods and properties are available under the global object, **window.cookiehub**, once the main CookieHub tag has loaded. **Can I launch the consent dialog with a custom link or button instead of the default icon?** Yes, absolutely. If you disable the default floating icon in the CookieHub dashboard, you can create a custom link or button anywhere on your site (e.g., in the footer) that triggers the openDialog() public method. **Can I display the full cookie declaration on my site with a code (e.g., linked from my Privacy Policy)?** Yes. The full cookie declaration can be embedded directly onto any page (such as your dedicated Cookie Policy page) using a simple HTML snippet. This method renders the declaration as an unstyled table which inherits your website's CSS, ensuring visual consistency. **How to Embed:** Insert the following HTML snippet exactly where you want the declaration to appear: ```
``` **Note:** If you want users to view the declaration inside the CMP dialog overlay, you can still use the window.cookiehub.openSettings('declaration'); method. **When should I use a Public Method versus listening for an Event?** - Use a **Public Method** (like hasConsented()) when your code needs to **query a status** or **control the dialog** (an active operation). - Use an **Event** (like cookiehub\_onStatusChange) when your code needs to **react to a user action** (a passive operation) or an initialization moment. **Can I use the API to override the user's consent?** No. The API methods like allowAll() or denyAll() are designed to provide alternative ways for the user to express consent (e.g., via a custom button). They should not be used to bypass the user's explicit choice or the CMP workflow. **Which event is best for triggering Google Tag Manager (GTM) updates?** The **cookiehub\_onStatusChange** event is the most reliable event for GTM integration. It fires whenever the user modifies their cookie preferences, allowing you to update your GTM Data Layer immediately to reflect the new consent state. --- # Supported Languages | CookieHub Global Consent Management URL: https://www.cookiehub.com/languages Last updated: September 24, 2026 ## Cookie consent in your visitor’s language Deliver a localized consent experience automatically. CookieHub detects browser settings to show your cookie banner in your user's native tongue, increasing trust and opt-in rates. ### Global Compliance through Localization Effective privacy compliance is built on clarity. To satisfy GDPR, LGPD, and other global regulations, consent must be informed and easily understood. CookieHub eliminates the language barrier by providing professionally translated content for all banner elements, buttons, and cookie descriptions. **How it Works:** - **Automatic Language Detection:** By default, CookieHub identifies the language settings of your visitor's browser and displays the corresponding translation instantly. - **Default Language Settings:** You can designate a primary language (e.g., English) in your dashboard. This acts as the fallback for visitors using a language that you haven't explicitly enabled. - **Dashboard Customization:** While we provide standard translations for 62 languages, you have the power to override any text string. This allows you to match your brand's specific tone or unique legal requirements for every region you serve. ### Supported Languages CookieHub currently provides professional translations for the following 62 languages. You can enable any of these within your dashboard to provide a seamless experience for your global audience. - Afrikaans - Albanian - Arabic - Armenian - Basque - Bengali - Bosnian - Bulgarian - Catalan - Chinese - Chinese (Traditional) - Croatian - Czech - Danish - Dutch - English - English (US) - Estonian - Faroese - Filipino - Finnish - French - French (Canada) - Galician - Georgian - German - Greek - Hebrew - Hindi - Hungarian - Icelandic - Indonesian - Irish - Italian - Japanese - Korean - Latvian - Lithuanian - Luxembourgish - Malay - Maltese - Norwegian - Persian - Polish - Portuguese - Portuguese (Brazil) - Romanian - Russian - Serbian - Slovak - Slovenian - Spanish - Swahili - Swedish - Tamil - Thai - Turkish - Ukrainian - Urdu - Uzbek - Vietnamese - Welsh #### Frequently Asked Questions **How do I enable a new language for my domain?** In your CookieHub dashboard, navigate to the **Languages** tab. Click "Add language," select your desired language from the dropdown menu, and click "Add." It will be available to your visitors immediately. **Can I customize the translations provided by CookieHub?** Yes. Every language enabled in your dashboard can be fully customized. By clicking the "Edit" icon next to a language, you can modify any text string - including the main message, button labels, and category descriptions. **What happens if a visitor uses a language not in my active list?** CookieHub will automatically display the "Default Language" you have selected in your settings. You can change your default language at any time in the dashboard to suit your primary audience. **Do I need to manage translations for my cookie descriptions?** Standard categories (like "Analytical" or "Marketing") are translated by default. For specific cookie descriptions found during scans, you can provide localized text in the "Cookies" tab to ensure a 100% native experience for the user. **Does the language detection work on all browsers?** Yes, our script uses standard browser headers to detect the user's preferred language, ensuring a consistent localized experience across Chrome, Safari, Firefox, and Edge. --- # Brazil LGPD Cookie Consent and Compliance URL: https://www.cookiehub.com/lgpd Last updated: June 18, 2026 ## Brazil LGPD Cookie Consent and Compliance The Brazilian General Data Protection Act (Lei Geral de Proteção de Dados Pessoais, LGPD) regulates activities related to processing personal data.  Are you ready for LGPD? ### What your business needs to know about LGPD Loosely based on GDPR (the data protection regulation enacted by the EU), LGPD is Brazilian legislation that establishes the conditions under which personal data can be processed, defines a set of rights for data subjects, creates specific obligations for data controllers and creates a series of procedures and standards so that greater care is taken with the processing of personal data and sharing with third parties. The LGPD is inspired by data privacy regulations, such as GDPR, but differs in significant ways. Brazil’s law is formed on “ten bases”, which include guidance on consent, protection of life and health, legitimate interests, and more. This is one of the ways it differs from GDPR and is an important difference to consider when looking to comply with LGPD. ### What does LGPD compliance require? Some of the key tenets of LGPD compliance include taking specific actions, including: **Data minimization and purpose:** Documenting your legal bases for processing Brazilians' personal information. You have to define a basis for every kind of data you collect and then document it in your processing records **Privacy Policy:** Including the necessary disclosures within your site's Privacy Policy **Consent:** Collecting users’ valid consent and maintaining proof of that consent including developing processes for honoring user requests **Privacy-by-default:** Implementing privacy by default, meaning the default setup for everything must offer the highest possible security **Notification:** Notifying the DPA and its users in the event that a data reach occurs and poses "significant risk or damage" to your users **Cross-border data transfer:** Remaining in compliance with the requirements of cross-border data transfer policies **Regulatory oversight:** Appointing a Data Protection Officer (DPO) tasked with managing all of these activities ### Who needs to comply with LGPD? LGPD applies to any person or entity (public or private) that processes personal data of individuals located in Brazil, regardless of where the entity is based or where the data processing takes place. This includes both domestic and foreign entities, as long as the data processing activities involve individuals in Brazil or are related to offering goods or services to individuals in Brazil or the data was collected in Brazil. ### Consumer rights under the LGPD Under the LGPD, users have specific rights with regard to their data, including, among others: **Right to access** Request access to their personal data **Right to correct** Rectify inaccuracies in their data **Right to delete** Request the deletion of their personal data, with certain exceptions **Right to anonymize** Anonymize, block or eliminate unnecessary or excessive personal data, or of any data that is not being processed in compliance with LGPD **Right to opt-out** Opt out of the processing of their personal data for targeted advertising, the sale of their data, or for profiling **Right to revoke** Withdraw consent at any time **Right to portability** Gain access to and move their data upon request **Right to confirmation** Gain confirmation that their data has been processed **Right to information** Get information about sub-processors and other third parties with access to their personal data as well as information about their consent choices and what happens if they refuse consent **Right to file complaint** Lodge complaints with the Data Protection Authority (DPA) ### Why cookies as part of LGPD compliance As a rule, the LGPD requires that you only process personal data for legitimate, specific, explicit and clearly communicated purposes, and these purposes need to be clearly and transparently communicated. Also, businesses should only collect the data they absolutely need, i.e., the principle of data minimization. With regard to cookies, consent must be freely given and unambiguous, and clear explanations of cookie use and purposes must also be provided. Consent management platforms like CookieHub are one way to make this process easier and transparent. ### Penalties for LGPD non-compliance LGPD non-compliance can cost businesses a great deal. Fines can reach BRL 50 million (approximately 9 million USD) in addition to lawsuits, sanctions and any reputational damage done. ### How to comply with the LGPD Businesses can also take additional steps to ensure compliance and a consent-first mindset: **Conduct data audits:** Align data practices with LGPD requirements **Update privacy policies:** Ensure privacy notices make data practices, consumer rights, and how to exercise those rights clear to consumers **Implement consent management:** Control cookie consent and oversight with a comprehensive consent management platform like CookieHub **Employee training:** Train employees on the importance of data privacy and LGPD compliance #### Frequently Asked Questions **What is the scope of the Brazilian General Data Protection Act (LGPD)?** The LGPD applies to any individual or organization that processes personal data of individuals located in Brazil, regardless of where the data processor is based. It covers all sectors and types of data processing activities, aiming to protect the privacy and rights of data subjects. **What is personal data under LGPD?** Personal data is any information related to an identified or identifiable natural person. This includes data like names, identification numbers, location data, online identifiers, or any other information that can directly or indirectly identify someone. **What is sensitive data according to the LGPD?** Sensitive data is a specific category of personal data that requires higher protection due to its nature. It includes information about racial or ethnic origin, religious beliefs, political opinions, health or sex life, genetic or biometric data, and any data related to children or adolescents. **Who is the regulatory authority for Brazil’s LGPD?** The National Data Protection Authority (ANPD) is the official regulatory body responsible for overseeing and enforcing compliance with the LGPD in Brazil. **Who is exempt from LGPD rules?** The LGPD does not apply to personal data processed exclusively for journalistic, artistic, or academic purposes, or data processed by individuals for exclusively private and non-economic activities. Certain government activities related to national security may also be exempt. **Where can I get more information about the Brazilian General Data Protection Act?** Learn more by visiting the official website of the National Data Protection Authority (ANPD) or consulting the full text of the LGPD available through Brazil’s government publications. --- # CookieHub for Magento | Cookie Consent & GDPR Compliance URL: https://www.cookiehub.com/magento Last updated: April 1, 2026 ## Cookie Consent for Magento Running a Magento store means handling marketing tools, analytics scripts, personalization engines, extensions, and third-party services that all want to drop cookies. Without proper consent handling, you'll violate GDPR, CCPA, and other regulations — and risk losing user trust. CookieHub brings a structured, automated consent layer to Magento. You drop in the script once, and CookieHub manages cookie blocking, consent decisions, and compliance from that point forward. ### Effortless Compliance, Centralized Control CookieHub integrates directly into your **Magento **theme’s header. Once installed, it blocks cookies until consent is given, manages user preferences, and provides a full audit trail of consent decisions. It’s the simplest way to ensure your store remains legally compliant while supporting marketing and analytics tools. For step-by-step installation, see the official [Magento implementation guide](https://docs.cookiehub.com/installation/content-management-systems#magento). **Key Benefits:** - Automatic cookie blocking before consent - Centralized consent management for all tracking scripts - Professional cookie banner with customization options - Dynamic cookie declaration for transparency and compliance - Works with all Magento storefront themes and custom layouts ### Why Use CookieHub with Magento Magento sites commonly load scripts from multiple extensions and integrations — each capable of setting cookies before a visitor agrees. Manual consent handling is inconsistent and error-prone. CookieHub removes that risk by blocking all non-essential cookies until the user actively consents and letting you maintain compliance across your entire store with zero ongoing development. **What CookieHub Adds to Magento** **Full GDPR/CCPA Compliance** Ensure analytics, marketing, and personalization scripts only run when consent is granted. **Automatic Cookie Blocking** Essential for Magento stores using third-party extensions that inject scripts outside your control. **Cookie Scanner** Detects and categorizes cookies set by Magento plugins, themes, and integrations. **Dynamic Cookie Declaration Page** Automatically updated to match your site's real cookie usage. **Simple Implementation** Add a single script to your theme’s header, publish, and you’re done. ### How It Works CookieHub integrates cleanly at theme level. No module installation. No backend modifications. No code-heavy customization. Setup takes only a few steps — follow the [implementation guide](https://docs.cookiehub.com/installation/content-management-systems#magento). **1. Add CookieHub Script to Magento’s Theme Header** Insert the CookieHub snippet into your theme’s HTML Head section. **2. Connect Your CookieHub Domain** Ensure your CookieHub dashboard domain matches your Magento storefront domain so consent can be stored correctly. **3. Configure Consent Categories** Define which cookies belong to “necessary,” “analytics,” “marketing,” etc. CookieHub enforces these automatically. **4. Publish and Enforce Compliance** Once live, CookieHub blocks all non-essential cookies until consent is granted and keeps your compliance status updated. #### Frequently Asked Questions **Does CookieHub automatically block Magento extension cookies?** Yes. CookieHub blocks any non-essential cookies until the user provides consent — including those set by third-party Magento extensions. **Do I need to install a Magento module for CookieHub?** No. CookieHub works by adding a script to your theme's header. No module installation is required. **Will CookieHub interfere with my checkout or performance?** No. CookieHub loads asynchronously, and essential cookies (necessary for checkout/session) are always allowed to run. **Does CookieHub work with Magento Cloud, On-Premise, and custom themes?** Yes. CookieHub is fully compatible with Magento 2 Commerce, Open Source, and any custom frontend theme. **Can I customize the cookie banner to match my store’s branding?** Yes. CookieHub lets you customize colors, text, behavior, and layouts, ensuring the consent UI blends with your brand. **Can I create a cookie declaration page inside Magento?** Yes. CookieHub automatically generates a dynamic cookie declaration you can embed in any CMS page. --- # CookieHub Management API URL: https://www.cookiehub.com/management-api Last updated: April 1, 2026 ## CookieHub Management API: Enterprise Automation and Policy Control Programmatically control domains, synchronize policy settings, and automate bulk configurations across your digital portfolio. Seamlessly integrate CMP management into your deployment workflows. ### Understanding the Management API The **CookieHub Management API** is a secure and exclusive service built for our **Enterprise clients** requiring sophisticated automation and large-scale governance of their Consent Management Platform (CMP). As compliance frameworks evolve and your domain count grows, manual configuration becomes impractical. This RESTful API solves that challenge by providing the tools necessary to treat your CookieHub policies and settings as code. ### Why Use the CookieHub Management API? This API eliminates manual administrative overhead and ensures consistency across hundreds of domains, making compliance management scalable and reliable. **Bulk Domain Onboarding** Rapidly create, configure, and activate multiple domain properties by sending a single configuration payload via your internal systems. **Policy Synchronization** Enforce strict regulatory consistency by automatically retrieving and updating master policy templates across all connected websites. **CI/CD Integration** Embed CMP configuration changes directly into your Continuous Integration/Continuous Deployment pipelines for zero-touch deployment and version control. **Custom Reporting** Programmatically fetch detailed consent records and log data for auditing, allowing integration into your internal Business Intelligence (BI) or compliance reporting tools. ### How It Works The Management API is built on standard REST principles, allowing interaction via common HTTP methods. Access requires strict authentication and knowledge of the core resources you need to manage. **Authentication** All API requests must be authenticated. Access is granted using an **API Key** generated within your dashboard. - **Method:** The key must be sent with every request, typically using the **Bearer Token** scheme in the Authorization header. - **Key Location:** [API Keys - CookieHub Dashboard Account Settings](https://docs.cookiehub.com/dashboard/account#api-keys) **Core Resources** The API manages configurations by interacting with the following key resources: - **/domains**: Used for **managing individual website properties** and their linked settings. Common operations include GET, POST, PUT, and DELETE requests. - **/settings**: Used for **retrieving or updating configuration details**, such as regional rules or scanner preferences, for a specific domain. Common operations are GET and PUT. - **/consentlog**: Used for **accessing the chronological log of user consent events** for compliance auditing and data export. The primary operation is GET. #### Frequently Asked Questions **Who is the CookieHub Management API designed for?** This API is designed exclusively for **Enterprise clients** who require a robust and scalable method to manage a large number of domains, policies, and settings. It is intended for use by internal DevOps teams, IT administrators, and developers focusing on large-scale automation. **What technology is the API built on?** The CookieHub Management API is a **RESTful API** that uses standard HTTP methods (GET, POST, PUT, DELETE) and JSON payloads for requests and responses. It is currently documented using the Swagger/OpenAPI specification. **How do I authenticate my requests to the API?** Authentication is handled via an **API Key**. This key must be generated within your CookieHub dashboard and passed securely with every request, typically using the Authorization header as a Bearer Token. You must have Enterprise access to generate this key. **Is there a rate limit for API usage?** Yes, standard rate limits are in place to ensure system stability and fair usage for all Enterprise clients. If your specific workflow requires higher request volumes, please contact your dedicated CookieHub Account Manager to discuss customized limits. **I'm a front-end developer, should I use this API?** Probably not. This API is for backend configuration. If you need to control the consent dialog, check a user's consent status, or conditionally load scripts, you should use the [**Javascript API**](https://docs.cookiehub.com/advanced/javascript-api). --- # Matomo Tag Manager Cookie Consent and Compliance Solution URL: https://www.cookiehub.com/matomo-tag-manager Last updated: April 1, 2026 ## Cookie Consent for Matomo Tag Manager Ensure GDPR, CCPA, and global privacy compliance across all tags running in **Matomo Tag Manager**. With CookieHub, you control consent, block cookies until approval, and automate compliance — without rewriting scripts or touching your server. ### Effortless Compliance, Centralized Control CookieHub integrates seamlessly with** Matomo Tag Manager **to deliver a unified, reliable consent layer. Once implemented, CookieHub manages consent decisions automatically, blocks tracking cookies until permission is granted, and gives you a complete view of your compliance posture. For step-by-step installation, see the official [Matomo Tag Manager implementation guide](https://docs.cookiehub.com/installation/matomo). **Key Benefits:** - Fully automated cookie blocking before consent. - Accurate cookie detection via CookieHub’s real-time scanner. - Auto-generated cookie declaration for transparency and compliance. - Easy, fast setup — minimal configuration, no extra code. ### Why Use CookieHub with Matomo Tag Manager Managing consent manually inside Matomo Tag Manager is inefficient and risky. CookieHub eliminates the guesswork by applying consistent consent enforcement across all tags in your container. You centralize tracking control, stay compliant by default, and avoid misconfigured tags that quietly collect data without consent. **Automatic Cookie Blocking** Tracking cookies are blocked until a user has explicitly opted in. **Cookie Scanner** Automatically detects, classifies, and updates your cookie inventory so you always know what’s being set. **Dynamic Cookie Declaration** Generate an up-to-date cookie declaration for your site — essential for compliance and user transparency. **Dynamic Control via Data Layer Events** Use CookieHub’s data layer events and variables to create advanced tag triggers, tailoring how scripts fire depending on user interactions. **Hands-Off Integration** CookieHub plugs into Matomo Tag Manager fast, with minimal configuration and no code modifications. ### How It Works CookieHub connects directly to Matomo Tag Manager, blocks tracking cookies until consent is given, and controls when your Matomo tags fire based on the user’s choices. Setup takes only a few steps — follow the [implementation guide](https://docs.cookiehub.com/installation/matomo). **1. Install CookieHub in Matomo Tag Manager** Add CookieHub as instructed in the official configuration guide. **2. Link Your CookieHub Domain** Connect the correct domain from your CookieHub dashboard to ensure user consent choices are stored properly. **3. Configure Consent Categories** Define which Matomo tags require consent (analytics, marketing, etc.) and assign them accordingly. **4. Publish and Enforce Compliance** Once deployed, CookieHub automatically handles consent, blocks cookies, and synchronizes user preferences across your site. #### Frequently Asked Questions **Does CookieHub block Matomo Analytics cookies automatically?** Yes. CookieHub prevents Matomo Analytics and any other Matomo Tag Manager tags from setting cookies until the user has granted consent. **Do I need to modify my existing Matomo tags?** In most cases, no. CookieHub manages consent enforcement through Matomo Tag Manager’s trigger logic, so tags fire only when the required consent category is granted. **Can CookieHub detect and categorize cookies created by custom Matomo scripts?** Yes. CookieHub’s cookie scanner identifies third-party and custom cookies, assigns categories, and updates your cookie declaration automatically. **How do I create region-specific consent behavior with Matomo Tag Manager?** You can configure region-based consent logic directly in CookieHub and sync it with Matomo Tag Manager triggers to comply with different legal jurisdictions. **What if my Matomo container includes non-tracking tags?** Only tags tied to analytics, marketing, or personalization require consent. You can allow functional or essential tags to fire without restriction. **Can CookieHub work with Matomo hosted on my own server (on-premise)?** Yes. CookieHub is fully compatible with Matomo On-Premise and Matomo Cloud setups. --- # Microsoft UET Consent Mode Integration URL: https://www.cookiehub.com/microsoft-uet-consent-mode Last updated: April 1, 2026 ## Integrate Microsoft UET Consent Mode ##### Microsoft Universal Event Tracking consent mode Seamlessly integrate CookieHub CMP with Microsoft’s Universal Event Tracking (UET) Consent Mode, empowering you to manage user consent and remain compliant with global privacy regulations. ### Easy CookieHub + Microsoft UET Consent Mode setup As one of the [CMPs that Microsoft highlights as supporting their consent mode](https://help.ads.microsoft.com/apex/index/3/en/60119), you can easily get started with activating [Microsoft UET Consent Mode in CookieHub](https://docs.cookiehub.com/compliance/frameworks/microsoft-uet-consent-mode). **To use UET Consent Mode with CookieHub** First, ensure that you are using CookieHub CMP version 2.8.8 version or later, as older versions will cause tracking data loss if [UET Consent Mode](https://docs.cookiehub.com/advanced/microsoft-consent-mode) defaults are implemented. Implementation is easy; simply follow the instructions. **Integration with IAB TCF** CookieHub also supports [integration between UET and the IAB Transparency and Consent Framework (TCF) v2.0 string](https://docs.cookiehub.com/compliance/frameworks/microsoft-uet-consent-mode#integration-with-iab-tcf). By adding a simple script, you enable UET to read the TCF string and adjust its behavior according to the user’s consent preferences. ###### UET data handling UET Consent Mode manages data in two ways. One way is that tags only fire and send data after explicit consent is granted. The other way refers to modeling and anonymized data collection after consent is denied. It is important to note that this second way is considered advanced functionality that aims to provide insights into user behavior without identifying individuals, enabling conversion and behavioral modeling in other Microsoft tools. ### Why Microsoft UET Consent matters Microsoft’s UET Consent Mode is Microsoft Advertising’s mechanism to adjust the behavior of UET tags based on user consent. It lets you manage when and how cookies are stored for advertising purposes — giving you a path to stay compliant while retaining valuable campaign insights. **True consent, better data\ ** Before UET Consent Mode, tracking would simply be blocked when users withdrew consent, and you'd lose insight into conversion performance. With UET Consent Mode and a capable CMP (like CookieHub), you can recover a more complete view of campaign performance while respecting user choices. **Microsoft UET Consent is required\ ** Microsoft requires all advertisers serving users in the EEA, UK, or Switzerland to provide valid user consent signals when using UET tags. Without this, conversion tracking and remarketing features may be disabled. Implementing UET Consent Mode helps you continue to use Microsoft Advertising features legally, while making sure campaign reporting and optimization run smoothly. ### Activate Microsoft UET Consent Mode for your CookieHub CMP Consent Mode works by letting users express consent (or decline it) before any Microsoft UET tag behavior is allowed. Once consent is set, the CMP sends signals to UET tags to determine what level of tracking is permitted. **What CookieHub provides:** **Seamless tag adaptation:** The CookieHub front end handles injecting the correct uetq.push('consent', …) commands based on user state. **No manual coding required:** Once enabled, the system ensures UET tags only fire when allowed. **Ongoing compliance updates:** As Microsoft updates its requirements, CookieHub will push updates so you stay aligned. With CookieHub as your CMP, you get full control of consent, from scanning, to blocking, to compliance audit logs and reporting. ### CookieHub CMP consent solution benefits **Effortless compliance with GDPR, ePrivacy, and DMA** CookieHub helps you stay compliant automatically, handling consent collection, storage, vendor lists, versioning, and audits — including for Microsoft UET. **Maintain high-quality, consented data** Even when users deny consent, you’ll capture the proper signals and avoid surprises in ad platforms. When they agree, you get the full detail needed to optimize campaigns. **Trust-centric user experience** Customize your banners and consent flows so they align with your brand. Build transparency that drives conversions, rather than blocking them. #### FAQ about Microsoft UET Consent Mode **What is Microsoft UET Consent Mode?** Microsoft UET Consent Mode framework by Microsoft Advertising lets universal event tags adjust their behavior based on user consent. It uses a consent signal parameter (ad\_storage) to grant or deny tracking. **Why did Microsoft introduce this?** To comply with privacy laws like GDPR, ePrivacy, and the Digital Markets Act. UET Consent Mode ensures advertisers can only track users after consent is obtained — aligning with Microsoft’s policies. **How does consent signaling work?** CookieHub (your CMP) passes the user’s consent choice to UET tags via calls like: ``` window.uetq = window.uetq || [];  ``` ``` window.uetq.push('consent', 'default', { 'ad_storage': 'denied' });  ``` And when the user gives consent, it becomes: ``` window.uetq.push('consent', 'update', { 'ad_storage': 'granted' });  ``` Microsoft’s UET template and best practice guides ensure sequencing is correct (consent first, then the UET tag) to avoid premature firing. **What if users decline consent?** If the user denies consent, UET tags cannot set or read advertising cookies (_ad\_storage = denied_). You will not get detailed attribution for those users. Microsoft does not currently support fallback modeling in that scenario. **Is UET Consent Mode mandatory?** Yes, for any site using Microsoft Advertising’s UET tags targeting users in the EEA, UK, or Switzerland. From May 5, 2025 onward, Microsoft has required valid consent signals. **What happens if I don’t implement it?** UET-based conversion tracking and remarketing features may stop working for visits originating from those regions, harming your campaign performance. **Do I need a CMP?** While technically possible to implement manually, a CMP like CookieHub greatly simplifies compliance — handling consent banners, state management, signals, uniform behavior across pages, and audit logs. Without it, your setup becomes fragile and hard to maintain reliably. **Does CookieHub CMP work well with Microsoft UET?** Not only does CookieHub CMP work seamlessly with Microsoft UET, CookieHub is listed as one of the CMPs that Microsoft acknowledged as supporting their consent mode. **How is Microsoft’s approach different from Google’s?** - Microsoft uses a simpler ad\_storage binary model (granted/denied) rather than the multi-parameter model in Google’s Consent Mode. - Microsoft does _not_ currently provide robust conversion modeling fallback when consent is denied — you either get full tracking or none. - Because of this, the quality of your CMP integration and signal transmission is especially critical. **For whom is UET Consent Mode relevant?** Any business using Microsoft Ads (UET tags) in markets like the EU, UK, or Switzerland should care deeply about UET Consent Mode. - **Advertisers & agencies**: ensures you continue to measure ad performance under consent constraints. - **Marketers**: helps retain signal quality and prevent data blind spots due to consent blocking. - **Website owners / publishers**: allows you to stay compliant while enabling advertising measurement for your partners. **How does UET Consent Mode help conversions and ad campaigns?** In the following ways, UET Consent Mode can help with the success of conversions and ad campaigns: - **Preserve measurement**: Even when many users deny consent, by appropriately managing consent signals, you reduce the amount of lost attribution. - **Improve ad tracking**: When consent is granted, UET tags operate normally — capturing conversions, remarketing, and event details. - **Better optimization** (within limits): With reliable conversion data from consenting users, optimization algorithms in Microsoft Ads can still function effectively. - **Compliance + performance balance**: You don’t have to choose between stopping all tracking or ignoring consent laws — UET Consent Mode gives you structured signal control that supports both. **How can I tell if UET Consent Mode is active?** Use Microsoft’s UET Tag Helper browser extension to inspect UET tags. Before consent, you should see _asc = "D"_ (Denied); after consent, _asc = "G"_ (Granted). In your CMP dashboard (CookieHub), you should see logs of consent events and signal transmissions. Use network dev tools: check requests to _uetq _or Microsoft endpoints to ensure the _consent _commands occur before tag firing. Any debugging guides for UET Consent Mode walk you through verifying sequencing and state transitions. **What data privacy frameworks does UET Consent Mode pertain to?** The major global data privacy regulations are covered by UET Consent, including: - **GDPR** (EU) — ensures personal data processing for tracking only occurs with consent - **ePrivacy Directive** — governs cookie and tracker behavior and timing - **Digital Markets Act (DMA)** — influences Microsoft’s obligations as a gatekeeper platform - **Local privacy laws** — regions may add further constraints **Is Microsoft UET Consent GDPR compliant?** UET Consent Mode alone does not guarantee full compliance with GDPR or other privacy regulations. It is, though, required in order to be compliant with Microsoft’s rules for advertising to users in the EU, UK, EEA, and Switzerland. It must be part of a holistic privacy program including notices, data minimization, purpose limitation, and your overall privacy policy. --- # Norway E-Com Act Cookie Consent Management | GDPR-Aligned Compliance URL: https://www.cookiehub.com/norwegian-electronic-communications-act Last updated: June 16, 2026 ## Norway E-Com Act Cookie Consent and Compliance Norway’s Electronic Communications Act (E-Com Act) mandates explicit user consent for cookies and online tracking. Aligned with GDPR and the EU’s ePrivacy Directive, E-Com introduces consent-based rules for cookies and online tracking. Is your website ready? ### What your business needs to know about the E-Com Act The Norwegian Electronic Communications Act regulates electronic communications more broadly and specifically includes data privacy and consumer rights as a part of its mandate. Norway’s E-Com Act introduces stricter cookie consent rules to bring them in line with GDPR and the EU ePrivacy Directive. If your website collects or processes user data through cookies, you must obtain clear and explicit user consent before tracking begins. ### What does E-Com compliance require? The regulation places a host of demands on businesses, which are now required to provide: **Explicit user consent required:** Users must actively accept cookies before they are placed **Equally accessible “reject” option:** Cookie banners must provide a clearly visible and easy-to-use “reject” button alongside the “accept” button **Clear and transparent information on cookies:** Websites must provide a detailed explanation of what cookies do, why they are used, and who has access to the collected data **Easy consent withdrawal:** Users must be allowed to change or withdraw their cookie preferences at any time **Consent logs:** Businesses must record and securely store consent data to demonstrate compliance in the event of an audit or legal inquiry ### Who needs to comply with Norway’s E-Com Act? Any business or website that processes data from Norwegian users, regardless of where the business is physically located, must comply with this law if they: - Operate an e-commerce store targeting Norwegian customers - Run a news or media website that collects user data - Use tracking technologies - Engage in digital marketing using cookie-based advertising ### Consumer rights under the E-Com Act Norway’s E-Com Act stipulates a number of data privacy and consent-related consumer rights: **Right to consent** Consumers must give explicit and active consent before websites or apps deploy any non-essential cookies or tracking technologies. **Right to detailed information** Consumers are entitled to transparent information regarding the types of data being collected, the purposes of collection, data storage duration, and any transfers to third parties. **Right to give granular consent** Users can consent to different categories of processing separately—for instance, analytics, marketing, or personalization—rather than being forced into an all‑or‑nothing choice. **Right to withdraw or modify consent easily** Consumers can withdraw or modify previously given consent at any time, and businesses must provide user‑friendly mechanisms (e.g., one-click withdrawal through a Consent Management Platform). **Right to only necessary data processing before consent** Businesses may only deploy cookies or tracking mechanisms that are strictly necessary for functionality if they have not obtained valid consent. **Right to remedy** Consumers must be informed of their rights to lodge complaints with the Norwegian Data Protection Authority (Datatilsynet) or seek legal remedies under Norway’s Personal Data Act. This includes access to enforcement and supervisory channels. ### Why cookies as part of Norway E-Com Act compliance If your website uses cookies for analytics, personalization or marketing, you must comply with the E-Com Act rules. And most businesses with an online presence do use cookies to track behavior, preferences, and interactions. As such, it is essential to manage cookie consent properly, implementing a compliant cookie banner that enables explicit accept and reject buttons, allows for consent withdrawal at any time, provides a visible preference management link, and stores consent log records to prove compliance in the event of an audit. ### Penalties for E-Com Act non-compliance Penalties for failure to comply can be harsh: fines of up to 4% of global annual revenue, or 20 million EUR, as well as the intangible and incalculable loss of user trust and reputational damage. ### How to comply with the E-Com Act Compliance with the E-Com Act can be achieved by taking a few key actions: **Review data practices for consent:** Ensure that you obtain explicit, informed consent before storing or accessing non-essential cookies. Pre-ticked boxes and implied consent are non-compliant **Provide clear choices:** Allow users to accept or reject different categories of cookies without influencing their choice and make consent withdrawal transparent **Ensure a symmetrical user experience:** Make “reject all” as easily accessible as “accept all” without burying the options under multiple clicks or with confusing wording **Avoid dark patterns and bundling:** Make sure that consent can be freely given, specific and not conditional **Implement consent management:** Platforms like CookieHub provide an easy way to manage consumer consent for data processing #### Frequently Asked Questions **What is the scope of the Norwegian Electronic Communications Act (E-Com Act)?** The E-Com Act regulates the provision and use of electronic communication services and networks in Norway. It covers areas such as privacy, data protection, security, and the responsibilities of service providers in the electronic communications sector. **What is personal data under Norway’s E-Com Act?** Personal data refers to any information relating to an identified or identifiable individual. This includes details like names, contact information, IP addresses, and any data that can directly or indirectly identify a person. **What is sensitive data according to the Norwegian E-Com Act?** Sensitive data includes personal information that reveals racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health information, sexual orientation, or other information that requires special protection due to its sensitive nature. **Who is the regulatory authority for Norway’s E-Com Act enforcement?** The Norwegian Communications Authority (Nkom) is the official regulatory body responsible for overseeing and enforcing the E-Com Act in Norway. **Who is exempt from Norway’s E-Com rules?** Certain organizations or services may be exempt, including those outside the scope of electronic communications, private internal networks without public access, and specific small-scale operators. However, exemptions are limited and clearly defined by law. **Where can I get more information about the Norway Electronic Communications Act?** More details can be found on the Norwegian Communications Authority’s website (Nkom) and through official government publications related to the E-Com Act. --- # OneTrust Alternative: CookieHub vs OneTrust Compared URL: https://www.cookiehub.com/onetrust-alternative Last updated: September 24, 2026 ## OneTrust alternative: CookieHub vs OneTrust OneTrust is an enterprise trust platform: privacy automation, GRC, third-party risk and AI governance, with cookie consent as one module. CookieHub is a consent management platform and nothing else. Both are Google-certified CMPs registered with the IAB Transparency & Consent Framework. The choice is really between a suite and a focused tool. This page compares the two using each vendor's own website, checked on 24 September 2026. ### The short version - **Choose CookieHub** if cookie consent is the problem you need solved and you want public prices, a self-serve trial and a setup your own team can finish in an afternoon. - **Choose OneTrust** if you want one vendor for consent and for privacy operations, GRC or AI governance, or if you need consent across web, mobile apps and connected TV from a single platform. ### CookieHub vs OneTrust at a glance As published by each vendor on 24 September 2026. CookieHub OneTrust Pricing Public, from €6 a month; free plan available On request only: “schedule a quick call for a personalized quote” Price based on Sessions per month, per domain Average daily visitors across all channels and properties Getting started Self-serve sign-up and 14-day free trial Demo and quote Google-certified CMP true true Google Consent Mode v2 All plans true IAB TCF Business and Enterprise true Global Privacy Control All plans true Banner languages 62, on Basic and above More than 250 Platforms Websites Web, mobile apps and connected TV JavaScript API true true REST API Management API on Enterprise true Wider privacy suite No: consent management only Yes: privacy automation, GRC, third-party risk, AI governance ### Pricing and setup **OneTrust** does not publish prices for its cookie consent product. Its pricing page says the CMP is priced on “average daily visitors aggregated across all channels and properties”, and it offers a personalized quote after a call. It lists no free tier or self-serve trial, so we cannot compare prices here. **CookieHub** publishes every price. Starter is €6 a month for 5,000 sessions, Basic €10 for 30,000, Business €30 for 120,000 and Enterprise €100 from 1,000,000, and there is a free plan for small sites. You can sign up, scan your site and have a banner running without talking to anyone. If you want help, Enterprise includes a customer success manager and implementation services. There is also a difference in how much there is to run. OneTrust is a platform with many modules. CookieHub does one job, so there is less to learn and less to maintain. ### Where OneTrust is stronger A fair comparison has to include these: **Breadth:** One vendor for consent, privacy automation, GRC, third-party risk and AI governance, with a shared data model. **Channels:** Consent across websites, mobile apps and connected TV, including Roku. CookieHub is registered as a web CMP. **Languages:** OneTrust says its banner supports more than 250 languages. CookieHub supports 62. **Universal consent:** OneTrust can tie consent to known users across devices, not just to a browser. ### When CookieHub is the better fit **You need a CMP, not a suite:** If you do not plan to use OneTrust's other modules, you would be buying and running a platform to use one part of it. **Predictable, public pricing:** Every CookieHub plan and overage rule is on the pricing page. **Fast, self-serve setup:** Sign up, scan and publish the banner yourself, the same day. **Agencies and multi-site teams:** Mix plans across domains in one dashboard, with a 30% partner discount. **Developers:** A documented JavaScript API with events on every plan and a Management API on Enterprise. ### Switching from OneTrust CookieHub builds its own cookie list from a scan, so there is nothing to export first. **Create an account:** Start the free trial and add your domain. CookieHub scans the site and sorts the cookies it finds into categories. **Review the categories and design:** Check the categorization, pick a banner template and set your colours and languages. **Swap the script:** Replace the OneTrust script with the CookieHub script, or use the CookieHub template in Google Tag Manager. Remove OneTrust completely so two banners never run at once. **Check the result:** Run the Google Consent Mode checker to confirm consent signals reach Google. **Expect one new prompt:** Consent stored by OneTrust is kept in its own cookie, which CookieHub cannot read. Returning visitors are asked once more. Further reading: [the 62 supported languages](https://www.cookiehub.com/languages), [the consent log](https://www.cookiehub.com/consent-log), [the JavaScript API](https://www.cookiehub.com/javascript-api), [the Management API](https://www.cookiehub.com/management-api), [the Google Consent Mode checker](https://www.cookiehub.com/google-consent-mode-checker), [the free privacy policy generator](https://www.cookiehub.com/privacy-policy-generator). ### Frequently asked questions **How much does OneTrust cost compared with CookieHub?** OneTrust does not publish prices; it provides a quote after a call. CookieHub's prices are public, from €6 a month, with a free plan for small sites. **Are both Google-certified CMPs?** Yes. Both are on Google's list of certified CMPs: OneTrust (listed as OneTrust / Cookiepro) under TCF CMP ID 28, CookieHub under ID 354. **Is CookieHub suitable for enterprises?** Yes. The Enterprise plan adds weekly scans, advanced consent reports, enterprise SSO, CMP configuration through the API, a customer success manager and implementation services. What CookieHub does not offer is OneTrust's wider GRC and privacy suite. **Will my visitors have to consent again after switching?** Yes, once. Each platform stores consent in its own cookie, so CookieHub cannot read choices a visitor made in OneTrust's banner. ### Sources Every fact about a competitor on this page comes from that vendor's own website, from Google's list of certified CMPs or from IAB Europe's CMP list. All of it was checked on 24 September 2026. Prices exclude VAT. - [Google: certified CMPs](https://support.google.com/admanager/answer/13554116) - [IAB Europe: CMP list](https://iabeurope.eu/cmp-list/) - [CookieHub pricing](https://www.cookiehub.com/pricing) - [CookieHub JavaScript API](https://docs.cookiehub.com/advanced/javascript-api) - [OneTrust pricing](https://www.onetrust.com/pricing/) - [OneTrust Cookie Consent](https://www.onetrust.com/products/cookie-consent/) - [OneTrust platform](https://www.onetrust.com/platform/) - [OneTrust JavaScript API](https://developer.onetrust.com/onetrust/docs/javascript-api) Vendors change their plans. If something here is out of date, [tell us](https://www.cookiehub.com/contact-us) and we will correct it. --- # Partners URL: https://www.cookiehub.com/partners Last updated: May 14, 2025 ## Become a partner As a reseller, you can offer your clients a valuable service by helping them to comply with GDPR, CCPA, LGPD, CNIL and POPIA. By joining our partner program, you will be able to offer the CookieHub solution to your clients and earn a monthly commission on their subscription fees. ### Earn commission for contributing to an open and transparent internet To become a reseller, you first need to have a CookieHub user account. This will give you access to our reseller portal, where you can manage your clients and track your earnings. Once you have signed up, you can start promoting the CookieHub solution to your clients and earning commission on their subscriptions. If you have any questions about becoming a reseller, please don’t hesitate to check out our support area or contact us directly at [sales@cookiehub.com](mailto:sales@cookiehub.com). **Reseller** As a reseller, you can take advantage of a 30% discount on all paid domains when you purchase them directly from us. You will have full control over all domain settings on your CookieHub account, allowing you to easily manage your clients and their domains. Our reseller programme is ideal for agencies, web developers, consultants, and managed service providers (MSPs). If you are interested in becoming a reseller partner, simply fill out the form below to sign up. We look forward to working with you and helping you grow your business. **Affiliates** As an affiliate partner, you can earn a 30% monthly commission on each paid domain that you refer to us. We will handle all billing and payment processing for your clients, and they will have control over their domain settings on their own CookieHub account. Our affiliate programme is ideal for contractors, bloggers, and influencers who want to promote the CookieHub solution to their audience. If you are interested in becoming an affiliate partner, please contact us using the support portal to apply. We look forward to working with you and helping you earn extra income. --- # Preconsent URL: https://www.cookiehub.com/preconsent Last updated: July 2, 2026 ## Preconsent As a website owner, it’s important to make sure that you’re following all relevant laws and regulations when it comes to collecting and using your visitors’ personal data. One way to do this is by implementing preconsent for cookies, which allows users to opt-in or opt-out of having cookies placed on their device. Preconsent for cookies is a requirement in many countries, including the European Union, where the General Data Protection Regulation (GDPR) requires that users be informed about and give their consent for the use of cookies. The GDPR also requires that the consent be specific, informed, and freely given. One way to ensure that your website is compliant with these requirements is by using a service like CookieHub, which provides a customizable banner that can be added to your website. The banner allows users to see what cookies are being used on your website, and gives them the option to accept or reject the use of cookies. CookieHub also offers advanced features, such as the ability to categorize cookies based on their purpose and expiration date, and to show users a detailed cookie policy that explains how each cookie is used. This can help you provide more transparency to your users and gain their trust. In addition to complying with the law, implementing preconsent for cookies can also benefit your website in other ways. For example, it can improve the user experience by giving users more control over the data that’s collected about them, and it can also help you avoid potential fines and other penalties for not complying with the GDPR. Overall, using a service like CookieHub can help you ensure that your website is compliant with the GDPR and other relevant laws, while also giving your users more control over their data and improving their experience on your website. **Get 14 days free!** Experience the benefits of our cookie management solutions risk-free! Sign up for any of our plans and receive the first 14 days free. ### CookieHub Features Take control of your cookie privacy with confidence. Explore our features designed for simplicity and built for reliability. **Cookie Scanner** Scans your website for you and detects the cookies that are in use. **Cookie Declaration** Automatically generates a detailed list of the cookies in use on your site. **Pre-Consent** Gain your customers trust by ensuring their privacy is taken seriously. **Consent Log** Log and store user consents along with necessary information required... **Consent Mode Scanner** Ensure Google Consent Mode V2 is correctly implemented on your site. **Geolocation** Automatically shows the correct consent framework depending on the users location. **Accessibility** CookieHub has fully embraced Web Content Accessibility Guidelines (WCAG) standards. **62 Languages** Changes language based on website content, browser preferences or URL prefix. **Reports** Detailed reports on consent responses, sessions and a lot of useful information. **Customer support** Fast and easily accessible support here to assist with any questions you have. **CCPA Compliance** CookieHub helps you protect your users privacy in California by complying to strict cookie consent laws. **TCF 2.4 Compliance** Promote transparency by allowing users to make informed choices about data processing and advertising preferences. **Google Consent Mode V2** As an advertiser, you can collect user data with the rights of users to maintain their privacy. **Google Certified CMP** We’re proud to announce our Google certification, solidifying our position as a trusted CMP for web managers. --- # New Subscription Tiers and Usage Limits for 2026 URL: https://www.cookiehub.com/pricing-changes-2026 Last updated: September 24, 2026 ## 2026 Pricing Updates: What You Need to Know We are updating our pricing to make costs fully predictable. Session overage charges will be removed and replaced with clear plan tiers. There are no per-session overage fees. **For Existing Customers** - **April 1, 2026:** The new pricing applies to all new subscriptions. - **April 1 to June 30:** Your current legacy plan remains unchanged. You may upgrade to one of the new tiers at any time during this period. - **July 1, 2026:** Any remaining legacy subscriptions will be transitioned to the most suitable new plan based on recent usage levels. **No More Overage Fees:** If your subscription exceeds its session limit for two consecutive billing periods, we will automatically move you to the appropriate plan. There are no per-session overage fees and exceeding limits will not interrupt service. **Resellers, Enterprise, and Multi-domain Managers:** If you manage multiple domains or operate under a custom setup, we recommend reviewing your portfolio ahead of the transition. Our team is available to assist. Contact billing@cookiehub.com to discuss the best migration path for your account. **Existing Discounts: **All current discounts will continue to apply under the new pricing structure. This includes reseller, non-profit, affiliate, volume, and other existing discounts. The 2026 pricing update changes the subscription tiers and session limits, but it does not remove or reset existing discounts. **The Agency & Partner Program** **Scale your business with professional compliance tools and recurring discounts.** Specifically designed for web developers and agencies managing multiple client sites. CookieHub provides the flexibility to grow your margins while ensuring your clients stay compliant. - **30% Partner Discount:** Get an automatic 30% discount on every paid domain in your account. - **Mix & Match Plans:** Assign different tiers (Free, Basic, or Business) to different clients under one centralized dashboard. - **White-Label Branding:** Remove the "Powered by CookieHub" link and use custom CSS for a fully branded experience. - **Centralized Billing:** Manage your entire portfolio with one consolidated monthly or annual invoice. **Enterprise Solutions** **Customized compliance and dedicated support for high-volume organizations.** Built for large-scale websites and corporations requiring advanced data insights, technical automation, and priority service. - **Advanced Consent Reports:** Access granular data on user interactions, acceptance rates, and regional performance. - **Full API Access:** Automate your compliance workflows and manage configurations via our robust backend API. - **Dedicated Account Management:** Receive priority support and a dedicated manager for onboarding and technical reviews. - **Custom Agreements:** Available support for custom Master Service Agreements (MSA) and Service Level Agreements (SLA). #### Frequently Asked Questions **How are sessions calculated?** A session is counted when a visitor loads your website and the CookieHub widget initializes. A single visitor can browse multiple pages within one session without increasing your count, making our plans much more cost-effective than "per-pageview" models. **What happens if I exceed my monthly session limit?** - **Paid plans:** If your subscription exceeds its included session limit for two consecutive billing periods, it will automatically move to the appropriate plan. Your consent banner remains active. - **Enterprise:** We will contact you if your usage requires an adjustment to your plan. - **Free:** If you exceed the included session limit, the consent banner will stop showing until you upgrade to a paid plan. **What happens when my trial ends?** You can try any premium plan for free. When the trial expires, you can choose to subscribe to keep your premium features. If you decide not to upgrade, your account will automatically revert to the Free plan. **Is VAT included in the price?** All our prices are listed excluding VAT. Customers located outside Iceland will not be charged VAT and is subject to the reverse charge rule in the country of receipt. Icelandic companies and residents will be charged 24% VAT. **What payment methods do you accept?** We accept all major credit cards (Visa, Mastercard, American Express) and PayPal. For Enterprise customers, we also support bank transfers and manual invoicing upon request. **Can I cancel my subscription at any time?** Yes. You can cancel through your dashboard whenever you like. You will maintain access to your paid features until the end of your current billing period, after which the domain will revert to the Free plan. **How does the 30% Reseller discount work?** Approved partners receive an automatic **30% flat discount** on all premium domains. You have the flexibility to "Mix & Match" plans, assigning different tiers (Basic, Business, etc.) to different clients within one centralized dashboard. **Do you offer a discount for Non-Profit Organizations?** Yes, we support the community. Registered NPOs are eligible for a **50% lifetime discount** on all premium plans. Please contact our support team with your registration details to apply. ### Official Google Certified CMP Experience the power of a Google-certified Consent Management Platform, engineered to meet the highest global standards for privacy and data accuracy. --- # Free Privacy Policy Generator URL: https://www.cookiehub.com/privacy-policy-generator Last updated: July 2, 2026 ## Free Privacy Policy Generator Create an expert-vetted privacy policy template for GDPR, CCPA, and global privacy regulations — ready to copy, paste, and publish. ### Your Free Path to Compliance Navigating data privacy laws like GDPR and CCPA is mandatory but often expensive and complex. We believe compliance shouldn't be a barrier to entry. We provide this **free generator** as a foundational resource, giving you a comprehensive, customized starting point for your compliance journey. Use the generated text or HTML template to quickly establish a compliant privacy policy on your domain. ### Why Choose CookieHub? We provide a high-quality, free alternative to costly legal drafting and complicated subscription services: **100% Free and Immediate** Generate a policy without sign-ups, subscriptions, or fees. Get instant results you can use today. **Expert-Reviewed Content** The underlying policy text has been reviewed and structured with expert legal guidance, giving you confidence in the quality and scope of the template. **Simple Implementation** Receive the policy as clean text or HTML code, allowing you to easily copy, paste, and host it directly on your website. **Global Scope** The generated policy covers critical disclosure requirements for users in the EU (GDPR), UK, Brazil (LGPD), Switzerland, and various US states. ### How It Works: Policy Generation in 3 Steps Our free generator transforms the complex process of policy creation into three fast, guided steps, providing you with a high-quality, template instantly. **1. Configure** Answer a quick, guided questionnaire about your specific data practices (collection, sharing, retention, etc.). **2. Generate** The platform instantly compiles a complete policy tailored to your responses, using expert-reviewed language. **3. Copy & Implement** Download the policy as a **text file** or **copy the HTML code**. Paste it onto a dedicated page on your website and publish. ### Core Features: Built for Compliance While the generator is a free, static resource, the quality of the policy output is its greatest asset. We focus on providing features that ensure accuracy and simplify your implementation process across any web platform. **Jurisdiction-Specific Clauses** Includes comprehensive legal text for exercising **User Rights** tailored to major global regions (e.g., **GDPR, CCPA, LGPD**), ensuring tailored international coverage. **CMS and Platform Ready Output** The HTML output is intentionally **clean and minimal**, ensuring smooth implementation across major Content Management Systems (like WordPress, Shopify, etc.) without needing manual code cleanup. **Comprehensive Structure** Ensures coverage of all essential sections, from **Company Identity** and **Information We Collect** to **International Transfers**, providing a complete compliance framework. **Retention Tracking & Transparency** Helps you clearly state **How Long We Retain Information** based on data type and includes crucial definitions, such as defining your legal role (Controller/Processor), which are essential for compliance. #### Frequently Asked Questions **Is the CookieHub Privacy Policy Generator really free?** Yes, the generator is completely free to use. There are no charges, sign-up requirements, or hidden fees. **Does CookieHub host the final policy for me?** No. We provide the policy content as raw text or HTML code. You must copy this code and implement it on your own website, hosted on your own domain. **Does the policy update automatically when laws change?** No, the generated policy is a static template. Because you host the policy on your own site, **dynamic updates are not automatic.** It is your responsibility to monitor legal changes and manually update the policy text on your website as needed. **Do I need a Privacy Policy if I don't collect data directly (e.g., no forms)?** Yes, it is highly likely. If your website uses analytics (like Google Analytics), embeds videos (like YouTube), or uses server logs, you are collecting data (such as IP addresses and cookie identifiers) indirectly. Major laws like **GDPR and CCPA require disclosure** if any personal data is collected, regardless of the source. **Is a Privacy Policy the same as a Cookie Policy?** No. A **Privacy Policy** is a broad document covering _all_ personal data collection, use, and sharing. A **Cookie Policy** (or a dedicated section within the Privacy Policy) is specifically focused on the use and purpose of cookies and tracking technologies. Our generator includes the necessary cookie disclosure sections. **Do I need to use CookieHub's CMP to use this generator?** No. While the generated policy integrates perfectly with a CookieHub CMP, you can use the policy template regardless of which Consent Management Platform (or method) you use. --- # CookieHub CMP | Google Certified Cookie Consent & Compliance URL: https://www.cookiehub.com/product Last updated: September 25, 2026 ## Cookie Consent Management for Modern Privacy Compliance Stay compliant with global privacy laws without losing analytics insights. CookieHub is a Consent Management Platform that scans cookies, collects consent, and records proof of consent for modern websites. ### How CookieHub Works CookieHub simplifies cookie consent and privacy compliance for modern websites. The platform automatically detects cookies, collects user consent, and records consent decisions so organizations can meet privacy requirements without complex implementation. **Step 1: Scan your website** Automatically detect cookies, tracking scripts, and other technologies that collect data. Scheduled scans ensure your cookie inventory stays accurate as your site evolves. **Step 2: Collect user consent** Display a customizable consent banner that lets visitors accept, reject, or manage cookie preferences. Non-essential scripts are blocked until consent is given. **Step 3: Maintain compliance automatically** CookieHub generates cookie declarations, stores consent records, and applies regional privacy rules so your website remains compliant. #### Google Consent Mode v2 support CookieHub integrates with Google Consent Mode v2 so Google tags adjust their behavior based on the visitor’s consent choices. This allows websites to maintain analytics and advertising measurement while respecting privacy requirements. #### Global Privacy Control (GPC) support CookieHub detects Global Privacy Control signals sent by compatible browsers and automatically applies opt-out preferences where required by privacy laws. ### IAB TCF 2.4 Support CookieHub supports the IAB Transparency and Consent Framework (TCF) to help websites communicate consent signals to advertising vendors in the ad ecosystem. This enables compliant ad-tech integrations while maintaining transparency and user control. ### Verifiable proof of consent Privacy regulations require organizations to demonstrate that valid consent was obtained. CookieHub securely stores consent records so teams can verify when consent was given and what choices were made. Each consent record includes - timestamp of consent - consent categories selected - consent identifier - applicable privacy framework Consent records can be retrieved to demonstrate compliance when required. ### Enterprise governance & access management CookieHub includes enterprise-grade tools for organizations managing privacy compliance across multiple teams, brands and environments. **Enterprise SSO (OIDC & SAML)** Integrate CookieHub with enterprise identity providers using secure Single Sign-On authentication. **Multi-user & access management** Manage team access securely across domains, environments and compliance workflows. **DSAR management** Streamline Data Subject Access Requests with centralized request handling and compliance workflows. ### Automated cookie discovery CookieHub continuously scans your website to identify cookies and tracking technologies. Detected cookies are matched against an updated cookie database to help categorize technologies and maintain accurate compliance documentation. **Cookie scanning** Automatically detect cookies and tracking scripts across your website so you know what technologies are active. **Cookie database** Detected cookies are matched against a database of known trackers to help categorize cookies and generate accurate declarations. **Cookie audit reports** Each scan generates a report listing cookies, providers, purposes, and expiration durations so teams can review tracking technologies. ### Flexible consent collection CookieHub allows visitors to make clear consent choices while giving website owners flexible control over how consent is collected and managed **Customizable consent banner** Configure the appearance and behavior of the consent banner to match your website and compliance needs. **Consent preference management** Visitors can update or withdraw their consent choices at any time through the consent settings interface. **Pre-consent script blocking** Prevent non-essential scripts from running until the visitor provides consent. ### Compliance evidence and insights CookieHub provides the tools organizations need to document consent decisions and demonstrate privacy compliance. **Consent logs** Consent records are stored securely and include timestamps, consent choices, and identifiers used to verify consent. **Compliance reports** Reports help teams review consent behavior including acceptance trends and category preferences. **Cookie declarations** Automatically generate and maintain a cookie declaration page that lists detected cookies and their purposes. ### Built for global audiences Automatically generate and maintain a cookie declaration page that lists detected cookies and their purposes. **Geo-targeted consent rules** Apply the correct consent experience depending on visitor location and applicable privacy regulations. **62 supported languages** Display consent banners and cookie declarations in the visitor’s preferred language. [View all languages](https://www.cookiehub.com/languages) **Accessible consent interface** CookieHub banners support accessible browsing aligned with WCAG guidelines, including screen reader support and keyboard navigation. #### Frequently Asked Questions **What is a Consent Management Platform (CMP)?** A consent management platform helps websites manage how cookies and tracking technologies collect user data. CMPs allow websites to inform visitors about cookies, collect consent choices, block tracking until consent is given, and store records of consent decisions. **Does CookieHub support Google Consent Mode v2?** Yes. CookieHub integrates with Google Consent Mode v2 so Google Analytics and advertising tags adjust their behavior based on user consent preferences. **How long does it take to implement CookieHub?** Most websites can implement CookieHub in a few minutes using a simple JavaScript snippet or through Google Tag Manager. **What information is stored in the consent log?** Consent logs store records of consent decisions including timestamps, consent category choices, and consent identifiers used to verify consent. **Can visitors change their consent later?** Yes. Visitors can update or withdraw their consent choices at any time through the consent preferences interface. **Can CookieHub manage multiple websites?** Yes. CookieHub allows organizations to manage consent across multiple websites and domains from a single dashboard. **Does CookieHub support global privacy regulations?** CookieHub helps websites comply with major privacy regulations including GDPR in Europe and privacy laws across the United States. --- # Consent Management Platform for Publishers URL: https://www.cookiehub.com/publishers Last updated: October 8, 2026 ## Consent management for publishers ##### A Google-certified CMP running IAB TCF 2.4, for sites that earn from advertising Google requires publishers using AdSense, Ad Manager or AdMob to use a Google-certified CMP integrated with the TCF when serving personalized ads to users in the EEA, the UK and Switzerland. CookieHub is a Gold Google Certified CMP, certified by IAB Europe as CMP 354, and was updated to TCF v2.4 ahead of the IAB's 23 October 2026 deadline. ### What an ad-funded site needs from its CMP **Google's CMP requirement, met** CookieHub is a Gold [Google Certified CMP](https://www.cookiehub.com/google-certified-cmp). Google assesses certified CMPs mainly on TCF compliance, and requires one for personalized ads served through AdSense, Ad Manager and AdMob in the EEA, the UK and Switzerland. CookieHub also supports Google's Additional Consent specification, for ad technology providers that are not registered with the TCF. **IAB TCF 2.4, kept current** CookieHub implements [IAB TCF 2.4](https://www.cookiehub.com/iab-tcf-v24) and Policies v5.0.b. Domains with automatic updates moved to v2.4 with nothing to configure, almost a month before the IAB's 23 October 2026 web deadline. **Consent signals you can defend** The TC string reflects the purposes and vendors your dialog disclosed and the choices your visitors made. Purposes you do not present are never signalled as consented, and the disclosed-vendors segment records which vendors were shown. ### How publishers stay compliant as the TCF evolves IAB Europe revises the framework regularly, and each version comes with a date by which CMPs must implement it. A publisher maintaining its own TCF integration has to track every release. With a managed CMP, the changes arrive in the widget. **Updates ship to the widget:** TCF v2.4 reached every automatically updating CookieHub domain ahead of the deadline, with no migration. **Your choices carry over:** Existing dialogs keep the same purposes and controls in the same order when new disclosures are added. **Stored consent is never rewritten:** Changing your purpose set does not alter consent already collected. Newly added purposes read as denied until the visitor is asked again. **Checked against the live vendor list:** Every change in the 2.4 release was verified by decoding real consent strings against the live Global Vendor List. **You decide what the dialog asks for** Choose which purposes, special features and stacks your dialog presents, individually or as IAB stacks, and manage your vendor list and legitimate-interest settings in the Dashboard's TCF settings. **Personalized ads and Consent Mode** Present purposes 3 and 4, or Stack 10, and the ad\_personalization Consent Mode signal becomes grantable once visitors consent. How CookieHub derives each Consent Mode signal under the TCF is [documented](https://docs.cookiehub.com/compliance/frameworks/google-consent-mode-v2) for widget version 2.9.1 and later. ### Built for many sites and many markets **Every site in one dashboard** Manage all your properties from one account, with cross-domain consent and forwarding on the Business plan. **The right framework in each region** Geolocation shows each visitor the consent framework for their location: the TCF in Europe, and frameworks such as the [IAB Global Privacy Platform (GPP)](https://www.cookiehub.com/iab-gpp) elsewhere. **Consent reports** Reports on consent responses and sessions, with advanced consent reports on the Enterprise plan. #### FAQ for publishers **Do publishers need a Google-certified CMP?** If you serve personalized ads through AdSense, Ad Manager or AdMob to users in the EEA, the UK or Switzerland, yes. Google requires a Google-certified CMP integrated with the TCF for those ads. CookieHub is a Gold Google Certified CMP. **Is the IAB TCF a legal requirement?** No. The TCF is an industry standard, not a law, and the GDPR does not require websites to use it. Advertising platforms do: Google requires it for the ads above, and header bidding providers and other advertising partners may require a valid TC string. **Can I collect consent for ad tech providers that are not in the TCF?** Yes. CookieHub supports Google's Additional Consent specification, which carries consent for ad technology providers on Google's list that are not registered with the TCF. **How do I keep up with new TCF versions?** Use a CMP that ships them. CookieHub moved every automatically updating domain to TCF v2.4 before the IAB's 23 October 2026 web deadline. If automatic updates are disabled on your domain, update to the 2.4 release before then: CookieHub no longer supports TCF 2.3. **Can I use the TCF together with Google Consent Mode?** Yes. CookieHub derives the Consent Mode signals from your visitors' TCF choices, and the mapping for each signal is [documented](https://docs.cookiehub.com/compliance/frameworks/google-consent-mode-v2) for widget version 2.9.1 and later. **Does CookieHub handle visitors outside Europe?** Yes. Geolocation shows each visitor the framework for their region, and CookieHub supports the [IAB Global Privacy Platform (GPP)](https://www.cookiehub.com/iab-gpp) for privacy signals beyond the TCF. **Which CookieHub plan do I need?** IAB TCF is included in the Business plan and in Enterprise. Sites with more than 1,000,000 sessions a month, or that need API configuration, SSO or implementation help, belong on Enterprise. --- # React Cookie Consent Integration | CookieHub for React.js URL: https://www.cookiehub.com/react Last updated: April 1, 2026 ## React.js Cookie Consent Integration React apps load scripts dynamically and navigate without full page refreshes—so tracking can fire early if consent isn’t handled correctly. CookieHub adds a full consent layer to your React site, blocks non-essential cookies until approval, and helps keep your app aligned with GDPR, CCPA, and other privacy regulations. ### Effortless Compliance, Centralized Control CookieHub integrates cleanly into React projects through react-cookiehub, giving you a consent banner, consent-driven script loading, and a consistent consent state across route changes. Once installed, CookieHub manages consent logic and keeps behavior consistent across your entire app. For step-by-step installation, see the [React package guide](https://www.npmjs.com/package/react-cookiehub). **Key Benefits:** - Block tracking scripts before consent (SPA-safe) - Keep consent behavior consistent across client-side routing - Control third-party scripts by category (analytics/marketing/etc.) - Use built-in components for common scripts (GA, Pixel, YouTube) - Extend control with CookieHub events/methods when needed ### Why Use CookieHub with React.js React makes it easy to accidentally load tracking when components mount, routes change, or scripts are lazy-loaded. CookieHub solves this by acting as the consent authority and giving you a predictable way to initialize consent once and gate scripts by consent category—without scattering consent checks throughout your components. **What CookieHub Adds to React.js** **Consent-first script loading** Only load analytics/marketing tags after the user grants the required category. **SPA-friendly initialization** Initialize once at the app root and keep consent state stable across route changes. **Components for common tracking tools** Use purpose-built components like CookieHubScript, CookieHubGA, CookieHubPixel, and CookieHubYoutube to avoid premature execution. **Event-driven control when you need it** React to consent changes using events like onAllow / onRevoke or JS API hooks. ### How It Works CookieHub integrates cleanly at app level. No backend changes. No complex rewiring. Setup takes only a few steps—follow the [package guide](https://www.npmjs.com/package/react-cookiehub). **1. Install** Add the package to your project and keep it updated. **2. Initialize CookieHub at the app root** Initialize at the root component. For SSR frameworks (like Next.js), initialize client-side to avoid server execution. **3. Gate scripts by consent category** Use the provided script components (or CookieHub events) so tags only run after consent. **4. Verify behavior and stay compliant** Confirm cookies don’t fire before consent and use CookieHub controls/events for any custom tracking behavior. #### Frequently Asked Questions **Does this work with Next.js (SSR)?** Yes. The package documentation recommends initializing CookieHub client-side (e.g., via a client component / useEffect) because it relies on window. **How do I prevent scripts from running before consent in React?** Use CookieHubScript (and related components) to load scripts with a required category, or hook into consent events like onAllow to initialize tools only after consent. **Can I load Google Analytics and Meta Pixel conditionally?** Yes—react-cookiehub includes components like CookieHubGA and CookieHubPixel designed to load those tools without running before consent. **How do I react to consent changes without a page refresh?** CookieHub supports events (e.g., when a category is allowed/revoked) and a JavaScript API you can use to update your app behavior immediately. **Where do I find the required “domain code”?** react-cookiehub initializes CookieHub with your “domain code” (as shown in the package docs). --- # Register URL: https://www.cookiehub.com/register Last updated: April 25, 2025 --- # Cookie Regulations | Global Consent & Compliance URL: https://www.cookiehub.com/regulations Last updated: June 23, 2026 ## Cookie regulations Data privacy and consent regulations exist around the world to safeguard users’ privacy and preserve their right to consent or not. The use of cookies is the cornerstone of these regulations, governed by laws and guidelines like the EU’s General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA) – and many more. No two cookie policies are alike, and each is unique enough that website owners face a challenge, and bear a responsibility, when trying to follow, adhere to and comply with these laws regardless of where their users are. ### Global cookie regulations: Stay compliant with CookieHub Make sure your website meets global consent regulations and cookie laws – regardless of where your users are. CookieHub supports full compliance with the latest data privacy regulations and gives you flexible options for cookie banner customization. Cookies are regulated by various global data privacy laws, such as the EU’s General Data Protection Regulation (GDPR) and California’s Consumer Privacy Act (CCPA), among a growing list designed to protect consumers and their right to consent. Although many cookie policies and consent requirements share similarities, website owners and brands must ensure that they adhere to the critical differences. CookieHub makes this easy. Our consent banner is displayed correctly for each country based on its regulations by default, but you can overwrite this by creating a new customized banner for whatever region or country, as it suits your needs. This means that CookieHub works for you, whether you want worry-free, automatic cookie handling or want more control and customization. ### Europe ### North America ### South America ### Asia ### Africa ### Oceania --- # CookieHub Reseller Program | Scale Your Agency Revenue URL: https://www.cookiehub.com/reseller Last updated: January 19, 2026 ## Grow Your Agency Revenue with the World’s Most Flexible CMP Partner with CookieHub to deliver effortless global compliance to your clients. Get exclusive 30% margins, a centralized management dashboard, and a solution that "just works." ### Why Agencies and MSPs Choose CookieHub Stop wrestling with manual cookie banners. Join 30,000+ websites using the platform built for scale. **Recurring Revenue, Your Way:** Flexibility is at our core. Whether you want to bundle compliance into your own invoices or let us handle the billing, you always secure a 30% advantage. **Centralized Client Management:** No more juggling passwords. Access every client domain from a single portal, with the ability to invite clients as users to their specific accounts so they can view their own data and settings securely. **Total Financial Transparency:** View a detailed list of all your clients under your "Client Accounts," complete with full transaction history and real-time tracking of your accumulated commissions. **No Limits, Just Growth:** We’ve removed the caps. Manage unlimited domains—including free plans for smaller sites—directly within your reseller account. **Plug-and-Play Compliance:** GDPR, CCPA, LGPD, and more—covered. Our automatic scanner and script-blocker mean you don't have to spend hours auditing client sites manually. ### Built for Your Tech Stack CookieHub integrates seamlessly with the industry-standard tools your team already uses. No complex workarounds, just native compatibility. **Google Consent Mode v2** Fully compliant with **Google Consent Mode v2**. Support high-performance tracking and "Advanced" implementations with zero friction. **Seamless CMS Deployment** One-click setups and dedicated plugins for **WordPress, Shopify, Wix, Webflow,** **Magento** and more. **Enterprise-Ready Infrastructure** Deep integration with **Google Tag Manager** and **Matomo**. Use our robust **Developer API** to automate domain provisioning and custom configurations. ### How it Works The CookieHub Reseller dashboard is a central command center built for efficiency. Manage your entire portfolio from one interface, eliminate the hassle of multiple logins, and take full control over your client billing and compliance settings. **1. Create a Client Account** Navigate to the **Reseller** section and click **Client Accounts** to add a new workspace. From here, you can **invite your clients as users**, giving them dedicated access to their own domains while you maintain master control. **2. Add Domains** Enter the domain name and select the subscription level that fits their needs. **3. Set the Billing** Decide if you will pay (securing an instant 30% discount) or if the client will pay (earning you a 30% commission). **4. Monitor Growth** Use your client list to track all transactions, subscription statuses, and your growing account balance in one place. #### Frequently Asked Questions **How do I sign up to become a reseller?** To sign up, use the reseller registration form on our website. Ensure you have a CookieHub account before signing up. **Do I need to create a CookieHub account before I sign up to become a reseller?** Yes, a CookieHub account is required before signing up as a reseller. **How long does it take to activate my reseller account after I sign up?** Account activation is reviewed within 48 hours. You will receive an email with next steps upon approval. **Must I have a paid subscription for my own website to be a reseller?** No, a paid subscription is not required to become a reseller for other domains. **Can I have free domains on my reseller account?** You can manage as many free domains as you need. This is ideal for smaller projects, internal testing, or low-traffic landing pages. **How do I track my earnings?** In the Reseller section, you can view a comprehensive list of all your clients. This includes every transaction and a clear breakdown of the commissions you have earned from client-paid subscriptions. **How do I get my commissions paid out?** When commissions accumulate in your balance from client-paid accounts, you can request a payout via Wire Transfer (IBAN/SWIFT) or PayPal once your balance reaches €100. **Can I move existing domains into my Reseller account?** Yes. If you have domains in your current account, they will be eligible for reseller benefits and can be organized under Client Accounts once your application is approved. --- # Shopify Cookie Consent App | GDPR & Google Consent Mode v2 URL: https://www.cookiehub.com/shopify Last updated: September 24, 2026 ## Shopify Cookie Consent App **GDPR Cookie Consent and Google Consent Mode v2 for Shopify** Install CookieHub's official Shopify app to manage cookie consent, comply with GDPR, CCPA, LGPD, and other privacy regulations, and synchronize visitor consent with Shopify's Customer Privacy API. CookieHub automatically creates your account, configures your Shopify privacy settings, and installs a fully customizable cookie consent banner without requiring manual code changes. ### Official Shopify App CookieHub provides a seamless way to add a modern Consent Management Platform (CMP) to your Shopify store. The official Shopify app automatically creates your CookieHub account, provisions your storefront, configures Shopify's privacy settings, and installs CookieHub using Shopify's Theme App Embed. No account registration, API keys, or manual code snippets are required. With CookieHub you can: - Synchronize consent with Shopify's Customer Privacy API - Automatically configure Shopify privacy settings - Display a fully customizable cookie consent banner - Automatically scan your store for cookies - Block non-essential cookies before consent - Enable Google Consent Mode v2 - Generate an always up-to-date cookie declaration - Maintain proof of visitor consent - Support 62 languages - Manage multiple Shopify stores from a single dashboard For advanced use cases, CookieHub can also be installed manually. ### Why Use CookieHub with Shopify Modern Shopify stores rely on analytics, advertising pixels, embedded content, and third-party applications that may require visitor consent before they can operate. CookieHub helps merchants manage consent while integrating directly with Shopify's own privacy infrastructure. **Native Shopify Integration** CookieHub synchronizes every visitor's consent preferences with Shopify's Customer Privacy API. Whenever consent changes, Shopify-managed pixels, Web Pixels, and compatible Shopify apps automatically receive the updated consent status, ensuring a consistent privacy experience across your store. **Automatic Privacy Configuration** During installation, CookieHub automatically configures Shopify's Customer Privacy settings for supported regions. Consent is configured for visitors in GDPR regions such as the EU, EEA, United Kingdom, and Switzerland, while supported US privacy regulations are automatically configured for applicable states. There's no need to manually configure Customer Privacy settings within Shopify. **Automatic Cookie Blocking** CookieHub automatically prevents analytics, advertising, and other non-essential tracking technologies from loading until visitors have granted consent. This helps ensure your Shopify store complies with applicable privacy regulations. **Automatic Cookie Scanner** CookieHub scans your Shopify storefront to identify cookies and tracking technologies used by your theme, installed apps, and third-party integrations. Your cookie declaration is automatically generated and kept up to date. **Google Consent Mode v2** CookieHub automatically communicates visitor consent choices to Google Analytics, Google Ads, and Google Tag Manager using Google Consent Mode v2. This allows Google services to respect each visitor's consent preferences while preserving measurement capabilities. **Fully Customizable Cookie Banner** Customize every aspect of your consent banner to match your store's branding. Configure layouts, colors, positioning, languages, consent behavior, and appearance directly from the CookieHub dashboard without modifying your Shopify theme. ### How It Works Getting started with CookieHub only takes a few minutes. **1. Install the App** Install CookieHub directly from the Shopify App Store. Your CookieHub account and storefront are automatically created during installation. **2. Enable the Theme App Embed** Open your Shopify Theme Editor, enable the CookieHub Theme App Embed, and save your changes. No Liquid template editing or manual code insertion is required. **3. Scan and Configure** CookieHub automatically scans your storefront and lets you customize your consent banner, compliance framework, languages, and branding. **4. Publish** Your cookie consent banner is now live. Visitor consent is automatically synchronized with Shopify's Customer Privacy API, Google Consent Mode v2, and CookieHub's consent records. #### Frequently Asked Questions **Does CookieHub integrate with Shopify's Customer Privacy API?** Yes. CookieHub synchronizes visitor consent directly with Shopify's Customer Privacy API, allowing Shopify-managed services, Web Pixels, and compatible applications to respect the same consent preferences. **Do I need to modify my Shopify theme?** No. Most Shopify stores simply install the CookieHub app and enable the Theme App Embed. Manual installation is also available for advanced implementations. **Does CookieHub automatically configure Shopify's privacy settings?** Yes. During installation, CookieHub automatically configures Shopify's Customer Privacy settings for supported GDPR and US privacy law regions. **Can CookieHub block cookies before visitors give consent?** Yes. CookieHub automatically blocks non-essential cookies and tracking technologies until visitors have granted consent. **Does CookieHub support Google Consent Mode v2?** Yes. CookieHub fully supports Google Consent Mode v2 and automatically communicates visitor consent choices to Google services. **Can I customize the cookie banner?** Yes. You can customize layouts, colors, positioning, languages, branding, and consent behavior directly from the CookieHub dashboard. **Does CookieHub automatically scan my Shopify store?** Yes. CookieHub automatically scans your storefront to identify cookies and tracking technologies and keeps your cookie declaration up to date. **Can agencies manage multiple Shopify stores?** Yes. CookieHub allows agencies, developers, and organizations to manage multiple Shopify stores from a single CookieHub account. --- # Shopify Customer Privacy API Integration URL: https://www.cookiehub.com/shopify-customer-privacy-api Last updated: September 24, 2026 ## Shopify Customer Privacy API ##### Shopify privacy integration made easy Make your Shopify store privacy compliant and ready to manage consent with the CookieHub CMP integration. ### Easy CookieHub + Shopify Customer Privacy API setup Here’s how you can easily integrate CookieHub with the Shopify Customer Privacy API: **Implement through Shopify** Install [CookieHub in Shopify](https://docs.cookiehub.com/installation/shopify) and follow the simple setup instructions. Make sure you have the latest version of CookieHub installed from the Shopify App Store. In your Shopify admin, enable Customer Privacy API Integration in the CookieHub settings and configure your consent settings. **Implement through Google Tag Manager** CookieHub offers a convenient Google Tag Manager template that comes with integrated consent mode support, making it easy and hassle-free to [implement into your existing Google Tag Manager](https://docs.cookiehub.com/installation/google-tag-manager) container. ### Why the Shopify Customer Privacy API matters Shopify introduced the Customer Privacy API to standardize how merchants, themes, and apps handle user consent. It ensures consistent, privacy-first behavior across the entire Shopify ecosystem. With growing global privacy regulations (like GDPR, CCPA, and LGPD), Shopify store owners and app developers face increasing responsibility to handle user consent correctly. **Manage consent, automate compliance** Before the Customer Privacy API, each Shopify app or theme often implemented its own cookie banner or tracking logic — leading to redundancy, poor user experience, and compliance risk. By integrating CookieHub CMP with the Shopify Customer Privacy API, you gain: - **Centralized consent management** across all plugins. - **Accurate, standardized consent signaling** for every data-handling component. - **Automatic propagation** of consent states — once a user gives or denies consent, all connected plugins are updated instantly. This ensures consistent privacy behavior, smoother customer experience, and full compliance with global regulations — without slowing down your storefront. **Consistent consent experiences across Shopify with CookieHub** CookieHub’s integration with the Shopify Customer Privacy API standardizes consent communication across your entire store. With CookieHub and the API working together, you can: - Effortlessly manage and synchronize cookie consent preferences across all apps and tracking tools - Accurately log and document user consent for regulatory audits - Provide a unified, transparent consent experience for shoppers worldwide - Enable or disable third-party scripts automatically based on user preferences ### Activate Shopify Customer Privacy API integration for your CookieHub CMP The Shopify Customer Privacy API allows themes, apps, and scripts to check and respect customer consent preferences before loading tracking scripts or setting cookies. CookieHub makes this process easy: **Simple integration:** Install the CookieHub Shopify app to connect automatically with the Customer Privacy API. **No coding required:** Activate and configure in minutes. **Future-proof compliance:** Stay on top of shifting global privacy laws with automatic CookieHub updates. **Works across apps and themes:** Whether it’s Facebook Pixel, Google Analytics, or custom apps — all respect the same consent preferences. ### CookieHub CMP + Shopify Customer Privacy API benefits Integrating CookieHub CMP with the Shopify Customer Privacy API ensures that customer consent preferences are consistently respected across your storefront and app ecosystem. This simplifies compliance with privacy regulations such as GDPR, CCPA, LGPD, and ePrivacy Directive — without sacrificing site performance or marketing capabilities. **Plug-and-play setup, seamless integration, complete automation** Instantly integrate CookieHub’s consent management with Shopify’s privacy infrastructure through our dedicated app. From cookie scanning and consent collection to recordkeeping and reporting, CookieHub automates compliance from end to end — whether you manage a single store or multiple Shopify Plus environments. **Compliance on reliable autopilot** Meet global privacy standards without manual updates or monitoring. CookieHub adapts automatically as laws evolve, keeping your store compliant without technical maintenance. **Better user experience and trust** Ensure all Shopify apps, pixels, and analytics tools honor the same consent preferences for a smoother experience. Build customer trust and increase conversions with transparent, compliant data handling. #### FAQ about Shopify Customer Privacy API **What is the Shopify Customer Privacy API?** The Shopify Customer Privacy API is a framework that standardizes how Shopify stores, themes, and apps handle customer consent. It ensures consistent, privacy-compliant behavior across the Shopify ecosystem. Introduced to support global data protection laws, it provides a single, reliable source for managing and sharing consent states. **How does the Shopify Customer Privacy API work?** The API allows consent management tools like CookieHub to register, store, and share consent preferences. When an app or theme attempts to track or collect data, it checks the Customer Privacy API to determine if consent has been given. If not, the script stays paused until the user grants permission. **Why should I use CookieHub with the Shopify Customer Privacy API?** CookieHub automates consent management — collecting preferences, communicating them to all Shopify apps, and maintaining compliance automatically. Instead of managing consent manually, CookieHub ensures your entire storefront respects privacy regulations seamlessly. **Is the Shopify Customer Privacy API required?** The Shopify Customer Privacy API is not required,  but it is a strongly recommended complement to Shopify to help ensure GDPR, CCPA, and similar compliance. Many Shopify apps and integrations now rely on it for consistent privacy handling. **What consent categories are supported?** Shopify’s Customer Privacy API uses four consent categories: **analytics**, **marketing**, **preferences** and **sale_of_data**. CookieHub maps its categories to them automatically: analytics to analytics, marketing to marketing and preferences to preferences. sale_of_data follows the visitor’s “Do not sell or share” choice where the CCPA applies, and the marketing choice elsewhere. Necessary cookies are always allowed. **Can I use the API without a CMP like CookieHub?** Yes, but it’s not recommended. Without CookieHub, you’d have to manage cookie collection, logging, and user preferences manually. CookieHub automates all of this while staying up to date with privacy regulations. **How do I verify that the API is working?** Open your storefront, accept and then reject a category in the CookieHub banner, and check that apps and pixels that use Shopify’s Customer Privacy API follow the choice — for example, that analytics only fires after consent. The integration is on by default and can be switched off in your CookieHub domain settings. **What regulations does the API help with?** It supports compliance with major privacy frameworks including: - GDPR (EU) - ePrivacy Directive (EU) - CCPA / CPRA (California) - LGPD (Brazil) - PIPEDA (Canada) While the API alone doesn’t make your store compliant, it’s a crucial component of a compliant setup when used with CookieHub. **Do I need a developer to set it up?** No. CookieHub’s Shopify app and Customer Privacy API integration require no coding — it can be configured directly through your Shopify Admin. **Does CookieHub support Shopify Plus or multi-store setups?** Yes. Install the CookieHub app on each store, including Shopify Plus stores. Each store is its own domain in your CookieHub account, so you can manage all of them from one CookieHub dashboard. **Which apps are compatible with the Customer Privacy API?** Shopify’s own analytics and customer events, and apps and pixels that use the Customer Privacy API, respect the consent CookieHub sets. CookieHub passes each visitor’s choice to Shopify, so there is nothing to connect app by app. **Does CookieHub log consent records?** Yes. CookieHub securely logs all consent actions for audit and compliance reporting, accessible from your dashboard. --- # Squarespace Cookie Consent Solution | Data Privacy Compliance with CookieHub URL: https://www.cookiehub.com/squarespace Last updated: April 1, 2026 ## Cookie Consent for Squarespace Squarespace gives you an elegant website platform, but it doesn’t provide a built-in cookie consent system that stops tracking before users agree. CookieHub fills that gap with an automated, privacy-law-aligned solution that blocks non-essential cookies, logs consent, and adapts to your site’s scripts — no advanced development needed. ### Effortless Compliance, Built for Squarespace CookieHub integrates directly into Squarespace’s code injection interface. After implementation, CookieHub enforces consent rules, prevents tracking before approval, and maintains compliance records — all while preserving your site’s design and performance. For step-by-step installation, see the [Squarespace implementation guide](https://support.cookiehub.com/article/434-how-to-install-cookiehub-in-squarespace). **Key Benefits:** - Blocks third-party tracking before user consent - Consent logging for audit and legal evidence - Automatic cookie scanning and categorization - Customizable banner themes, colors, and layouts - Dynamic cookie declaration that can be embedded into your content - Simple, code-light implementation ### Why Use CookieHub with Squarespace Squarespace loads scripts for analytics, marketing pixels, embedded content, and external integrations directly in page headers or blocks — which usually fire cookies automatically. Without a consent management system, this can lead to non-compliant tracking and privacy risks. CookieHub gives you a centralized layer that controls all scripts consistently, regardless of origin, so you stay compliant even as your site grows. **What CookieHub Brings to Squarespace Sites** **Regulatory Privacy Compliance** Ensures your Squarespace site aligns with GDPR, CCPA, LGPD, and other global data-privacy regulations. **Pre-Consent Cookie Blocking** Prevents analytics, marketing, and third-party cookies from loading until visitors provide consent. **Consent Logging for Audits** Securely records user consent decisions, giving you clear documentation for compliance reviews. **Cookie Detection for Embedded Content** Identifies cookies set by embedded tools, integrations, and external scripts running on your site. **Customizable Consent Banner** Adjust banner design, layout, text, and colors to match your brand and site aesthetics. **Simple Code Injection Setup** Integrates seamlessly using Squarespace’s built-in header code injection—no plugins or apps required. ### How It Works CookieHub integrates cleanly using Squarespace’s **Header Code Injection** feature. No plugins, no theme packages, no backend modules — just a few steps and you’re compliant. Setup takes only a few steps — follow the [implementation guide](https://support.cookiehub.com/article/434-how-to-install-cookiehub-in-squarespace). **1. Get Your CookieHub Script** In the CookieHub dashboard, add your domain and copy the implementation code from the _Inline HTML Tag_ section. **2. Open Squarespace Code Injection** In your Squarespace admin, go to **Settings → Advanced → Code Injection**. **3. Paste CookieHub Into the Header** Paste the CookieHub snippet into the **Header** field. This ensures it loads before any tracking scripts. **4. Save & Publish** Save your changes and publish your site. From this point on, CookieHub blocks tracking until consent is given and logs user choices automatically. #### Frequently Asked Questions **Do I need a Squarespace app or plugin to use CookieHub?** No. Squarespace doesn’t support plugins in the traditional sense — instead, CookieHub is added through the Code Injection interface. **Will CookieHub block cookies from embedded content, such as videos or forms?** Yes. CookieHub blocks non-essential cookies from any embedded service or external script until the visitor consents. **Can I customize how the consent banner looks?** Absolutely. CookieHub lets you adjust themes, colors, text, and layout to match your brand and Squarespace design. **Does CookieHub support multiple languages?** Yes. CookieHub can display the banner in multiple languages based on visitor settings or browser preferences. **Can I embed a cookie declaration page on Squarespace?** Yes. CookieHub generates a dynamic cookie declaration that you can embed using a text block or CMS page. **Does CookieHub work with Squarespace analytics, Google tags, and marketing pixels?** Yes. Once CookieHub is installed, it controls when these scripts fire based on user consent. --- # Termly Alternative: CookieHub vs Termly Compared URL: https://www.cookiehub.com/termly-alternative Last updated: September 24, 2026 ## Termly alternative: CookieHub vs Termly Termly is a policy generator suite with a consent manager included: privacy policies, terms, cookie policies, a banner and a scanner. CookieHub is a consent management platform only. Both are Google-certified CMPs registered with the IAB Transparency & Consent Framework, and both honor Global Privacy Control. This page compares the two using each vendor's own website, checked on 24 September 2026. ### The short version - **Choose Termly** if you also want your policies generated in the same product, or if you need the IAB TCF on a small budget: Termly includes it in Pro+ at $20 a month. - **Choose CookieHub** if you need a consent platform with more languages, proof of consent on every plan and more control for developers. A free privacy policy generator is included, but not the other documents Termly generates. ### CookieHub vs Termly at a glance Plans and prices as published by each vendor on 24 September 2026, monthly billing, in US dollars, excluding tax. CookieHub Termly Price based on Sessions per month, per domain Banner views per month, per website Free plan Up to 1,000 sessions a month Up to 10,000 banner views a month, one basic policy Entry paid plan Starter: $7 a month, 5,000 sessions Starter: $14 a month, 50,000 banner views Multiple languages 62, on Basic ($12 a month) and above On Pro+ ($20 a month); 13 listed on its product page IAB TCF Business ($35 a month) and Enterprise Pro+ ($20 a month) Google-certified CMP true true Google Consent Mode v2 All plans Basic mode on Free and Starter; advanced mode on Pro+ Global Privacy Control All plans true Consent log Every plan, including Free Pro+ Automated scans Monthly; weekly on Enterprise Quarterly on Free, monthly on Starter, weekly on Pro+ Legal document generators Free privacy policy generator Privacy policy, terms and conditions, cookie policy, EULA and more JavaScript API true true ### Pricing **Termly** prices each website by banner views. Starter is $14 a month ($10 billed yearly) for 50,000 banner views. Pro+ is $20 a month ($15 billed yearly) with unlimited banner views, multiple languages, the IAB TCF, advanced Consent Mode and consent logs. **CookieHub** prices each domain by sessions, from $7 a month for 5,000 sessions on Starter, $12 for 30,000 on Basic and $35 for 120,000 on Business. Paying yearly gets you 12 months for the price of 11. For a single-language site with modest traffic, CookieHub's Starter and Basic plans cost less. For a busy site that needs the IAB TCF, Termly Pro+ costs less, because its banner views are unlimited and CookieHub includes the TCF only from Business. ### Where Termly is stronger A fair comparison has to include these: **Policy generators:** Privacy policy, terms and conditions, cookie policy, EULA, disclaimer, Impressum and more, in the same account. CookieHub offers a free privacy policy generator and a cookie declaration, but not the other documents. **TCF on a smaller budget:** The IAB TCF is included in Pro+ at $20 a month. CookieHub includes it from Business at $35 a month. **Unlimited traffic on Pro+:** Pro+ has no banner-view limit, which suits very busy sites. **Weekly scans for less:** Pro+ scans weekly. CookieHub scans weekly only on Enterprise. ### When CookieHub is the better fit **Many languages:** 62 languages with automatic detection from Basic, against the 13 Termly lists on its product page. **Proof of consent on every plan:** A consent log is included on every plan, including Free. At Termly consent logs start at Pro+. **Developers and agencies:** A documented JavaScript API on every plan, a Management API on Enterprise, and one dashboard for many domains with a 30% partner discount. ### Switching from Termly CookieHub builds its own cookie list from a scan, so there is nothing to export first. **Create an account:** Start the free trial and add your domain. CookieHub scans the site and sorts the cookies it finds into categories. **Review the categories and design:** Check the categorization, pick a banner template and set your colours and languages. **Swap the script:** Replace the Termly script with the CookieHub script, or use the CookieHub template in Google Tag Manager. Remove Termly completely so two banners never run at once. **Check the result:** Run the Google Consent Mode checker to confirm consent signals reach Google. **Expect one new prompt:** Consent stored by Termly is kept in its own cookie, which CookieHub cannot read. Returning visitors are asked once more. Further reading: [the 62 supported languages](https://www.cookiehub.com/languages), [the consent log](https://www.cookiehub.com/consent-log), [the JavaScript API](https://www.cookiehub.com/javascript-api), [the Management API](https://www.cookiehub.com/management-api), [the Google Consent Mode checker](https://www.cookiehub.com/google-consent-mode-checker), [the free privacy policy generator](https://www.cookiehub.com/privacy-policy-generator). ### Frequently asked questions **Is Termly only for US privacy laws?** No. Termly covers the GDPR and UK GDPR as well as CCPA and other US state laws, and it is Google-certified and registered for the IAB TCF. CookieHub covers the same ground as a CMP; the difference is that Termly also generates a wider set of legal documents. **Are both Google-certified CMPs?** Yes. Both are on Google's list of certified CMPs: Termly under TCF CMP ID 412, CookieHub under ID 354. **Which is cheaper?** It depends on what you need. CookieHub's Starter ($7 for 5,000 sessions) and Basic ($12 for 30,000) cost less than Termly's Starter ($14 for 50,000 banner views) and include proof of consent. If you need the IAB TCF, Termly Pro+ ($20) costs less than CookieHub Business ($35). Termly counts banner views and CookieHub counts sessions, so check both against your own traffic. **Will my visitors have to consent again after switching?** Yes, once. Each platform stores consent in its own cookie, so CookieHub cannot read choices a visitor made in Termly's banner. ### Sources Every fact about a competitor on this page comes from that vendor's own website, from Google's list of certified CMPs or from IAB Europe's CMP list. All of it was checked on 24 September 2026. Prices exclude VAT. - [Google: certified CMPs](https://support.google.com/admanager/answer/13554116) - [IAB Europe: CMP list](https://iabeurope.eu/cmp-list/) - [CookieHub pricing](https://www.cookiehub.com/pricing) - [CookieHub JavaScript API](https://docs.cookiehub.com/advanced/javascript-api) - [Termly pricing](https://termly.io/pricing/) - [Termly Consent Management Platform](https://termly.io/products/cookie-consent-manager/) - [Termly IAB TCF](https://termly.io/features/iab-tcf/) - [Termly developer documentation](https://docs.termly.io/) Vendors change their plans. If something here is out of date, [tell us](https://www.cookiehub.com/contact-us) and we will correct it. --- # Umbraco Cookie Consent Solution | Data Privacy Compliance with CookieHub URL: https://www.cookiehub.com/umbraco Last updated: April 1, 2026 ## Cookie Consent for Umbraco Umbraco gives developers full control over templates and server-rendered HTML — which is powerful, but it also means you’re responsible for managing scripts and cookies that track user behavior. CookieHub brings a central consent layer to Umbraco, preventing tracking before approval and helping you comply with GDPR, CCPA, LGPD, and other global privacy laws. ### Effortless Cookie Compliance Built for Umbraco CookieHub installs directly into your Umbraco templates. Once implemented, it prevents non-essential cookies from running without consent, logs user choices for compliance, and keeps your cookie strategy up to date — without requiring custom modules or complex backend development. For step-by-step installation, see the [Umbraco implementation guide](https://support.cookiehub.com/article/435-how-to-install-cookiehub-in-umbraco). **Key Benefits:** - Prevents third-party tracking until consent is granted - Automatic cookie detection for analytics and embedded tools - Dynamic cookie declaration for transparency - Fully brandable consent banner - No Umbraco package installation — works with any theme - Minimal developer overhead ### Why Use CookieHub with Umbraco Umbraco lets you control your HTML, templates, and rendering logic — but that flexibility comes with responsibility. When tracking scripts are added directly into templates or inserted via external embeds, it becomes easy to lose sight of what cookies fire and when. CookieHub centralizes consent rules across every page and template, enforcing compliance without manual tracking logic or hook management. **What CookieHub Adds to Umbraco Sites** **Automatic Enforcement of Consent Rules** CookieHub ensures that privacy and consent rules are applied consistently across your Umbraco site without manual configuration or custom logic. **Blocking of Non-Essential Cookies** Analytics, marketing, and third-party cookies are prevented from loading until the visitor has explicitly given consent. **Consent Logging for Compliance** User consent decisions are securely recorded and can be accessed for audits or regulatory documentation. **Real-Time Cookie Discovery** CookieHub continuously detects cookies set by scripts running on your site, helping you stay aware of new or changed tracking behavior. **Customizable Consent Banner UI** Adjust colors, layouts, text, and interaction styles so the consent banner aligns with your design system and branding. **Flexible Template Integration** Place CookieHub within templates or master pages to fit your existing Umbraco architecture without structural changes. ### How It Works CookieHub integrates at the template/Header level in Umbraco. No packages. No backend services to install. No dependency on third-party modules. Setup takes only a few steps — follow the [implementation guide](https://support.cookiehub.com/article/435-how-to-install-cookiehub-in-umbraco). **1. Get Your CookieHub Integration Code** Log in to your CookieHub dashboard and follow the _Inline HTML tag_ setup to generate your unique implementation code. **2. Open Your Umbraco Template** In your backoffice, edit the layout or master template where the element is defined. **3. Paste CookieHub Into the Header** Add the CookieHub snippet inside the section of your template, preferably at the top below the opening tag. **4. Save & Publish** Save your template and publish your site. CookieHub now blocks tracking scripts until consent is given and logs user choices automatically. #### Frequently Asked Questions **Do I need an Umbraco package to install CookieHub?** No. CookieHub installs via HTML snippet in your layouts or master templates — so you don’t need any third-party Umbraco packages. **Will CookieHub block cookies from scripts added in templates or macros?** Yes. CookieHub’s script runs in the visitor’s browser and blocks non-essential cookies regardless of where the script originated. **Can I customize the appearance of the consent banner?** Yes. CookieHub lets you adjust colors, banner layouts, button styles, and text to match your brand. **Does CookieHub work with multilingual Umbraco sites?** Yes. CookieHub supports multiple languages and can switch banner text based on browser language detection. **Can I create a cookie declaration page in Umbraco?** Yes. CookieHub generates a dynamic cookie declaration that you can embed into any Umbraco page or content document. **Will CookieHub interfere with core Umbraco functionality?** No. CookieHub only manages third-party cookies and scripts — it doesn’t affect CMS rendering or backoffice functionality. --- # Usercentrics Alternative: CookieHub vs Usercentrics URL: https://www.cookiehub.com/usercentrics-alternative Last updated: September 24, 2026 ## Usercentrics alternative: CookieHub vs Usercentrics Usercentrics is the company behind Cookiebot, and it also sells its own CMP for websites, mobile apps and connected TV. Like CookieHub, its web CMP is priced by sessions, which makes the two unusually easy to compare. Both are Google-certified CMPs registered with the IAB Transparency & Consent Framework. The differences are how many sessions and domains each price buys, and which platforms each covers. This page compares the two using each vendor's own website, checked on 24 September 2026. ### The short version - **Choose CookieHub** for one website, or a few, with real traffic: each euro buys more sessions, and all 62 languages come from Basic at €10 a month. - **Choose Usercentrics** if you run several small domains on one plan, or you need consent in mobile apps or on connected TV from the same vendor. ### CookieHub vs Usercentrics at a glance Web CMP plans and prices as published by each vendor on 24 September 2026, monthly billing, excluding VAT. CookieHub Usercentrics Price based on Sessions per month, per domain Sessions per month; each plan includes a set number of domains Free plan 1,000 sessions a month, one domain 1,000 sessions a month, one domain What €30 a month buys Business: 120,000 sessions, one domain Pro: 15,000 sessions, up to three domains One site with 50,000 sessions a month Business: €30 a month Business: €50 a month (up to ten domains) Banner languages 62, on Basic (€10) and above Two on Free and Essential, five on Plus, 60 on Pro (€30) and above IAB TCF Business (€30) and Enterprise Pro (€30) and above Google-certified CMP true true Google Consent Mode v2 All plans All plans Global Privacy Control All plans All plans Proof of consent All plans All plans, kept for 12 months ISO 27001 certified true true Automated scans Monthly; weekly on Enterprise Monthly; weekly on Corporate Subdomains Scanned, with consent shared between them, on Business and above Each subdomain counts as a separate domain Platforms Websites Websites; separate products for mobile apps and connected TV JavaScript API true true ### Sessions, domains and price **Usercentrics** prices its web CMP by sessions, which it counts each time a visitor loads your website, for a 30-minute period. Essential is €7 a month for 1,500 sessions, Plus €15 for 3,000, Pro €30 for 15,000 across up to three domains and Business €50 for 50,000 across up to ten, with higher Business tiers from there. Plans upgrade automatically when you exceed their limits. **CookieHub** also prices by sessions, per domain. A session starts when a visitor loads the site and the banner initializes. Starter is €6 a month for 5,000 sessions, Basic €10 for 30,000, Business €30 for 120,000 and Enterprise €100 from 1,000,000. **One busy site.** A site with 50,000 sessions a month needs Usercentrics Business at €50 a month, and fits in CookieHub Business at €30, which includes the IAB TCF and all 62 languages. **Several small sites.** Three sites with 4,000 sessions each fit in one Usercentrics Pro plan at €30 a month, with 60 languages and the IAB TCF included. On CookieHub each domain needs its own plan: three Basic plans at €30 in total with all languages, but three Business plans, €90 in total, if all three need the TCF. ### Where Usercentrics is stronger A fair comparison has to include these: **Several domains on one plan:** Pro covers up to three domains and Business up to ten, so a group of small sites can share one plan. **Apps and connected TV:** Separate Usercentrics products cover iOS, Android, Flutter, React Native and Unity apps, and connected-TV platforms. CookieHub is registered as a web CMP. **Accessibility certification:** Usercentrics says its banners are certified to WCAG 2.2 AA. **Faster support on Business:** Usercentrics offers premium support, as fast as one hour, from its Business plan. ### When CookieHub is the better fit **More sessions for the money:** On a single site, each CookieHub plan includes more sessions than the Usercentrics plan at the same price: 120,000 against 15,000 at €30 a month. **Languages at a lower tier:** All 62 languages from Basic at €10 a month. Usercentrics includes its full set from Pro at €30. **Subdomains:** On Business and above, CookieHub scans subdomains and shares consent between them. Usercentrics counts each subdomain as a separate domain. **Developers:** A documented JavaScript API with events on every plan, and a Management API for configuring the CMP on Enterprise. ### Switching from Usercentrics CookieHub builds its own cookie list from a scan, so there is nothing to export first. **Create an account:** Start the free trial and add your domain. CookieHub scans the site and sorts the cookies it finds into categories. **Review the categories and design:** Check the categorization, pick a banner template and set your colours and languages. **Swap the script:** Replace the Usercentrics script with the CookieHub script, or use the CookieHub template in Google Tag Manager. Remove Usercentrics completely so two banners never run at once. **Check the result:** Run the Google Consent Mode checker to confirm consent signals reach Google. **Expect one new prompt:** Consent stored by Usercentrics is kept in its own cookie, which CookieHub cannot read. Returning visitors are asked once more. Further reading: [the 62 supported languages](https://www.cookiehub.com/languages), [the consent log](https://www.cookiehub.com/consent-log), [the JavaScript API](https://www.cookiehub.com/javascript-api), [the Management API](https://www.cookiehub.com/management-api), [the Google Consent Mode checker](https://www.cookiehub.com/google-consent-mode-checker), [CookieHub vs Cookiebot](https://www.cookiehub.com/cookiebot-alternative). ### Frequently asked questions **Are Usercentrics and Cookiebot the same product?** No. Usercentrics owns Cookiebot, but they are separate products with separate pricing: Cookiebot is priced by subpages per domain, the Usercentrics web CMP by sessions. When the companies merged in 2021, Usercentrics said it would focus on enterprise customers and Cookiebot on small and mid-sized businesses. **Is CookieHub cheaper than Usercentrics?** For a single site, usually: at every price point CookieHub includes more sessions. For several small domains that share one plan, Usercentrics can cost less, because its Pro and Business plans cover three and ten domains. **Are both Google-certified CMPs?** Yes. Both are on Google's list of certified CMPs: Usercentrics under TCF CMP ID 5, CookieHub under ID 354. **Will my visitors have to consent again after switching?** Yes, once. Each platform stores consent in its own cookie, so CookieHub cannot read choices a visitor made in the Usercentrics banner. ### Sources Every fact about a competitor on this page comes from that vendor's own website, from Google's list of certified CMPs or from IAB Europe's CMP list. All of it was checked on 24 September 2026. Prices exclude VAT. - [Google: certified CMPs](https://support.google.com/admanager/answer/13554116) - [IAB Europe: CMP list](https://iabeurope.eu/cmp-list/) - [CookieHub pricing](https://www.cookiehub.com/pricing) - [CookieHub JavaScript API](https://docs.cookiehub.com/advanced/javascript-api) - [Usercentrics pricing](https://usercentrics.com/pricing/) - [Usercentrics: web CMP JavaScript API](https://usercentrics.com/docs/web/features/api/control-functionality/) - [Usercentrics: app SDK documentation](https://usercentrics.com/docs/apps/intro/) - [Cookiebot: Usercentrics and Cookiebot](https://www.cookiebot.com/en/usercentrics-cookiebot-cmp/) Vendors change their plans. If something here is out of date, [tell us](https://www.cookiehub.com/contact-us) and we will correct it. --- # Vermont VTDPOSA Cookie Consent and Compliance URL: https://www.cookiehub.com/vtdposa-vermont Last updated: June 23, 2026 ## Vermont VTDPOSA Cookie Consent and Compliance Prepare for Vermont’s Data Privacy and Online Surveillance Act with clear cookie consent, opt-out controls, and online tracking compliance tools. Are you ready to comply? ### What your business needs to know about the Vermont Data Privacy and Online Surveillance Act The Vermont Data Privacy and Online Surveillance Act, enacted as S.71 / Act 145, is Vermont’s comprehensive consumer privacy law. Signed on June 16, 2026, the law takes effect on January 1, 2028. The Act applies to businesses that conduct business in Vermont or offer products or services targeted to Vermont residents and meet certain data processing thresholds. It gives consumers more control over their personal data and requires organizations to provide transparency, limit unnecessary data collection, protect sensitive data, and honor consumer opt-out requests. For websites and digital services, the Act is particularly relevant where cookies, tracking technologies, analytics tools, advertising pixels, or third-party scripts collect or process personal data from Vermont residents. ### What does Vermont Data Privacy compliance require? To prepare for Vermont Data Privacy compliance, organizations should review how they collect, use, disclose, and sell personal data, including through cookies and other online tracking technologies. Key compliance steps include: **Update privacy notices:** Provide a clear and accessible privacy notice explaining what personal data is processed, why it is processed, how consumers can exercise their rights, what categories of third parties receive data, and whether personal data is used, collected, or sold for training large language models. **Implement consent management:** Use cookie banners and preference centers to collect clear affirmative consent where required, especially when processing sensitive data or selling sensitive data. **Provide opt-out mechanisms:** Allow consumers to opt out of targeted advertising, the sale of personal data, and profiling that produces legal or similarly significant effects. **Respect universal opt-out signals:** Support opt-out requests submitted through authorized agents or technologies such as browser settings, browser extensions, global device settings, or internet links, where applicable. **Conduct assessments:** Carry out data protection assessments for higher-risk processing, including targeted advertising, sale of personal data, profiling with significant effects, and processing of sensitive data. **Manage vendors and processors:** Use appropriate contracts with processors and ensure third-party data sharing supports compliance with the Act. ### Who needs to comply with the Vermont Data Privacy and Online Surveillance Act? The Vermont Data Privacy and Online Surveillance Act applies to persons or businesses that conduct business in Vermont or produce products or services targeted to Vermont residents and, during the preceding calendar year, meet at least one of the following thresholds: Process the personal data of at least 35,000 Vermont consumers, excluding personal data processed solely to complete payment transactions. Process the sensitive data of at least 3,000 Vermont consumers, excluding data processed solely to complete payment transactions. Offer to sell the personal data of at least 3,000 Vermont consumers. The Act also includes separate consumer health data provisions that apply more broadly to persons doing business in Vermont or targeting Vermont residents with products or services. Certain entities and data types are exempt, including government entities, some HIPAA-regulated entities and data, certain GLBA-regulated entities and data, employment-related data, and other categories already governed by specific federal or state laws. ### Consumer rights under the Vermont Data Privacy and Online Surveillance Act Vermont residents have several rights over their personal data, including: **Right to access** Consumers can confirm whether their personal data is being processed and access the data held about them. **Right to correct** Consumers can request correction of inaccurate personal data held by a controller. **Right to delete** Consumers can request deletion of personal data provided by, or obtained about, them. **Right to data portability** Consumers can obtain a copy of their personal data in a portable and usable format. **Right to opt out** Consumers can opt out of targeted advertising, the sale of personal data, and certain profiling. **Right to question profiling** Consumers can question certain profiling decisions that produce legal or similarly significant effects. **Right to sale disclosures** Consumers can request information about third parties to which their personal data has been sold. **Right to appeal** Consumers can appeal a controller’s decision if a privacy rights request is denied. Controllers must generally respond to consumer requests within 45 days, with a possible 45-day extension where reasonably necessary. Consumers must also be provided with an appeal process if a request is denied. ### Why cookies are part of Vermont Data Privacy compliance Cookies and similar tracking technologies can collect personal data such as unique identifiers, device information, browsing behavior, location signals, and data used for analytics, personalization, targeted advertising, or profiling. Under the Vermont Data Privacy and Online Surveillance Act, businesses should evaluate whether their cookies and third-party scripts process personal data, sensitive data, or data used for targeted advertising or sale. Sensitive data processing requires consent, and consumers must be able to opt out of targeted advertising, sale of personal data, and certain profiling activities. A compliant cookie consent setup should make cookie purposes clear, avoid dark patterns, provide granular choices, support withdrawal of consent, and maintain records of consent and opt-out preferences. ### Penalties for Vermont Data Privacy non-compliance The Vermont Attorney General has enforcement authority under the Vermont Data Privacy and Online Surveillance Act. A violation of the Act is treated as a violation of the Vermont Consumer Protection Act. The law does not provide a private right of action for consumers. During the period from January 1, 2028, through June 30, 2029, the Attorney General must provide a notice of violation and a 60-day cure period if the Attorney General determines that the violation can be cured. Organizations that fail to comply may face enforcement action, civil penalties, injunctions, and other remedies available under Vermont consumer protection law. ### How to comply with the Vermont Data Privacy and Online Surveillance Act To prepare for the Vermont Data Privacy and Online Surveillance Act, organizations should: **Audit:** Identify all cookies, pixels, trackers, SDKs, and third-party scripts used across websites and apps. **Categorize:** Classify cookies and trackers by purpose, such as necessary, preferences, analytics, marketing, targeted advertising, sale, or sensitive data processing. **Review sensitive data:** Check whether cookies or digital services collect sensitive data, such as precise geolocation, biometric data, consumer health data, children’s data, neural data, or other protected categories. **Implement consent management:** Deploy a cookie banner and preference center that support clear choices, opt-outs, consent withdrawal, and consent logging. **Update privacy notices:** Ensure privacy notices describe data categories, purposes, consumer rights, third-party sharing, opt-out options, and whether personal data is used for training large language models. **Review third-party contracts:** Make sure processors and vendors support Vermont privacy obligations, including consumer rights requests, data security, and appropriate processing restrictions. #### Frequently Asked Questions **What is the Vermont Data Privacy and Online Surveillance Act?** The Vermont Data Privacy and Online Surveillance Act is Vermont’s comprehensive consumer privacy law. It establishes consumer privacy rights and obligations for businesses that collect, process, sell, or use personal data from Vermont residents. **When does the Vermont Data Privacy and Online Surveillance Act take effect?** The Act takes effect on January 1, 2028. **Who must comply with the Vermont Data Privacy and Online Surveillance Act?** The Act applies to businesses that conduct business in Vermont or target Vermont residents and meet certain thresholds, including processing personal data of at least 35,000 consumers, processing sensitive data of at least 3,000 consumers, or offering to sell personal data of at least 3,000 consumers. **What is personal data under the Vermont Data Privacy and Online Surveillance Act?** Personal data means information, including derived data and unique identifiers, that is linked or reasonably linkable to an identified or identifiable individual or to a device linked to one or more individuals. **What is sensitive data under the Vermont Data Privacy and Online Surveillance Act?** Sensitive data includes categories such as racial or ethnic origin, religious beliefs, sex life, sexual orientation, transgender or nonbinary status, citizenship or immigration status, health data, genetic or biometric data, children’s data, precise geolocation data, neural data, certain financial account information, and government-issued identification numbers. **Does Vermont’s privacy law require cookie consent?** The Act does not treat all cookies the same way. However, cookies that process sensitive data may require consent, and cookies used for targeted advertising, sale of personal data, or certain profiling activities must be covered by opt-out mechanisms. A cookie consent platform helps businesses provide transparency, manage preferences, and document consent and opt-outs. **Who enforces the Vermont Data Privacy and Online Surveillance Act?** The Vermont Attorney General enforces the Act. The law does not create a private right of action for consumers. **Where can I get more information about the Vermont Data Privacy and Online Surveillance Act?** More information can be found in Vermont S.71 / Act 145 and future guidance from the Vermont Attorney General. ### Disclaimer The information provided on this page is for general reference purposes only and is not intended to constitute legal or regulatory advice. Data privacy regulations are complex and subject to frequent updates, interpretations, and jurisdictional variations. While efforts are made to keep the material accurate and up to date, we cannot guarantee its completeness or applicability to your specific circumstances. For guidance on compliance or legal obligations, please consult qualified legal professionals or the appropriate regulatory authorities. --- # WCAG 2.2 Compliant Consent Dialog URL: https://www.cookiehub.com/wcag-accessibility Last updated: July 2, 2026 ## Accessible Compliance for Everyone ##### WCAG 2.2 Compliant Consent Dialog CookieHub has fully embraced Web Content Accessibility Guidelines (WCAG) standards, helping you deliver a user-friendly, compliant experience for every visitor, including those with disabilities. ### Why Accessibility in Consent Dialogs Matters Accessible consent dialogs ensure all users, regardless of ability, can easily understand and manage their privacy preferences. Prioritizing accessibility in your consent management. - **Inclusive Experience:** Ensure your site is welcoming and usable by everyone. - **Legal Compliance: **Stay aligned with global accessibility laws and regulations. - **Better User Engagement:** Improve satisfaction and trust among all your visitors. #### How CookieHub Supports Accessibility Simplify your journey toward accessibility by providing reliable solutions designed with inclusivity in mind - **Screen Reader Optimization:** Fully compatible with popular screen readers like Windows Narrator and Mac VoiceOver. - **Semantic HTML: **Clear, structured code ensures easy navigation and understanding for users and assistive technologies. - **Contrast and Visibility:** Enhanced visual contrast meets WCAG guidelines, improving readability and usability. **Get 14 days free!** Select any plan and get the first 14 days free so you can try it out and see how we can help you manage your websites cookies. **Compare our plans** CookieHub is a subscription service that offers flexible pricing plans to suit the needs of websites of all sizes. Find the plan that works for you. ### CookieHub Features Take control of your cookie privacy with confidence. Explore our features designed for simplicity and built for reliability. **Cookie Scanner** Scans your website for you and detects the cookies that are in use. **Cookie Declaration** Automatically generates a detailed list of the cookies in use on your site. **Pre-Consent** Gain your customers trust by ensuring their privacy is taken seriously. **Consent Log** Log and store user consents along with necessary information required... **Consent Mode Scanner** Ensure Google Consent Mode V2 is correctly implemented on your site. **Geolocation** Automatically shows the correct consent framework depending on the users location. **Accessibility** CookieHub has fully embraced Web Content Accessibility Guidelines (WCAG) standards. **62 Languages** Changes language based on website content, browser preferences or URL prefix. **Reports** Detailed reports on consent responses, sessions and a lot of useful information. **Customer support** Fast and easily accessible support here to assist with any questions you have. **CCPA Compliance** CookieHub helps you protect your users privacy in California by complying to strict cookie consent laws. **TCF 2.4 Compliance** Promote transparency by allowing users to make informed choices about data processing and advertising preferences. **Google Consent Mode V2** As an advertiser, you can collect user data with the rights of users to maintain their privacy. **Google Certified CMP** We’re proud to announce our Google certification, solidifying our position as a trusted CMP for web managers. --- # Webflow Cookie Consent Solution | GDPR & CCPA Compliance with CookieHub URL: https://www.cookiehub.com/webflow Last updated: April 1, 2026 ## Cookie Consent for Webflow Webflow gives you visual control over your website, but it doesn’t provide native consent management for analytics tools, marketing platforms, or custom scripts. CookieHub closes that gap by adding a fully compliant consent layer that governs how and when cookies are allowed to run — without forcing you to restructure your site. ### Effortless Compliance, Centralized Control CookieHub installs through Webflow’s Custom Code settings and instantly takes over consent handling. It blocks unapproved tracking scripts, maintains an audit-ready log of user choices, and continuously scans your site for new cookies introduced by embeds or integrations. For step-by-step installation, see the official [Webflow implementation guide](https://docs.cookiehub.com/installation/content-management-systems#webflow). **Key Benefits:** - Automatic cookie blocking until visitors opt in - Real-time cookie scanning for scripts added through Webflow or custom embeds - Dynamic cookie declaration page you can drop into any Webflow CMS collection or static page - Full customization options for banner layout, colors, positioning, and behavior - Straightforward integration without code refactoring ### Why Use CookieHub with Webflow Webflow allows scripts to be loaded in multiple places — site settings, page settings, embeds, and custom code blocks. This flexibility also creates compliance risks because scripts can fire immediately on page load. CookieHub provides the structured consent framework Webflow lacks, ensuring consistent behavior across every script, regardless of where it’s loaded. **What CookieHub Adds to Webflow** **Reliable consent enforcement** For tracking, analytics, and marketing tools **Built-in cookie blocker** To stop scripts that Webflow loads before consent **Cookie scanner** That detects cookies set by external integrations (e.g., HubSpot, GA, Meta Pixel) **Consent log** To maintain verifiable records **Brand-friendly customization** Without touching HTML ### How It Works CookieHub integrates at the site-settings level in Webflow. No Webflow plugins. No redesigns. Just clean implementation. Setup takes only a few steps — follow the [implementation guide](https://docs.cookiehub.com/installation/content-management-systems#webflow). **1. Set Up Your Domain in CookieHub & Copy the Snippet** Add your domain inside CookieHub, choose a template, and copy the integration code from the _Manually insert the code_ option. **2. Add CookieHub to Your Webflow Project** In Webflow Dashboard → **Project Settings** → **Custom Code**, paste the snippet into the _Head Code_ field. (Available on Webflow Pro plans and above.) **3. Make Tracking Scripts Compatible with CookieHub** Modify any analytics or marketing scripts placed in Webflow’s Head Code, Body Code, or page-level settings to follow CookieHub’s **Delay Inline JavaScript** method. This ensures CookieHub can control when your scripts fire. **4. Publish Your Site** After publishing, CookieHub blocks unapproved scripts, logs consent choices, and manages all cookie activity automatically. #### Frequently Asked Questions **Does CookieHub work with custom code blocks, page-level scripts, and site-wide scripts in Webflow?** Yes. CookieHub can manage scripts injected at any level — Head Code, Body Code, page settings, or custom embeds — as long as they follow the inline JavaScript delay method. **Do I need a Webflow App to use CookieHub?** No. CookieHub integrates through Custom Code and does not require a third-party app **Will CookieHub interfere with Webflow interactions or animations?** No. Only non-essential tracking scripts are controlled. Webflow Interactions, layout scripts, and functional behavior are unaffected. **Can I customize the appearance of the cookie banner to fit my Webflow design?** Yes. CookieHub includes extensive styling options for colors, themes, placement, and interaction flow. **Does CookieHub support multilingual Webflow sites?** Yes. CookieHub automatically displays the banner in the visitor’s preferred language if translations are enabled. **Can I publish a cookie declaration page inside Webflow?** Absolutely. CookieHub generates a dynamic declaration you can embed into any static page or CMS-driven legal center. **What plan do I need on Webflow to use CookieHub?** You must be on a Webflow plan that allows access to **Custom Code** (Pro or higher). --- # Weebly Cookie Consent Solution | Data Privacy Compliance with CookieHub URL: https://www.cookiehub.com/weebly Last updated: April 1, 2026 ## Cookie Consent for Weebly Weebly sites often rely on embedded widgets, app integrations, and external scripts — each capable of dropping cookies the moment a page loads. CookieHub adds a structured consent layer that puts you back in control, ensuring visitors decide what data gets collected while keeping you aligned with privacy laws. ### Effortless Compliance, Centralized Control CookieHub integrates through a single header snippet and immediately starts enforcing consent rules across your site. It blocks non-essential scripts, records visitor preferences, and adapts to new cookies as they appear — all without you editing code or installing plugins. For step-by-step installation, see the official [Weebly implementation guide](https://docs.cookiehub.com/installation/content-management-systems#weebly). **Key Benefits:** - Pre-consent cookie blocking that prevents unauthorized tracking - Automated scanning to detect new cookies introduced by apps or embeds - Dynamic cookie declaration for full transparency - Flexible styling options to match your brand - Straightforward, low-maintenance setup ### Why Use CookieHub with Weebly Weebly isn’t built with advanced consent control in mind, and apps or embeds often load tracking scripts outside your visibility. CookieHub fills that gap by applying a single, consistent consent framework across your entire site — something Weebly alone doesn’t offer. **What CookieHub Adds to the Weebly Ecosystem** **Legal compliance by default** Analytics and marketing scripts pause until approval **An audit-ready consent log** So you can show proof of user decisions **Real-time cookie discovery** To catch cookies added by new apps or features **Full banner customization** Without touching your Weebly theme **Fast onboarding** Paste one script and you’re done ### How It Works CookieHub connects at theme level with no need for Weebly apps or backend changes. A short setup process gets everything running smoothly. Setup takes only a few steps — follow the [implementation guide](https://docs.cookiehub.com/installation/content-management-systems#weebly). **1. Create Your CookieHub Setup & Copy the Script** Add your domain in the CookieHub dashboard, pick a banner template, and copy the HTML snippet provided in the _Inline HTML Tag_ section. **2. Open Your Weebly Site Settings** Go to Weebly → select your site → **Settings** → **SEO**. **3. Add CookieHub to Your Header Code** Paste the snippet into the **Header Code** field and save your changes. **4. Publish Your Site** Once published, CookieHub begins blocking non-essential cookies, capturing consent choices, and applying compliance rules automatically. #### Frequently Asked Questions **Does CookieHub stop Weebly apps from setting cookies without permission?** Yes. CookieHub prevents any non-essential cookies — including those from Weebly apps or embedded widgets — from loading before consent. **Will CookieHub disrupt core Weebly functionality?** No. Essential cookies that support basic site operations remain untouched. **Do I need to install anything from the Weebly App Center?** No app is required. CookieHub works through the Header Code area, giving you full control. **Can the banner be styled to look native to my site?** Yes. You can customize colors, layouts, and button styles directly in the CookieHub dashboard. **Can I create a cookie declaration page?** Yes. CookieHub’s dynamic declaration can be embedded on any page inside Weebly. **Will CookieHub work with custom embeds or external scripts I add manually?** Yes. CookieHub evaluates and controls cookies set by custom code blocks as well as third-party snippets. --- # CookieHub Whitepapers: Data Privacy & Compliance Analysis URL: https://www.cookiehub.com/whitepapers Last updated: December 4, 2025 ## CookieHub Whitepapers **The CookieHub Whitepaper Series: a definitive resource for understanding the real forces shaping global data privacy, regulatory compliance, and consent governance.** These publications go beyond surface-level summaries of GDPR, CCPA, LGPD, CNIL, and emerging privacy frameworks. Each whitepaper dissects the underlying regulatory logic, the technical implications for digital ecosystems, and the operational risks organizations tend to overlook. Whether you need clarity on evolving legal requirements, the mechanics of cookie governance, or the broader shifts in consent and data-handling practices, these whitepapers provide the analysis decision-makers can’t afford to ignore. Expect actionable frameworks, evidence-based perspectives, and strategic guidance designed for teams responsible for compliance, product integrity, and user trust. The goal is simple: equip organizations to anticipate change, close compliance gaps, and build resilient data-privacy practices that stand up to regulatory scrutiny worldwide. --- # Why CookieHub? URL: https://www.cookiehub.com/why-cookiehub Last updated: September 21, 2026 ## Why CookieHub CookieHub is powerful, feature-rich, and incredibly simple to use. The service is GDPR compliant and LGPD compliant cookie consent solution that makes cookie management effortless. We require clear consent from every site visitor, helping you remain in compliance with global regulations. Cookie consent management is made simple with CookieHub, a full-featured CMP (cookie consent management platform). Simply add a widget to your website and our cookie scanner will detect which cookies your website uses, then automatically categorize and generate a cookie declaration listing for each one to explain its purpose and usage. Your end users will then be given a choice to allow or disallow those cookies and CookieHub will remember their decision for future visits. ### Why should I use CookieHub? CookieHub is powerful, feature-rich, and incredibly simple to use. The service is GDPR compliant and LGPD compliant cookie consent solution that makes cookie management effortless. We require clear consent from every site visitor, helping you remain in compliance with global regulations. Best of all, CookieHub is flexible and our easy-to-create widget can be fully customized to match the branding of your website so it never looks out of place. What’s more, implementing that widget is as easy as copy and pasting the javascript code that we provide or simply implementing to your existing Google Tag Manager setup. If you’re concerned about pricing, don’t be. CookieHub is free to use for any website that has fewer than 1.000 sessions per month. If you have additional sessions, easily upgrade to our highly-affordable paid versions, which also comes with additional features, starting at just €6/month. #### **What is GDPR and why is compliance important?** If you’re not familiar with [GDPR](https://www.cookiehub.com/gdpr/), it stands for General Data Protection Regulation. GDPR was formed by the European Union to aid in the data protection and privacy for all individuals within the EU and the European Economic Area. These regulations went into effect on May 25 2018. All websites are supposed to have been in compliance with GDPR since that date, which means your site should seek consent from every user regarding the cookies you use and any methods you might utilize to track your users across the web. With CookieHub, this tall order is made easy to follow thanks to our simple and direct consent collection for each cookie category. #### **Stop Stressing Over Cookies** With CookieHub, you no longer have to worry about being in compliance with GDPR and other data privacy and protection regulations. We make cookie consent management simple with an easy-to-use, fully customizable, and feature-rich tool. **Get 14 days free!** Experience the benefits of our cookie management solutions risk-free! Sign up for any of our plans and receive the first 14 days free. **Compare our plans** Our selection of plans accommodates websites of all sizes, offering options to suit your specific needs --- # Wix Cookie Consent App for GDPR URL: https://www.cookiehub.com/wix Last updated: July 2, 2026 ## Wix Cookie Consent App **GDPR cookie consent and Google Consent Mode v2 for Wix** Install CookieHub from the Wix App Market to manage cookie consent, support GDPR compliance, and control tracking technologies on your Wix website. ### Available in the Wix App Market Install CookieHub directly from the [Wix App Market](https://www.wix.com/app-market/cookiehub) and add cookie consent management to your Wix website in minutes. CookieHub provides an easy setup experience for Wix websites with support for GDPR compliance, Google Consent Mode v2, customizable consent banners, and script blocking before consent. **The Wix app allows you to:** - Manage cookie consent preferences - Customize banner styles and languages - Support Google Consent Mode v2 - Block non essential tracking technologies - Maintain consent records - Manage multiple Wix websites No coding is required for most Wix websites. Advanced users can also use manual installation methods when needed. ### Why Use CookieHub with Wix Wix websites often use analytics tools, advertising pixels, embedded media, and third party applications that may require visitor consent before activation. CookieHub helps Wix website owners manage privacy and consent requirements while supporting modern analytics and advertising platforms. **Support GDPR and Privacy Compliance** CookieHub helps manage consent for cookies and tracking technologies used on Wix websites, including analytics, advertising, personalization, and embedded third party content. **Google Consent Mode v2 Support** CookieHub supports Google Consent Mode v2 for Wix websites, helping communicate user consent choices to services such as Google Analytics and Google Ads. This is especially important for websites serving visitors in the European Economic Area. **Designed for Wix Websites** CookieHub integrates directly with Wix websites through the Wix App Market and supports customizable consent banners, multi language support, consent logging, and automatic cookie scanning. CookieHub supports both individual Wix website owners and agencies managing multiple client websites. **Block Tracking Technologies Before Consent** Help prevent non essential cookies and tracking scripts from loading before user consent is granted. **Automatic Cookie Scanning** CookieHub can automatically scan your Wix website to help identify cookies and tracking technologies in use, making it easier to maintain accurate consent categories and cookie declarations. **Flexible Banner Customization** Customize banner layouts, colors, positioning, consent categories, and messaging to match your Wix website branding and user experience requirements. ### How It Works CookieHub can be installed on Wix websites directly through the Wix App Market or using manual installation methods for advanced setups. **Wix App Market Installation** Recommended for most Wix website owners. Install CookieHub directly from the Wix App Market and configure your consent preferences in just a few steps. **Best for** - Standard Wix websites - Small businesses - Agencies - Non technical users - Fast setup [Install from Wix App Market](https://www.wix.com/app-market/cookiehub) **Manual Installation** Advanced users can also install CookieHub manually using custom code injection or Google Tag Manager. **Best for** - Custom implementations - Existing GTM workflows - Advanced script management - Custom consent logic [View Wix Installation Documentation](https://docs.cookiehub.com/installation/wix) #### Frequently Asked Questions **Does Wix provide cookie consent functionality?** Wix provides privacy related tools and infrastructure, but websites using analytics, advertising, and third party tracking technologies may still require a dedicated consent management platform. CookieHub helps Wix website owners manage consent preferences, script blocking, consent logging, and Google Consent Mode v2. **Do Wix websites need a cookie banner?** Websites using non essential cookies or tracking technologies may require consent notices depending on applicable privacy regulations and visitor location. This can include analytics, advertising, personalization, and embedded third party content. **Does CookieHub support Google Consent Mode v2 on Wix?** Yes. CookieHub supports Google Consent Mode v2 for Wix websites and integrates with Google services such as Google Analytics and Google Ads. **Can CookieHub block scripts before consent?** Yes. CookieHub can help prevent non essential scripts and tracking technologies from loading before user consent is granted. **Is coding required to use CookieHub on Wix?** No. Most Wix users can install CookieHub directly through the Wix App Market without coding. Advanced users can also use manual installation methods if needed. **Does CookieHub work with Google Analytics on Wix?** Yes. CookieHub can help manage consent for Google Analytics implementations on Wix websites. **Can agencies manage multiple Wix websites with CookieHub?** Yes. CookieHub supports multi domain management and can be used by agencies managing multiple client websites. **Does CookieHub maintain consent records?** Yes. CookieHub includes consent logging functionality to help maintain records of visitor consent decisions. **Does CookieHub support IAB TCF?** Yes. CookieHub supports IAB TCF v2.4 for websites and advertising environments where framework support is required. **Can CookieHub help with GDPR compliance?** CookieHub provides tools to help website owners manage consent preferences, cookie notices, consent logging, and script blocking requirements related to privacy regulations such as GDPR. --- # WordPress Cookie Consent Plugin: Data Privacy Compliance URL: https://www.cookiehub.com/wordpress Last updated: July 2, 2026 ## WordPress Cookie Consent Plugin WordPress sites rely on plugins, embeds, analytics tools, and theme scripts — all capable of setting cookies before the visitor gives consent. CookieHub provides a unified, automated consent layer that prevents unauthorized tracking, enforces privacy rules, and keeps your site compliant with GDPR, CCPA, LGPD, and other global data regulations. ### Effortless Compliance With Zero Coding CookieHub’s dedicated WordPress plugin handles cookie consent from end to end. It scans your site, categorizes cookies, blocks third-party scripts until consent is granted, and displays a fully customizable banner that fits seamlessly into your theme. For step-by-step installation, see the official [Wordpress implementation guide](https://docs.cookiehub.com/installation/content-management-systems#plugin). **Key Benefits:** - Auto-blocks third-party cookies before consent - Works with all major themes, builders, and plugins - Extremely lightweight — lower memory usage than competing plugins (WPHive) - Consent log for audit-ready tracking - Dynamic cookie declaration page - Granular consent by category - Full customization of banner layout, colors, placement, and behavior - Google Consent Mode support included - No coding required ### Why CookieHub Is Essential for WordPress WordPress stacks often include dozens of plugins — each injecting scripts independently. Relying on manual solutions or edits to theme files is inconsistent and nearly impossible to maintain. CookieHub centralizes consent management so every script follows the same rules, regardless of how it was added. **What CookieHub Adds to WordPress** **Automatic Cookie Blocking** Stops analytics, marketing tools, plugin scripts, and custom embeds from loading until the user opts in. **Cookie Scanner** Identifies cookies set by plugins, themes, embeds, and other integrations. **Third-Party Tag Management (Plugin Feature)** Assign tags to consent categories, control firing behavior, and override scripts safely — without editing code. **Google Consent Mode Support** Automatically adapts Google services (GA4, Ads, GTM) to user consent. **Development Mode** Test layouts, plugins, or themes without logging consent events. **Lightweight and Performance-Friendly** Lower memory usage than primary competitors (WPHive performance analysis). ### How It Works CookieHub supports **two installation paths**: [**The official WordPress plugin**](https://wordpress.org/plugins/cookiehub/) (recommended) [**Manual script insertion** ](https://docs.cookiehub.com/installation/content-management-systems#manual-implementation)(ideal for custom or headless builds) Setup is fast either way. **1. Choose Your Installation Method** - **Plugin:** Install & activate CookieHub from the WordPress Plugin Directory. - **Manual:** Insert the CookieHub script into your theme’s header or via a header/footer manager. **2. Connect Your Domain** Register your domain in the CookieHub dashboard (or directly inside the plugin settings). **3. Automatic Cookie Scan & Blocking** CookieHub detects cookies on your site and blocks non-essential scripts until consent is given. **4. Customize & Publish** Adjust colors, themes, placements, and behavior — then publish your site with full, automated compliance. #### Frequently Asked Questions **Does CookieHub support manual implementation instead of the plugin?** Yes. You can insert the CookieHub script manually if you prefer a lightweight setup or have a custom theme/headless build. Manual instructions: [https://docs.cookiehub.com/installation/content-management-systems#manual-implementation](https://docs.cookiehub.com/installation/content-management-systems#manual-implementation) **What is Automatic Cookie Blocking?** This feature prevents third-party scripts and cookies from loading before a user gives consent — essential for GDPR/CCPA compliance. Details: [https://support.cookiehub.com/article/454-what-is-automatic-cookie-blocking-and-how-to-enable-it-in-wordpress](https://support.cookiehub.com/article/454-what-is-automatic-cookie-blocking-and-how-to-enable-it-in-wordpress) **Can CookieHub control scripts from any WordPress plugin?** Yes. CookieHub intercepts and manages scripts from all plugins, embeds, and themes — even those added through widgets or shortcodes. **Does the plugin support Google Consent Mode?** Yes. CookieHub integrates with Google Consent Mode so Google tags adapt automatically to user preferences. Guide: [https://support.cookiehub.com/article/455-how-to-enable-google-consent-mode-in-the-wordpress-plugin](https://support.cookiehub.com/article/455-how-to-enable-google-consent-mode-in-the-wordpress-plugin) **How do I handle third-party tags with the plugin?** The plugin includes a tag management interface where you can categorize, enable, or block scripts based on consent. Guide: [https://support.cookiehub.com/article/456-how-to-manage-third-party-tags-in-the-wordpress-plugin](https://support.cookiehub.com/article/456-how-to-manage-third-party-tags-in-the-wordpress-plugin) **What is Development Mode?** A mode that allows testing or redesigning your site without generating consent records or triggering cookie blocking. Guide: [https://support.cookiehub.com/article/452-how-to-use-development-mode-in-the-cookiehub-wordpress-plugin](https://support.cookiehub.com/article/452-how-to-use-development-mode-in-the-cookiehub-wordpress-plugin) **Will CookieHub slow down my site?** No. It’s designed to be lightweight and uses less memory than competing consent plugins (verified by WPHive). **Can I edit and manage my cookie list?** Yes. You can modify cookie descriptions, categories, and visibility in the CookieHub dashboard. --- # WordPress Consent API Integration URL: https://www.cookiehub.com/wordpress-consent-api Last updated: September 24, 2026 ## Connect WordPress Consent API ##### WP consent integration made easy Easily connect the CookieHub consent management platform with the WordPress Consent API to simplify compliance with the growing list of evolving global privacy regulations. Ensure consistent handling across WordPress plugins and services while enhancing user trust – all with minimal setup. ### Connect CookieHub to WordPress Consent API ##### Here’s how you can integrate CookieHub with WordPress Consent API: Install and activate the WP Consent API plugin and the CookieHub WordPress plugin, and follow the easy instructions in our installation documentation. When both plugins are active, CookieHub passes every consent choice to the WP Consent API automatically — there is nothing else to connect. Keep your CookieHub plugin updated to the latest version for full WP Consent API compatibility. ### Why Integrate CookieHub with the WP Consent API? The WordPress Consent API** **was introduced to standardize how WordPress plugins handle user consent, ensuring a consistent, privacy-first approach across the entire ecosystem. WordPress site owners face increasing pressure to handle user consent correctly. The WP Consent API provides a unified, developer-friendly way to share consent signals between themes, plugins, and consent management tools — such as CookieHub — eliminating conflicting consent logic and improving compliance. CookieHub’s integration with the WP Consent API bridges the gap between technical implementation and legal compliance, enabling site owners to meet privacy requirements while preserving valuable site functionality. ### Better consent, simpler compliance Before the WordPress Consent API, each plugin managed consent independently, often leading to inconsistent or redundant cookie notices, poor UX, and regulatory risks. By integrating CookieHub CMP with the WP Consent API, you gain: - **Centralized consent management** across all plugins. - **Accurate, standardized consent signaling** for every data-handling component. - **Automatic propagation** of consent states — once a user gives or denies consent, all connected plugins are updated instantly. This approach ensures compliance while maintaining optimal site performance and user experience. ### Standardize consent across WordPress with CookieHub CookieHub’s integration with the WP Consent API plugin standardizes consent communication across your WP site. With CookieHub and WP Consent API working together, you can: - Effortlessly manage and synchronize cookie consent preferences across plugins - Accurately log and document user consent for regulatory audits and compliance - Provide a consistent, seamless user experience with unified consent banners - Enable or disable plugin behavior dynamically based on user preference ### Activate WordPress Consent API integration for your CookieHub CMP The WordPress Consent API helps websites comply with global privacy laws by allowing plugins and services to check and respect user consent preferences before performing tracking or data collection. CookieHub’s integration makes this process seamless: **Simple integration** Use the CookieHub plugin to connect to the WordPress Consent API automatically. **Future-proof compliance** Stay on top of changing privacy regulations with automatic updates and support from CookieHub. **Works across plugins** Whether you use WooCommerce, analytics tools, or ad plugins — all will respect the same consent preferences. **No coding required** Activate in just minutes. ### CookieHub CMP WP Consent API benefits Integrating the CookieHub CMP with the WP Consent API ensures that user consent preferences are consistently respected across your WordPress site and its ecosystem of plugins and services. This simplifies compliance with privacy regulations like GDPR, CCPA, and the ePrivacy Directive. **Plug-and-play setup, seamless integration, end-to-end automation** Instantly integrate CookieHub's consent management with the WP Consent API through our dedicated integration plugin. From cookie scanning to consent collection and recordkeeping, CookieHub automates compliance and consent management from end to end at any scale – from single sites to multisite WordPress deployments. **Automated compliance** Adhere to global privacy regulations like GDPR, CCPA, and others without having to monitor legal changes, develop regulatory expertise yourself or make manual updates. **Better user experience and trust** By ensuring all WordPress plugins and third-party tools honor the same consent signals, the user experience is smoother, and you can build user trust, boost conversions and engagement, and improve brand credibility with transparent and standardized consent handling. #### FAQ about WordPress Consent API Digging into WordPress Consent API can help businesses understand the importance of making compliance and consent management easier. Here are some of the most frequently asked questions. **What is the WordPress Consent API?** The WordPress Consent API is a framework that standardizes how WordPress plugins and themes handle user consent. It allows plugins to check and respect user choices, ensuring consistent behavior across the entire WordPress ecosystem. The Consent API is available as the WP Consent API feature plugin and has been proposed for inclusion in WordPress core. It simplifies compliance with global data protection laws by providing a single source of truth for consent states. **How does the WordPress Consent API work?** The API allows consent management platforms like CookieHub to register and store consent preferences (e.g., analytics, marketing, functional cookies). When a plugin attempts to set cookies or track data, it queries the Consent API to determine whether consent has been given. If not, it must wait or adjust its behavior accordingly. This ensures that user preferences are respected at every level — no matter how many plugins your site uses. **Why should I use CookieHub with the WordPress Consent API?** CookieHub simplifies and automates the entire consent process — from collecting user preferences to communicating them to all plugins. Instead of manually configuring each plugin or relying on inconsistent scripts, CookieHub ensures accurate, compliant, and automatically updated consent signals across your site. **Is the WordPress Consent API required?** While not mandatory, the WordPress Consent API is quickly becoming a best practice for GDPR and global compliance. Many modern plugins now support it by default to ensure consistent privacy behavior. **What consent categories are supported?** The WordPress Consent API uses standard categories: - **functional** – cookies needed for the site to work or to provide a requested service - **preferences** – cookies that store choices such as language or layout - **statistics** and **statistics-anonymous** – cookies used for measuring performance - **marketing** – cookies used for advertising and remarketing CookieHub maps its categories automatically: preferences to preferences, analytics to statistics and statistics-anonymous, and marketing to marketing. Functional cookies are always allowed. **Can I use the WordPress Consent API without a CMP like CookieHub?** Yes, but integration with a CMP is highly recommended. Without a CMP, you would have to manage consent collection, updates, and logs manually. CookieHub automates these processes and ensures your site remains compliant as regulations evolve. **How do I know if the WordPress Consent API is working?** When the WP Consent API plugin is active, the CookieHub plugin connects to it on its own. To check it, accept and then reject a category in the CookieHub banner on your site and confirm that plugins which support the WP Consent API respond — for example, that analytics does not load until statistics consent is given. **What regulations does the WordPress Consent API help with?** The API helps facilitate compliance with major global data privacy laws, including: - **GDPR** (EU) - **ePrivacy Directive** (EU) - **CCPA / CPRA** (California) - **LGPD** (Brazil) - **PIPEDA** (Canada) While the API itself doesn’t make a site compliant, it forms a key part of a compliant consent management framework when paired with CookieHub CMP. **Do I need a developer to set it up?** Not necessarily. CookieHub’s integration with the WP Consent API requires no coding — setup can be done through the WordPress dashboard in just a few minutes. **Does CookieHub support multisite WordPress setups?** Yes. On a multisite network, activate the CookieHub plugin and configure it on each site. Each site then passes its visitors’ consent choices to the WP Consent API in the same way. **What plugins are compatible with the WP Consent API?** An increasing number of popular plugins (like WooCommerce, Google Site Kit, WP Statistics, and other analytics tools) support the WP Consent API. CookieHub passes each consent choice to the API, so every plugin that supports it picks up the visitor’s choice without extra configuration. **Does CookieHub log consent records?** Yes. CookieHub securely logs all user consent events to support your compliance obligations and regulatory audits. --- # Japan APPI Cookie Consent and Compliance URL: https://www.cookiehub.com/appi Last updated: June 18, 2026 ## Japan APPI Cookie Consent and Compliance APPI requires businesses to be transparent about how personal data is collected and used, provide clear privacy notices, and implement mechanisms to manage user consent—particularly for data used for analytics, advertising, and marketing purposes. Are you ready to comply with Japan's privacy requirements? ### What your business needs to know about the APPI Japan The Act on the Protection of Personal Information (APPI) is Japan's primary data protection law, originally enacted in 2003 and significantly amended in 2017 and 2022 to align more closely with international standards, such as the GDPR. The APPI governs the handling of personal information by both private and public entities, emphasizing user rights and accountability and requires that businesses obtain proper consent from users when collecting or using personal data, including through cookies and tracking technologies. ### What does APPI compliance require? Organizations must pursue a number of activities to achieve APPI compliance, which include: **Data disclosure:** Clearly disclose data collection practices and purposes **Obtain consent:** All data collection must be done with explicit user consent and implement user-friendly consent mechanisms **Data protection:** Organizations must safeguard data security and manage cross-border data transfers **Privacy Policy:** Organizations must keep and disclose up-to-date privacy policies ### Who needs to comply with the APPI? All businesses handling the personal data of individuals located in Japan—whether domestic or international—must comply with the APPI. This includes websites accessible in Japan, cloud services, and e-commerce platforms, even if the organization itself is not physically located in Japan. ### Consumer rights under the APPI Japan’s APPI gives residents a set of data privacy rights, including letting consumers: **Right to access** Request access to their personal information, including what data is held and the purposes for its collection **Right to correction** Request that inaccurate, incomplete or out-of-date information be corrected **Right to deletion** Request the erasure of their personal information under certain circumstances **Right to complaint** Right to file complaints if they believe their rights have been violated **Right to suspension of use** Request the suspension of data use or disclosure if consumer believes information is being handled unlawfully **Right to notification/transparency** Notification to affected individuals and the Personal Information Protection Commission in the event of a data breach ### Why cookies as part of APPI compliance Cookies that collect personal information, such as IP addresses or browsing behavior, fall under the scope of the APPI. Consent is especially required when cookies are used for purposes beyond essential site functionality, such as targeted advertising or analytics, making it crucial to provide clear opt-in options and cookie categorization. ### Penalties for APPI non-compliance APPI non-compliance can lead to administrative orders, public reprimands, and fines. In severe cases, criminal penalties may apply, including imprisonment and substantial financial penalties for both individuals and companies that fail to meet the law’s requirements. ### How to comply with the APPI APPI compliance can be maintained through implementing a number of privacy best practices: **Conduct data and cookie audits:** Review current data practices to identify areas that need adjustment to align with the APPI **Update privacy and cookie policies:** Revise privacy notices to clearly outline data practices, consumer rights, and how to exercise those rights **Implement consent management:** Manage cookie use and consent with a comprehensive consent management platform like CookieHub **Educate employees:** Give employees training on the importance of compliance with APPI **Implement breach processes:** Ensure clear pathways for notifying about breaches **Assign a privacy officer:** Ensure an overseer is a part of your organization to manage compliance #### Frequently Asked Questions **What is the scope of the Act on the Protection of Personal Information (APPI) in Japan?** The APPI applies to any business operator handling personal information in Japan. It also applies extraterritorially to foreign entities that collect or use personal data of individuals located in Japan in connection with providing goods or services. **What is personal data under the APPI?** Under the APPI, personal data refers to information about a living individual that can identify that person, including name, date of birth, or other descriptors, either alone or in combination with other data. It also includes personally identifiable codes and data that can be readily collated to identify individuals. **What is sensitive data according to the APPI?** Sensitive personal information (referred to as "Special Care-Required Personal Information") includes details such as race, creed, social status, medical history, criminal records, and information about physical or mental disabilities. Handling such data requires obtaining the individual’s prior consent. **Who is the regulatory authority for Japan’s APPI?** The Personal Information Protection Commission (PPC) is the primary regulatory authority responsible for enforcing the APPI and overseeing data protection compliance in Japan. **Who is exempt from APPI rules?** Individuals who process personal information strictly for personal use are generally exempt. Additionally, the APPI provides limited exemptions for media organizations, academic institutions, and certain government functions when performing activities related to freedom of expression or academic research. **Where can I get more information about Japan’s Act on the Protection of Personal Information?** You can find official guidance and updates on the Personal Information Protection Commission (PPC) website. Legal and compliance professionals specializing in Japanese privacy law can also provide in-depth insights and resources. --- # Australian Privacy Act Cookie Consent Management and Compliance URL: https://www.cookiehub.com/australian-privacy-act Last updated: June 19, 2026 ## Australian Privacy Act Cookie Consent and Compliance The Australian Privacy Act is the key legislation regulating the handling of personal information by Australian government agencies and certain private sector organizations, establishing principles for collecting, using, storing, and disclosing personal data to protect individuals' privacy rights. Are you ready to safeguard data privacy? ### What your business needs to know about the Australian Privacy Act Under the Australian Privacy Act, cookies and similar technologies that collect personal information are subject to privacy obligations. Businesses must notify users when cookies are being used to collect data and, in some cases, obtain informed consent—particularly when sensitive or identifiable information is involved. This means clear cookie notices and options for users to manage their preferences are essential for compliance. ### What does the Australian Privacy Act compliance require? Your business must understand that any collection of personal data—including via digital tracking or cookies—falls under the Privacy Act. As part of compliance, organizations are required to: **Disclosure:** Clearly disclose data collection practices. **Data minimization:** Limit data use to the stated purposes. **Data protection:** Ensure data security. **Right of access:** Provide individuals access to their data. **Transparency:** Be transparent and responsive to privacy complaints. **Notification:** Notify individuals when collecting personal information, including via cookies. **Privacy Policy:** Have a clear and up-to-date privacy policy. **Privacy Impact Assessment:** Conduct a privacy impact assessment and audit data practices regularly. ### Who needs to comply with the Australian Privacy Act? The Privacy Act applies to: - Australian Government agencies. - All businesses with an annual turnover of 3 million AUD or more. - Smaller businesses involved in trading personal information or providing health services. Any organization handling sensitive data or operating under specific regulations (e.g., credit reporting, healthcare, and so on). ### Consumer rights under the Australian Privacy Act The Australian Privacy Act gives residents in Australia a set of data privacy rights, including the: **Right to know** Right to be informed about the purpose for personal information data collection, how it will be used, and to whom it might be disclosed **Right to access** Right to request access to their personal information **Right to correction** Request corrections to inaccurate, out-of-date, irrelevant information **Right to anonymity** \ Request to remain anonymous or use pseudonyms when interacting with organizations **Right to complaint** Right to lodge complaints with the relevant external dispute resolution scheme **Right to opt out** Request to stop receiving direct marketing from an organization **Notification of collection** Right to be notified when data is collected **Data protection** Requires organizations to take reasonable steps to protect information from misuse, interference, loss, unauthorized access, modification or disclosure ### Why cookies as part of Australian Privacy Act compliance Cookies that track user behavior, store preferences, or collect identifiable information are considered a form of personal information under the Act. Therefore, businesses must disclose cookie use and offer users a way to accept or reject non-essential cookies. Transparency and user control are key. ### Penalties for Australian Privacy Act non-compliance Non-compliance with the Australian Privacy Act can result in severe penalties. The maximum fine for serious or repeated breaches has been increased to 50 million AUD, three times the benefit obtained through misuse, or 30% of adjusted turnover—whichever is greater. Reputational damage and legal action can also result from non-compliance. ### How to comply with the Australian Privacy Act Compliance with the Australian Privacy Act can be more easily achieved by following a consent-first approach and data privacy best practices: **Conduct data and cookie audits:** Review current data practices to identify areas that need adjustment to align with the Australian Privacy Act and document cookie and tracker purposes **Update privacy and cookie policies:** Revise privacy notices to clearly outline data practices, consumer rights, and how to exercise those rights **Implement consent management:** Get effective management and control of cookie use with a comprehensive consent management platform like CookieHub **Educate employees:** Offer staff education programs on the importance of data privacy and Australian Privacy Act compliance **Implement breach processes:** Develop internal systems to detect, evaluate, and notify breaches within specified time period **Assign a privacy officer:** Appoint a privacy officer to oversee compliance #### Frequently Asked Questions **What is the scope of the Australia Privacy Act?** The Australia Privacy Act 1988 governs how personal information is collected, used, stored, and disclosed by Australian Government agencies and many private sector organizations. It applies to entities with an annual turnover of more than AUD 3 million, as well as some smaller businesses that handle sensitive information or provide health services. **What is personal data under the APA?** Personal data (or personal information) refers to any information or opinion that identifies or could reasonably identify an individual. This includes names, addresses, email addresses, phone numbers, and other details that make a person identifiable. **What is sensitive data according to the APA?** Sensitive data is a special category of personal information that includes details such as racial or ethnic origin, political opinions, religious beliefs, sexual orientation, criminal records, and health or genetic information. The APA imposes stricter rules on handling sensitive data. **Who is the regulatory authority for Australia’s PA?** The Office of the Australian Information Commissioner (OAIC) is the regulatory authority responsible for overseeing and enforcing the Privacy Act. **Who is exempt from APA rules?** Certain organizations are exempt from the APA, including most small businesses with an annual turnover of less than AUD 3 million, unless they handle health information, provide services under contract to the government, or trade in personal information. **Where can I get more information about Australia’s Privacy Act?** For comprehensive information, guidance materials, and updates, visit the [Office of the Australian Information Commissioner (OAIC)](https://www.oaic.gov.au/)** **website. --- # CCPA Cookie Consent: California Data Privacy Compliance URL: https://www.cookiehub.com/ccpa Last updated: April 1, 2026 ## California Consumer Privacy (CCPA) cookie consent and compliance CCPA was the first comprehensive data privacy law in the United States and remains the leading light as other states follow suit in adopting their own privacy laws. ### What your business needs to know about CCPA The California Consumer Privacy Act (CCPA) is the US state of California’s strict consumer privacy act, enacted in 2020 to protect the privacy rights of California residents. CCPA is designed to give consumers more power in knowing what personal information is being collected about them by businesses, the right to request deletion of that information, and the right to opt-out of that information being sold. ### What does CCPA compliance require? CCPA requires organizations to perform a number of different consumer requests and data handling standards to be considered compliant. Among these are: **Fair processing of personal information:** Data collection and processing must be lawful, fair, and transparent **Legitimate purpose collection:** Personal data may only be collected for legitimate purposes at the specific time it is collected **Appoint a data controller:** A data collector must be appointed who will be responsible for demonstrating full CCPA compliance **Adhere to data collection and storage limitations:** Data minimization (collect only what is necessary) is a core proviso, and data can only be stored as long as needed for the specified purpose **Accuracy:** All data stored must be accurate and up to date **Ensure data security:** All stored data must be safeguarded with proper security, integrity and confidentiality applied ### Who needs to comply with CCPA? If your website is accessible to users in California, it is best practice to comply with CCPA regulations, although the CCPA as it stands specifies that organizations required to comply will have an annual gross revenue of at least 25 million USD, will buy or sell the data of 100,000 or more California residents or households, and earn 50% or more of their annual revenue from selling California residents’ personal data. Even if not required to comply, these rules could change, and protecting data privacy is never a bad idea for your business. ### Consumer rights under the CCPA Ultimately CCPA is governed by a handful of key privacy-related tenets for consumers: **The right to know** Consumers can request personal data collected about them. **The right to delete** Consumers can ask that their data be removed or deleted. **The right to opt out** Consumers can refuse data collection for profiling and targeted advertising. **The right to limit use and disclosure of sensitive personal information** Consumers can direct businesses to restrict the use of their sensitive data. **The private right of action** Consumers can take legal action against businesses if their personal information is exposed. ### Why cookies as part of California state compliance Cookies are a big part of consent, and the cookie banner is usually the first way users have to opt in or out of data collection and to understand what data is being collected and why. While cookies are not the heart of the CCPA, they are an unavoidable part of the user experience on the web and thus remain relevant and a potential compliance risk. ### Penalties for CCPA non-compliance Penalties related to CCPA violations can quickly add up, with fines ranging from 2,500 to 7,500 USD per violation, depending on whether the violation was intentional or unintentional. These penalties apply to each instance of non-compliance, such as a data breach affecting multiple consumers, which can quickly make the cost balloon to exorbitant sums. ### How to comply with the CCPA Businesses can take a number of steps to help stay in compliance with the CCPA and fulfill general data privacy best practices: **Review data practices:** Conduct a comprehensive audit of your data handling practices, including collection, storage and sharing. Identify where personal data is being used and check that it complies with CCPA requirements. **Implement consent management:** Platforms like CookieHub provide an easy way to manage consumer consent for data processing. **Check partner contracts:** Review third-party service provider contracts to ensure agreements meet CCPA standards for data protection. **Update privacy policies:** Keep your privacy policy up to date and accessible, including detailed information on how data is collected, processed and shared. **Train staff:** Educate employees about CCPA and its implications, and their role in maintaining compliance. #### Frequently Asked Questions **What is the scope of CCPA?** The CCPA applies to businesses that collect personal information from California residents and meet certain thresholds, such as having annual gross revenues over $25 million, buying or selling personal data of 100,000 or more consumers, or earning 50% or more of annual revenue from selling personal data. It gives California residents rights over their personal data, including the right to know, delete, and opt out of the sale of their information. **What is personal data under CCPA?** Under the CCPA, personal data (or personal information) is any information that identifies, relates to, describes, or could reasonably be linked with a particular consumer or household. This includes names, addresses, email addresses, browsing history, geolocation data, and more. **What is sensitive data according to CCPA?** The CCPA, as amended by the California Privacy Rights Act (CPRA), defines "sensitive personal information" to include data such as Social Security numbers, driver’s license numbers, financial account information, precise geolocation, racial or ethnic origin, religious beliefs, biometric data, and contents of certain private communications. **Who is the regulatory authority for CCPA enforcement?** The California Privacy Protection Agency (CPPA) is the primary authority responsible for enforcing the CCPA. The California Attorney General also retains enforcement authority, especially for civil penalties. **Who is exempt from CCPA?** Certain entities and types of data are exempt from the CCPA. This includes small businesses that do not meet the law’s thresholds, certain nonprofit organizations, and specific categories of data such as publicly available government records, or data already regulated by other laws like HIPAA or GLBA. **Where can I get more information about CCPA?** For more details, visit the official website of the [California Privacy Protection Agency](https://cppa.ca.gov/) or consult the Office of the Attorney General of California for legal guidance and resources. --- # CNIL Cookie Consent Management | French GDPR Compliance Guidelines URL: https://www.cookiehub.com/cnil Last updated: June 16, 2026 ## Cookie Consent and Compliance for CNIL Requirements French data privacy is governed by the EU’s GDPR, and CNIL offers guidelines and recommendations beyond GDPR. In 2021, new recommendations on cookies and cookie consent came into force. Consent is at the heart of CNIL’s guidelines. ### What your business needs to know about CNIL and cookie walls CNIL, or the Commission nationale de l’informatique et des libertés, is an independent French administrative body that oversees data privacy legislation in France. It issues and enforces the rules and regulations regarding data compliance within the territory. Central to CNIL’s guidelines is the free nature of consent. A website user’s consent must be freely given in accepting cookies. This is a key issue for websites that use cookie walls. Since cookie walls only allow access to a site if the site’s cookies are accepted, they remove any free choice, and a user has to provide consent to proceed. While CNIL has not introduced a blanket ban on cookie walls, it does have guidelines on what kind of information these walls need to give users in order to make them compliant. As long as a website provides users with accurate and reliable information about accepting or denying consent and what that means, cookie walls are generally allowed. ### What does CNIL compliance require? A website must provide the following to be able to claim they have received a user’s informed consent, and thus adhere to CNIL. CNIL further stipulates that consent must be affirmative, or an explicit click of an “I consent” or “Yes” button – there can be no assumptions or implied consent by a lack of user action. Any inaction from a user must be considered a rejection of site cookies. **Cookie compliance:** Inform transparently about the functions cookies serve **Ability to accept or reject:** How to accept or reject any particular cookie **Enable informed consent about cookies:** What accepting or rejecting these cookies will mean **Cookie data and handling:** Data regarding the identities of cookie administrators and any third parties that may be involved **Right to withdraw:** The user’s right to withdraw consent, and a clear way to do so ### Who needs to comply with CNIL? Any organization operating a website or application that collects personal data through cookies from users in France must comply with CNIL's cookie rules. This includes businesses based in France, as well as those outside of France that target French users. Essentially, if your website uses cookies that track or collect information about individuals in France, you need to adhere to CNIL's guidelines, which emphasize transparency and user consent. ### Consumer rights under the CNIL CNIL is tasked with protecting personal data, with a focus on safeguarding the following consumer rights: **Right to access** Individuals can request access to their personal data **Right to correction** If data is inaccurate or incomplete, individuals can request corrections **Right to erasure/to be forgotten** Individuals can request the deletion of their data under certain conditions **Right to object** Individuals can object to the processing of their data, particularly for marketing purposes **Right to data portability** Individuals can request to receive their data in a usable format **Right to information** Companies must provide clear and transparent information about data collection and processing practices **Right to withdraw consent** Individuals can withdraw consent for data processing at any time ### Why cookies as part of CNIL compliance CNIL requires a user’s consent to be managed with complete transparency — that is to say, websites can’t request a single consent for cookies that have different functions. Since such consent fails to fully inform users of what they’re actually agreeing to, it restricts their freedom of choice and isn’t regarded as consent in any meaningful way. When it comes to individual cookie types and their functionalities, websites must grant users precise information about each individual cookie in order for users to grant their ‘informed’ consent. To help clarify the picture, websites must also reveal the identity of any data administrators or third parties who are involved in the creation, or use, of the cookies. Of equal importance here is that any data a website supplies about its cookies should be delivered in simple, easy-to-understand terms — and not masked behind technical and legal terminology. Once again, a user’s consent must be granted in a meaningful way. ### Penalties for CNIL non-compliance CNIL has imposed a number of massive fines on various companies, so the penalties are not theoretical. CNIL can impose fines of up to 4% of a company’s global annual revenue or 20 million EUR, whichever is higher. In addition, CNIL is empowered to issue formal notices, injunctions and can require companies to simplify their cookie consent mechanisms. ### How to comply with the CNIL Staying in compliance means proactively thinking about your data privacy posture; here are a few best practices to stay on the right path: **Conduct data audits:** Review current data practices to identify areas that need adjustment to align with CNIL and GDPR **Update privacy policies:** Revise privacy notices to clearly outline data practices, consumer rights, and how to exercise those rights **Implement consent management:** Get effective management and control of cookie use with a comprehensive consent management platform like CookieHub **Employee training:** Offer staff education programs on the importance of data privacy, GDPR and CNIL #### Frequently Asked Questions **What is the scope of the Commission nationale de l’informatique et des libertés (CNIL)?** The CNIL is France’s independent regulatory body responsible for ensuring the protection of personal data and privacy. It oversees compliance with data protection laws, including the GDPR, and provides guidance to individuals and organizations on their rights and responsibilities regarding data processing in France. **What is personal data under CNIL?** According to the CNIL, personal data refers to any information that can directly or indirectly identify a natural person. This includes names, email addresses, identification numbers, location data, online identifiers (such as IP addresses), and other information that can be linked to a person. **What is sensitive data according to the CNIL?** Sensitive data includes special categories of personal data that require a higher level of protection. This covers information such as racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for identification, health data, and data concerning a person’s sex life or sexual orientation. **Who is the regulatory authority for France’s CNIL?** The CNIL itself is the national regulatory authority for data protection in France. It operates independently but is recognized and empowered by French law to enforce data privacy regulations and oversee their application. **Who is exempt from CNIL rules?** In general, CNIL rules apply to all entities that process personal data in France. However, purely personal or household activities (e.g., managing personal contacts or photo albums) are exempt from CNIL oversight. Public authorities or organizations with specific legal exemptions may also have limited exclusions under defined circumstances. **Where can I get more information about the French Commission nationale de l’informatique et des libertés (CNIL)?** You can learn more by visiting the official [CNIL website](https://www.cnil.fr/). The site offers resources, guidance, and updates on data protection laws, individual rights, and regulatory compliance. --- # COPPA Compliance: Cookie Consent, Parental Rights & Privacy Rules URL: https://www.cookiehub.com/coppa Last updated: June 16, 2026 ## COPPA Consent and Compliance The Children’s Online Privacy Protection Act (COPPA) is a US federal law enacted in 1998 and enforced by the Federal Trade Commission (FTC). COPPA regulates how websites, mobile apps, and digital services collect, use, and share personal information from children under the age of 13. The law requires parental consent, transparency, and data security, with the goal of protecting children’s online privacy. Are you in compliance? ### What your business needs to know about COPPA If your business operates a website, game, app, or digital platform aimed at children under 13 or collects their data, you must put specific measures into place that safeguard more stringent privacy practices, obtain parental consent, and limit data collection. You must also ensure third-party services (e.g., ad networks or analytics platforms) comply with COPPA when used on your platform. ### What does COPPA compliance require? To evaluate your compliance with COPPA, consider: **Age controls:** Think about whether your website or app is targeted toward children under 13, or knowingly collects data from children **Parental consent:** Implement a method for obtaining verifiable parental consent before collecting personal information **Disclosure:** Disclose your data practices in a privacy policy written in language understandable to children and parents **Parental controls:** Allow parents to review, delete, or refuse further collection of their child’s data **Third-party connections:** Ensure third-party services or cookies you use also COPPA-compliant Failure to meet these requirements may place your business in violation of federal law. ### Who needs to comply with COPPA? COPPA applies to: - **Operators of websites or online services** (including apps, games, and social platforms) **directed to children under 13**. - Operators who **knowingly collect data** from users under 13, even if the site is not specifically directed at children. - **Third-party services**, such as plugins or ad networks, that collect data through child-directed platforms. ### Consumer rights under the US’s COPPA regulation Under COPPA, parents and legal guardians have the right to: **Be informed** of the types of personal data being collected from their children. **Give or deny consent** to the collection and use of their child's information. **Access or review their child’s personal information** held by a business. **Request deletion** of their child’s data. **Withdraw consent** and prohibit further collection or use of their child’s personal information. ### Why cookies as part of COPPA compliance Cookie consent banners must clearly explain data collection practices and ensure no data is gathered from children without parental approval**.** Cookies, especially those used for tracking, behavioral profiling, or targeted advertising, fall under COPPA if they collect information from users under 13. This includes: - IP addresses - Device IDs - Location data - Browsing behavior If your platform is child-directed or knowingly targets children, you must disable tracking cookies until you have received verifiable parental consent. First-party cookies used for essential functionality may be permitted, but profiling or marketing cookies are restricted. ### Penalties for COPPA non-compliance Violating COPPA can result in: - Civil penalties of up to 50,120 USD per violation**.** - Enforcement actions by the FTC and state attorneys general. - Reputational damage, public investigation reports, and forced changes to business practices. - Legal settlements or compliance orders requiring periodic audits and monitoring. ### How to comply with COPPA Ensuring that standard best practices for data privacy are enacted and followed in addition to obtaining verifiable parental consent before collecting or disclosing a child's personal information is at the heart of COPPA compliance. **Update privacy policy:** Provide clear and comprehensive privacy notices about your data practices. **Gain parental consent:** Obtain verifiable parental consent before collecting or disclosing a child's personal information. **Give parents control:** Allow parents to access and delete their child’s information. **Keep data secure:** Implement procedures to maintain data security. **Data minimization:** Limit data collection to what is necessary for the activity. #### Frequently Asked Questions **What is the scope of COPPA?** COPPA applies to websites, mobile apps, and online services that collect personal information from children under 13 in the United States, or that knowingly target this age group. **What is personal data under COPPA?** COPPA defines personal information as any data that can be used to identify a child, including names, email addresses, usernames, IP addresses, geolocation data, and photos or voice recordings. **What is sensitive data according to COPPA?** All personal data from children under 13 is treated as sensitive under COPPA. This includes identifiers, biometric data, and behavioral information collected through tracking. **Who is the regulatory authority for COPPA?** The Federal Trade Commission (FTC) enforces COPPA, including investigating complaints, issuing fines, and publishing enforcement guidelines. **Who is exempt from COPPA rules?** General-audience websites that neither target children nor knowingly collect their data may be exempt. However, once an operator becomes aware they are collecting data from a child under 13, COPPA applies. **Where can I get more information about COPPA?** You can visit the FTC’s COPPA page for comprehensive guidance, updates, and compliance resources. --- # Colorado CPA Cookie Consent and Compliance URL: https://www.cookiehub.com/cpa Last updated: June 16, 2026 ## Colorado CPA Cookie Consent and Compliance Designed to protect consumers with key privacy rights and penalize those who do not respect these rights, learn how to comply with the Colorado Privacy Act. ### What your business needs to know about CPA The** **Colorado Privacy Act (CPA) is Colorado’s consumer privacy regulation, aimed at providing consumers with more control and oversight of their personal data. As US states individually enact their own privacy laws to safeguard consumer data, Colorado is no exception. Signed into law in July 2023, the law gives consumers a range of rights related to their data and privacy. ### What does CPA compliance require? The CPA stipulates a number of requirements for businesses to be in compliance: **Data minimization:** Businesses must only collect the personal data necessary for the specific purposes disclosed to consumers. **Transparency:** Businesses must provide clear, accessible explanations of data collection practices, consumers’ rights, and how data is shared with third parties. **Risk assessments:** If engaged in high-risk data processing activities, such as profiling or targeted advertising, companies must conduct data protection assessments to evaluate potential risks to consumers. **Data collection purposes:** Organizations must clearly explain why the business is collecting personal data and how it will be used. **Data security:** Organizations must implement security measures to protect personal data from breaches and unauthorized access. ### Who needs to comply with CPA? The CPA applies to businesses and nonprofits as well as vendors, service providers, and contractors that manage data on behalf of these companies in Colorado or with Colorado residents. One of the following criteria must also apply: - Affected businesses must process the personal data of 100,000 or more consumers annually, and/or - Gain revenue or receive discounts from the sale of personal data of 25,000 or more consumers. ### Consumer rights under the CPA The CPA gives Colorado residents five core rights pertaining to their personal data: **Right to access** Consumers can request personal data collected about them **Right to deletion** Consumers can demand the removal of their data, with the exception of data required for legal compliance **Right to opt out** Consumers can refuse profiling and targeted advertising **Right to correction** Consumers can request fixes to inaccurate data **Right of data portability** Consumers can request a copy of personal data collected about them in a readable format Businesses are required to respond within 45 days of a CPA-related complaint and have the possibility of a 45-day extension. While in other jurisdictions, consumers can bring legal action against businesses for violations, the CPA only offers relief through enforcement by state authorities. ### Why cookies as part of Colorado state compliance Cookies make up a fundamental part of the data collection experience. Cookies are small pieces of data stored on a user’s device to track behavior, preferences, and interactions with a website. These kinds of cookies trigger CPA obligations. Transparent disclosure and securing user opt-in consent through clear, informative consent banners before loading non-essential cookies is a key part of compliance. After consent, websites must also allow users to withdraw or opt-out at any time. With cookies as a central part of Colorado’s data privacy ethos, businesses need to manage cookie consent properly, obtaining clear authorization from users before collecting personal data via cookies and ensuring they have the right to opt out or withdraw consent at any time. ### Penalties for CPA non-compliance Failure to comply with CPA can result in penalties for infringement. If your website is accessible to users in Colorado, it is important to understand and comply with the CPA. Non-compliance can result in immediately applicable penalties up to 20,000 USD per violation, with each representing a separate infringement of consumer rights. The CPA provides a 60-day “cure period”, during which businesses have the opportunity to remedy any violations. The 60 days begin once the business is notified of the infraction by the state, and if fixed during this grace period, the business can avoid the fine or further penalties. ### How to comply with the CPA Businesses can take a number of steps to help stay in compliance with the CPA and fulfill general data privacy best practices: **Review data practices:** Conduct a comprehensive audit of your data handling practices, including collection, storage and sharing. Identify where personal data is being used and check that it complies with CPA requirements. **Implement consent management:** Platforms like CookieHub provide an easy way to manage consumer consent for data processing. **Check partner contracts:** Check partner contracts: Review third-party service provider contracts to ensure agreements meet CPA standards for data protection. **Update privacy policies:** Keep your privacy policy up to date and accessible, including detailed information on how data is collected, processed and shared. **Train staff:** Educate employees about CPA and its implications, and their role in maintaining compliance. #### Frequently Asked Questions **What is the scope of CPA?** The Colorado Privacy Act (CPA) applies to entities conducting business in Colorado or targeting Colorado residents, and that either control or process the personal data of at least 100,000 consumers per year or derive revenue from the sale of personal data and process data for at least 25,000 consumers. It grants Colorado residents rights over their personal data, including the rights to access, correct, delete, and opt out of data processing for targeted advertising or sale. **What is personal data under CPA?** Under the CPA, personal data is any information that is linked or reasonably linkable to an identified or identifiable individual. This includes names, email addresses, account information, and any data that can be used to identify a person—excluding de-identified or publicly available information. **What is sensitive data according to CPA?** The CPA defines sensitive data as personal information that reveals a consumer’s racial or ethnic origin, religious beliefs, mental or physical health condition or diagnosis, sex life or sexual orientation, citizenship or immigration status, as well as genetic or biometric data used for identification, and personal data from a known child (under 13 years old). **Who is the regulatory authority for CPA enforcement?** the Colorado Attorney General and district attorneys are responsible for enforcing the CPA. The Attorney General also has rulemaking authority to issue guidance and clarify compliance requirements under the law. **Who is exempt from CPA?** The CPA does not apply to certain organizations and data types. Exemptions include government entities, certain financial institutions subject to the Gramm-Leach-Bliley Act (GLBA), entities governed by HIPAA, and data used for purely personal or household purposes. **Where can I get more information about CPA?** You can find official information, guidance, and updates on the CPA by visiting the Colorado Attorney General’s website. --- # Connecticut CTDPA Cookie Consent and Compliance URL: https://www.cookiehub.com/ctdpa Last updated: June 16, 2026 ## Connecticut CTDPA Cookie Consent and Compliance Under Connecticut Data Privacy Act (CTDPA), businesses must obtain clear, informed opt-in consent before setting cookies or other tracking technologies that collect personal or sensitive data from Connecticut residents. Do you have the right consent management tools in place to comply? ### What your business needs to know about CTDPA Connecticut The Connecticut Data Privacy Act (CTDPA) went into effect as of July 1, 2023. It grants Connecticut residents key data rights and protections and imposes obligations on businesses and service providers processing Connecticut residents’ personal data. Controllers/processors meeting quantitative thresholds or handling consumer health data (no thresholds apply to CHD controllers) are affected by CTDPA. ### What does CTDPA compliance require? Businesses should assess whether they exceed thresholds—processing data of ≥ 100,000** **Connecticut residents, or ≥ 25,000** **with over 25% revenue from data sales—as well as any handling of consumer health data (CHD). If so, ensure you: **Update privacy policy:** Updating privacy policies with Delaware-specific disclosures **Implement consent management:** Implement cookie consent banners and enable consumer rights **Conduct assessments:** Prepare risk and data protection assessments **Opt-in and out support:** Use opt-in for sensitive data and bake in global opt-out support (e.g., GPC) **Implement processor agreements:** Have agreements in place to enforce CTDPA standards ### Who needs to comply with CTDPA Connecticut? Compliance with CTDPA is required for any organization that: 1. Processes personal data of ≥ 100,000 consumers annually, **or** 1. Processes data of ≥ 25,000 consumers and earns > 25% gross revenue from selling personal data, **or** 1. Processes consumer health data for CT residents Exempt entities include: - State/local governments - Non-profit and higher-ed institutions - GLBA-covered financial institutions - HIPAA-covered entities - National securities associations ### Consumer rights under CTDPA Connecticut Connecticut residents may exercise the following rights: **Right to access** Consumers can access personal data, including profiling-derived inferences **Right to correct** Consumers can request to correct inaccuracies **Right to delete** Consumers can request that their personal data be deleted **Right to data portability** Consumers have a right to download/transmit their information **Right to opt-out** Consumers can opt out of personal data sale, targeted advertising, and profiling that produces legal/significant effect ### Why cookies as part of CTDPA Connecticut compliance Cookie banners and consent tools must explain what data is collected, why and how it is used, and allow users to accept or reject tracking. Cookies that process personal or sensitive data (e.g. device IDs, biometric, health-related tracking) require explicit opt-in**.** Cookie notices must detail the purpose, types of cookies, and provide easy accept/reject options. Firms must record consent and support “Do Not Sell” mechanisms. ### Penalties for CTDPA Connecticut non-compliance Non-compliance will lead to financial penalties. Through Dec 31, 2024, CTDPA provided for a 60-day cure period after AG notice, during which violations had to be addressed to avoid fines. After January 1, 2025, the default cure period was eliminated. The Connecticut AG is empowered to assess up to 5,000 USD per willful violation, including restitution and injunctive relief. ### How to comply with CTDPA Connecticut To check your compliance with the CTDPA, organizations should: **Audit:** Conduct a data audit to identify all cookies and trackers on their websites **Categorize:** Categorize cookies (e.g., necessary, preference, analytics, marketing) **Implement consent management:** Ensure consent banners are implemented correctly with granular choices, enable users to withdraw consent at any time, and maintain consent logs **Check third-party contracts:** Review third-party data-sharing practices #### Frequently Asked Questions **What is the scope of CTDPA Connecticut?** It applies to controllers/processors doing business in CT or targeting its residents who process ≥ 100,000 consumers’ data annually, or ≥ 25,000 with > 25% revenue from data sales, plus any controller of consumer health data. **What is personal data under CTDPA Connecticut?** Any information linked to an identifiable individual (e.g. name, address, IDs, login credentials), excluding public information. **What is sensitive data according to CTDPA Connecticut?** Subset of personal data including racial/ethnic origin, religion, health conditions, sexual orientation, biometric/genetic data, and consumer health data—processing requires opt-in. **Who is the regulatory authority for CTDPA Connecticut?** The Connecticut Attorney General enforces CTDPA; enforcement includes notices, fines, injunctions, and restitution. **Who is exempt from CTDPA Connecticut rules?** Exempt entities include governmental bodies, nonprofits, highered, GLBA covered financial institutions, HIPAA covered entities, and national securities associations. **Where can I get more information about CTDPA Connecticut?** For official guidance, visit the Connecticut Attorney General’s CTDPA page. --- # Digital Markets Act (DMA) Compliance & EU Gatekeeper Rules URL: https://www.cookiehub.com/digital-markets-act Last updated: September 24, 2026 ## Digital Markets Act (DMA) consent and compliance The Digital Markets Act (DMA) is a landmark regulation enacted by the European Union to promote fair competition and increased transparency in the digital economy. ### What your business needs to know about the Digital Markets Act The Digital Markets Act (DMA) is a European Union regulation that targets large digital platforms acting as “gatekeepers” — typically tech giants that dominate certain digital markets. The DMA seeks to ensure fair competition by imposing restrictions on these gatekeepers, including prohibiting practices such as self-preferencing, locking users into ecosystems, and unfair use of business users' data. It complements the Digital Services Act (DSA). It entered into force on 1 November 2022 and has applied since 2 May 2023, with compliance required from March 2024. ### What does DMA compliance require? If your business operates online in the EU or targets EU users, understanding the DMA is critical — even if you are not a gatekeeper. Gatekeepers are companies with a significant impact on the internal market. But smaller companies may also be affected, especially if they interact with or rely on gatekeeper platforms. Compliance may involve changes in interoperability, access to data, advertising transparency, and user consent practices. Businesses must ensure that users make informed choices freely and without coercion, aligning consent practices with GDPR standards. A central concept of the DMA is requiring explicit user consent for data processing, particularly when personal data is combined across services. Simply bundling consent into general terms and conditions or using manipulative design (known as “dark patterns”) is no longer acceptable under the DMA. To ensure compliance with the DMA, businesses should: **Determine DMA role:** Identify whether they qualify as a “gatekeeper” under the DMA criteria. **Review data practices:** Review how data is collected, processed, and combined across platforms. **Update consent mechanisms:** Update consent mechanisms to ensure users are informed and consent is freely given. **Review policies:** Audit contracts, platform rules, and algorithmic transparency policies. **Document for compliance:** Prepare for and maintain comprehensive documentation to demonstrate compliance. ### Who needs to comply with DMA? The DMA primarily applies to digital platforms designated as gatekeepers by the European Commission. A gatekeeper typically: - Has an annual EU turnover of at least €7.5 billion, or a market value of at least €75 billion - Provides core platform services (like search engines, app stores, social networks, etc.) to over 45 million monthly EU users - Operates in at least three EU member states However, non-gatekeeper businesses must still adjust to the rules imposed on gatekeepers, especially if they use or depend on those platforms. Therefore, awareness and indirect compliance are necessary for many digital businesses. ### Consumer rights under the DMA The EU Digital Markets Act intersects with data privacy laws like GDPR and thus confers a number of data privacy rights to consumers, including: **Enhanced consent mechanisms** Consumers must give specific, informed and unambiguous consent without any manipulative tactics and have the right to withdraw consent at any time **Data portability** Consumers must be able to easily transfer their data to other services and know that there is interoperability between them **Protection from gatekeeper organizations** Gatekeepers may not self-preference their own services and products and must allow users to uninstall pre-installed apps that are part of gatekeepers’ platforms **Right to complain** Consumers are allowed to complain about any non-compliance by gatekeepers **Transparency** Consumers have a right to know how their data is collected, used and shared. ### Why cookies as part of DMA compliance Cookie consent practices are particularly key under the DMA, as the Act aims to prevent gatekeepers from using cookies to combine user data across services or platforms. The DMA requires that: - users must have the choice to opt in to such tracking - refusal must not result in degraded service - cookie banners and consent tools be clear, user-friendly, and fully compliant - cookie choices be respected across sessions - users can easily withdraw consent ### Penalties for DMA non-compliance Failure to comply with the DMA can result in significant penalties, including: - Fines of up to 10% of a company’s global annual turnover, or up to 20% for repeated infringements - Periodic penalty payments of up to 5% of daily turnover for continued non-compliance - In extreme cases, the European Commission may impose structural remedies, such as requiring a company to divest parts of its business ### How to comply with the DMA Compliance with the DMA can be achieved by taking a few key actions: **Review data practices for consent:** Ensure that you obtain explicit, informed consent before storing or accessing non-essential cookies. Pre-ticked boxes and implied consent are non-compliant **Provide clear choices:** Allow users to accept or reject different categories of cookies without influencing their choice and make consent withdrawal transparent **Ensure a symmetrical user experience:** Make “reject all” as easily accessible as “accept all” without burying the options under multiple clicks or with confusing wording **Avoid dark patterns and bundling:** Make sure that consent can be freely given, specific and not conditional **Implement consent management:** Platforms like CookieHub provide an easy way to manage consumer consent for data processing #### Frequently Asked Questions **What is the scope of the European Union Digital Markets Act (DMA)?** The DMA targets large online platforms acting as “gatekeepers” to ensure fair competition and prevent anti-competitive practices in the digital market across the EU. It applies to major tech companies that provide core platform services like search engines, social networks, app stores, and online marketplaces. **What is a gatekeeper according to the EU DMA?** A gatekeeper is a large online platform that controls access to important digital markets and acts as a critical gateway between businesses and users. These platforms have a strong economic position, a significant user base, and operate core platform services such as app stores, search engines, social networks, or online marketplaces. The DMA sets specific criteria to identify gatekeepers based on their size, user numbers, and impact on the internal market. **What is personal data under the EU DMA?** Personal data refers to any information relating to an identified or identifiable individual, such as names, email addresses, location data, or online identifiers, that platforms may collect, process, or use in their services. **What is sensitive data according to the EU DMA?** Sensitive data includes personal information that reveals racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, health information, or data concerning a person’s sex life or sexual orientation. **Who is the regulatory authority for Europe’s DMA?** The European Commission is the primary regulatory authority responsible for enforcing the DMA and overseeing compliance across the EU member states. **Who is exempt from EU DMA rules?** The DMA rules apply specifically to gatekeepers that meet certain thresholds related to size and market impact. Smaller digital platforms and companies that do not meet these criteria are exempt from the DMA regulations. **Where can I get more information about the European Union Digital Markets Act?** More detailed information and official documents can be found on the European Commission’s website dedicated to the [Digital Markets Act](https://digital-strategy.ec.europa.eu/en/policies/digital-markets-act). --- # Kenya DPA Cookie Consent and Compliance URL: https://www.cookiehub.com/dpa Last updated: June 19, 2026 ## Kenya DPA Cookie Consent and Compliance Under the Kenya Data Protection Act (DPA), using cookies or similar technologies to process personal data requires explicit, informed, and freely given consent—mirroring EU GDPR. Are your websites compliant? ### What your business needs to know about the DPA Kenya The Data Protection Act, 2019, effective from 25 November 2019, is Kenya’s primary data privacy law. It enshrines the constitutional right to privacy and establishes the Office of the Data Protection Commissioner (ODPC) to oversee data protection, governed by subsidiary regulations on registration, general compliance, and enforcement. ### What does DPA Kenya compliance require? Businesses are required to understand that the scope of the DPA applies to both Kenyan and non-Kenyan entities processing the personal data of Kenyan residents. The rights these residents hold include the right to be informed, the right to access, rectification, erasure, portability, objection to automated decisions, and opting out of direct marketing. Businesses must also register with the ODPC, appoint data processing officers and conduct data protection impact assessments as well as implement data protection and security safeguards. To verify compliance: **Map and specify cookie use:** Map current cookie usage and classify data collected. **Implement consent management:** Review consent mechanisms for clarity and granularity. **Track consent:** Track user consent records and allow for withdrawal. **Maintain privacy policy:** Update your privacy policy to reflect cookie practices. **Registration:** Register as a data controller or processor with the ODPC where applicable. ### Who needs to comply with the DPA Kenya? Any data controller or processor (public or private) handling personal data of Kenyan residents, regardless of where the entity is based, must comply with the DPA. Small businesses are not exempt. ### Consumer rights under the DPA Kenya Kenya’s DPA gives residents a set of data privacy rights, including: **Right to access** Request access to their personal information **Right to be informed** Request to know how personal data is being collected and used **Right to correction** Request that inaccurate, incomplete or out-of-date information be corrected **Right to deletion** Request the erasure of their personal information under certain circumstances **Right to object to or limit processing of data** Request to opt out of processing of their data **Right to data portability** Request data in a structured, commonly used format **Right to object to automated decision-making** Request that decisions not be made solely on automated processing **Right to consent** Organizations must obtain consumer consent before processing data **Right to lodge complaints** File complaints with the Office of the Data Protection Commissioner in the case of data protection violations ### Why cookies as part of DPA Kenya compliance Cookies that collect or transfer personal information (like through third parties or analytics) are subject to DPA rules. Businesses must categorize cookies, state their purposes and gather valid consent prior to deployment. ### Penalties for DPA Kenya non-compliance DPA non-compliance can lead to: - Fines up to 5 million KES or 1% of annual turnover, whichever is lower - Specific breaches (e.g. processing without consent, failure to register, obstructing ODPC) can accrue separate fines (20,000–3 million KES) or prison terms (up to 10 years) - The ODPC may issue compliance directives, seize equipment, or refer matters for prosecution as part of their enforcement authority. - Individuals can claim damages for data rights violations by bringing civil suits against violators. Reputational fallout and brand damage can be collateral damage. ### How to comply with the DPA Kenya DPA Kenya compliance and data privacy best practices go hand in hand: **Conduct data and cookie audits:** Review current data practices to identify areas for aligning with the DPA **Update privacy and cookie policies:** Revise privacy notices to clearly outline data practices, consumer rights, and how to exercise those rights **Implement consent management:** Manage cookie use and consent with a comprehensive consent management platform like CookieHub **Educate employees:** Give employees training on the importance of compliance with DPA **Implement breach processes:** Ensure clear pathways for notifying consumers about data breaches **Assign a privacy officer:** Add a privacy officer to your organization to manage compliance #### Frequently Asked Questions **What is the scope of Kenya’s Data Protection Act (DPA)?** The DPA applies to any person or organization—whether established in Kenya or outside—that processes personal data of individuals located in Kenya. It governs how personal data is collected, stored, used, and shared, ensuring privacy and protection for data subjects. **What is personal data under the DPA?** Personal data refers to any information that relates to an identified or identifiable natural person. This includes names, identification numbers, location data, online identifiers, or other data that can be used to identify someone directly or indirectly. **What is sensitive data according to the DPA?** Sensitive personal data includes information that reveals a person’s race, health status, ethnic or social origin, conscience, belief, genetic data, biometric data, sexual orientation, or sex life. This type of data is subject to stricter protection requirements under the Act. **Who is the regulatory authority for Kenya’s DPA?** The Office of the Data Protection Commissioner (ODPC) is the regulatory authority responsible for overseeing the implementation and enforcement of the DPA in Kenya. **Who is exempt from DPA rules?** The DPA does not apply to data processing done for purely personal or household activities. Additionally, exemptions may apply in cases involving national security, public interest, or journalism, subject to specific legal conditions. **Where can I get more information about Kenya’s Data Protection Act?** You can find more information by visiting the official website of the Office of the Data Protection Commissioner (ODPC). The site offers resources, guidelines, and updates related to data protection in Kenya. --- # Botswana DPA Cookie Consent and Compliance URL: https://www.cookiehub.com/dpa-botswana Last updated: June 18, 2026 ## Botswana DPA Cookie Consent and Compliance Botswana’s Data Protection Act requires organizations to get consent before processing personal data, including cookies and other tracking technologies. Is your website ready for compliance? ### What your business needs to know about the Botswana’s DPA Botswana’s Data Protection Act governs the collection, processing, storage and transfer of personal data. Inspired by global frameworks like the EU’s GDPR, the law aims to safeguard individuals’ privacy rights while enabling lawful data-driven business practice. Organizations must obtain explicit consent before processing personal data unless another legal basis applies (such as legal obligations, the performance of a contract, or legitimate interest as defined under the law). Privacy notices must clearly explain what data is collected, why it is processed, how long it will be stored, and whether it will be shared or transferred abroad. Cross-border transfers of personal data are tightly regulated and generally require either explicit consent from the data subject or approval from the Information and Data Protection Commission. ### What does DPA Botswana compliance require? To check compliance with Botswana’s DPA, your organization should: **Conduct a data review:** Map out how your business collects, processes, and stores personal data. **Implement consent management:** Ensure your cookie banner, privacy policy, and consent mechanisms are transparent and compliant. **Maintain records:** Maintain up-to-date documentation and carry out regular audits. **Train staff:** Educate employees about the law’s requirements and responsibilities. **Complete vendor checks:** Verify that partners, service providers, and third-party tools comply with Botswana’s law. ### Who needs to comply with the Botswana’s data privacy law? The DPA applies to all public and private organizations that process the personal data of individuals located in Botswana, regardless of where the organization itself is based. This includes local businesses, NGOs, online platforms, and international companies offering goods or services to people in Botswana. ### Consumer rights under DPA Botswana Under the Act, data subjects in Botsana have the following rights: **Right to be informed** To know what personal data is collected, for what purposes, and with whom it is shared. **Right to access** To learn whether their personal data is being processed and request access to it. **Right to rectification** To correct incomplete or inaccurate data. **Right to erasure (right to be forgotten)** To request deletion of personal data when it is no longer needed or if consent is withdrawn. **Right to restrict processing** To request limitations on data use in certain circumstances. **Right to object** To object to processing, including profiling or marketing. **Right to data portability** To request transfer of data to another controller, where feasible. **Right to withdraw consent** To withdraw previously given consent to processing at any time. **Right to lodge a complaint** To file a complaint with the Information and data Protection Commission if they believe their data rights have been violated. ### Why cookies as part of Botswana data privacy compliance Cookies and tracking technologies are considered personal data processing under Botswana’s DPA when they identify or can be linked to a user. - **Essential cookies** (necessary for site functionality) may not require consent. - **Non-essential cookies** (analytics, advertising, personalization) require **explicit opt-in consent.** Websites must provide a clear cookie policy, allow users to withdraw consent at any time, and ensure consent logs are properly maintained. ### Penalties for DPA Botswana non-compliance The Information and Data Protection Commission can impose penalties for violations. These could include: - **Administrative fines** (up to BWP 1,000,000 depending on severity of breach) - **Orders to suspend or restrict processing activities** - **Mandatory deletion** of unlawfully processed data - **Corrective actions** and monitoring Non-compliance risks both financial penalties and loss of customer trust. ### How to comply with DPA Botswana To prepare your business for compliance: **Audit:** Identify all cookies and trackers on your site. **Categorize:** Organize cookies into categories (necessary, preferences, analytics, marketing). **Implement consent management:** Deploy consent banners, allow easy withdrawal, and log consent activity. **Review partners and vendors:** Ensure all third-party tools and platforms are compliant. **Train employees:** Build awareness of compliance requirements and internal policies. #### Frequently Asked Questions **What is the scope of Botswana’s Data Privacy Law?** The Act regulates the processing of personal data by individuals and organizations in Botswana. It protects individuals’ privacy rights when their data is collected, used, stored, or transferred. **What is personal data under the law?** Any information that relates to an identified or identifiable individual. This includes names, IDs, contact details, financial data, or any data that can directly or indirectly reveal someone’s identity. **What is sensitive personal data?** Sensitive data includes information on race, religion, political beliefs, union membership, health, sexual life, biometric or genetic identifiers, and criminal records. Processing such data requires heightened safeguards and explicit consent. **Who is the regulatory authority in Botswana?** A dedicated Information and Data Protection Commission (IDPC) is the independent regulator responsible for monitoring compliance, issuing guidance, and enforcing the law. **Who is exempt from the law?** The law does not apply to purely personal or household data processing where information is not shared with third parties or used commercially. **Where can I get more information?** Further details, guidelines, and official resources are published by the Data Protection Commission of Botswana. --- # Philippines DPA Cookie Consent and Compliance URL: https://www.cookiehub.com/dpa-philippines Last updated: June 18, 2026 ## Philippines DPA Cookie Consent and Compliance The Philippines’ Data Privacy Act of 2012 (Republic Act No. 10173) requires organizations to obtain consent before processing personal data. This includes all data collected through cookies and other tracking technologies. Are your website and apps ready for compliance? ### What your business needs to know about DPA Philippines The Data Privacy Act of 2012 (DPA)** **establishes comprehensive rules governing the collection, processing, storage, and transfer of personal data in the Philippines. The DPA seeks to balance the right to privacy with the legitimate needs of businesses and government organizations to process data and is aligned with other global data privacy regulations, such as GDPR. Under the DPA, organizations must obtain informed and explicit consent before processing personal data, unless another lawful basis applies (such as contractual necessity, legal obligation, or legitimate interest recognized under the law). Organizations are also required to: - Provide clear, accessible notices detailing why data is collected, how it will be used, and how long it will be stored. - Ensure data transfers, particularly cross-border transfers, comply with DPA safeguards and may require the National Privacy Commission (NPC)’s approval or the data subject’s explicit consent. ### What does DPA Philippines compliance require? To comply with the DPA, businesses must review how they collect, process, and store personal data. A compliant setup typically includes: **Use cookie banners:** A cookie banner that clearly explains cookie categories and purposes. **Update privacy policy:** An up-to-date privacy policy that aligns with DPA principles. **Implement consent management:** Consent mechanisms that are explicit, freely given, and easy to withdraw. **Audit:** Regular audits and staff training to ensure continued compliance. **Assess third parties:** Vendor assessments for third-party analytics, marketing, or advertising tools that process user data. ### Who needs to comply with the DPA Philippines? All organizations, whether public, private, non-profit, and foreign, that process or control the personal data of individuals in the Philippines must comply with the DPA. This includes: - Local businesses and service providers. - Online platforms and e-commerce websites. - International companies targeting or serving users in the Philippines. ### Consumer rights under DPA Philippines Under the DPA, individuals (data subjects) in the Philippines are granted the following rights: **Right to be informed** To know what data is collected, for what purposes, and who it is shared with. **Right to access** To request access to their personal data held by an organization. **Right to rectification** To request correction of inaccurate or incomplete personal data. **Right to erasure (right to be forgotten)** To request deletion when processing is no longer necessary or consent is withdrawn. **Right to restrict processing** To limit data processing under certain conditions. **Right to object** To object to processing, including for direct marketing or profiling. **Right to data portability** To request their data be transferred to another controller, where technically feasible. **Right to compensation** To seek damages for unlawful processing or data breaches. ### Why cookies as part of DPA Philippines compliance Cookies and similar tracking technologies are considered personal data processing under the DPA when they identify, or can reasonably identify, an individual. - Essential cookies necessary for website functionality may not require consent. - Non-essential cookies, such as analytics, advertising, or personalization cookies, do require explicit opt-in consent**.** Websites must: - Provide a clear cookie notice or policy explaining types and purposes of cookies. - Obtain and record explicit consent before using non-essential cookies. - Allow users to change or withdraw consent easily at any time. ### Penalties for DPA Philippines non-compliance The National Privacy Commission (NPC) can impose significant penalties for non-compliance with the DPA. Sanctions may include: - Administrative fines, which vary depending on the severity and nature of the violation. - Orders to suspend or stop data processing activities**.** - Deletion of unlawfully processed data and other corrective measures. Beyond financial penalties, non-compliance can result in severe reputational damage, loss of customer trust, and potential criminal liability for willful violations. ### How to comply with the DPA Philippines To check your compliance with the DPA Philipines, businesses should: **Audit:** Audit all cookies and trackers used on their websites. **Categorize:** Categorize cookies (e.g., necessary, preferences, analytics, marketing). **Implement consent:** Implement and test cookie consent banners for functionality and clarity. **Keep logs:** Keep detailed consent logs and make withdrawal simple and transparent. **Review third-party tools:** Review third-party tools to ensure their compliance with the DPA. **Train employees:** Train employees on data protection responsibilities and best practices. #### Frequently Asked Questions **What is the scope of the Data Privacy Act (DPA) in the Philippines?** The Data Privacy Act of 2012 (Republic Act No. 10173) governs the collection, processing, storage, and use of personal data in the Philippines. It applies to both public and private sector organizations that control or process personal information, whether the data is processed in the Philippines or abroad, as long as the individual is a Philippine citizen or resident. The law ensures that individuals’ privacy rights are protected and establishes principles of transparency, legitimate purpose, and proportionality in handling personal data. **What is personal data under the Philippines’ Data Privacy Act?** Under the DPA, personal data refers to any information, whether recorded or not, that can identify an individual, either directly or indirectly. This includes: - **Personal information** – data that can identify a person, such as name, address, phone number, email, or government-issued ID number. - **Sensitive personal information** – data that can be used to discriminate against or harm an individual, such as race, ethnic origin, marital status, age, health records, education, genetic or sexual life, social security numbers, or government-issued identifiers. - **Privileged information** – any data covered by attorney-client privilege or similar protected relationships. **What is sensitive personal information according to the DPA?** Sensitive personal information includes data that is more private in nature and requires stricter protection. Examples include: - Race, ethnic origin, or religious or political affiliations - Health, education, or genetic data - Sexual life or orientation - Social security numbers and other government-issued identifiers (e.g., passport or driver’s license numbers) - Data issued by government agencies that are unique to an individual (such as SSS, GSIS, or PhilHealth numbers) The processing of sensitive personal information generally requires explicit consent from the data subject, except in specific cases allowed by law. **Who is the regulatory authority for the Philippines’ Data Privacy Act?** The National Privacy Commission (NPC) is the independent government agency tasked with implementing and enforcing the Data Privacy Act. The NPC: - Monitors compliance with the law and its implementing rules - Investigates complaints and data breaches - Issues advisory opinions and compliance orders - Promotes public awareness of data protection rights and obligations **Who is exempt from the DPA rules?** Certain processing activities are exempt from the Data Privacy Act, including: - Data used for personal, family, or household affairs that are not publicly available - Information necessary for journalistic, artistic, or literary purposes in order to uphold freedom of expression - Data processed for research or statistical purposes, provided they are not used to make decisions about individuals - Data processed for information required by law or for legal proceedings - Information necessary for national security, public order, or law enforcement purposes These exemptions are limited and subject to conditions defined by the NPC. **Where can I get more information about the Data Privacy Act?** You can visit the National Privacy Commission (NPC) website for official guidelines, advisories, compliance tools, and updates related to the Data Privacy Act. --- # India DPDP Cookie Consent and Compliance URL: https://www.cookiehub.com/dpdp Last updated: June 18, 2026 ## India DPDP Cookie Consent and Compliance Enacted to protect individual privacy in the digital age, India’s Digital Personal Data Protection Act (DPDP) emphasizes consent-based data processing and grants individuals rights over their personal information. Is your website ready for compliance? ### What your business needs to know about the DPDP India The Digital Personal Data Protection (DPDP) Act of 2023, is India’s landmark privacy law that governs how organizations collect, process, store, and transfer digital personal data. Under the DPDP, cookies that collect personal data—such as behavioral tracking or user profiling—fall within the scope of regulation. Organizations must obtain clear, informed, and voluntary consent from users before placing such cookies on their devices. This means displaying detailed cookie banners or pop-ups and offering granular choices regarding data collection. ### What does DPDP India compliance require? Businesses must implement robust data governance policies, appoint a Data Protection Officer (DPO) if mandated, ensure data is processed only for specified purposes, and maintain accountability through audit trails. The Act requires consent to be revocable and easily accessible, with a strong emphasis on transparency. Cross-border data transfers must comply with conditions prescribed by the central government. To be in compliance with DPDP India, businesses should: **Data governance:** Implement robust data governance policies and publish and keep up-to-date a comprehensive Privacy Policy **Consent management:** Obtain proper consent for collecting and processing personal data **Consent withdrawal mechanism:** Ensure a method for consumers to withdraw consent **Data audit:** Audit all data collection practices, including consent mechanisms, data security, third-party data sharing **Data minimization:** Adhere to data minimization principles, collecting only what data is required and using it only for the stated purposes **Implement data protection:** Secure data against breaches and unauthorized access ### Who needs to comply with the DPDP India? The DPDP applies to any entity—public or private, within or outside India—that processes the personal data of Indian citizens digitally. This includes websites, mobile apps, service providers, and multinational companies offering goods or services to individuals in India. ### Consumer rights under the DPDP India India’s DPDP gives consumers various data privacy rights, including: **Right to access** Request access to their personal information **Right to be informed** Request to know how personal data is being collected and used **Right to correction** Request that inaccurate, incomplete or out-of-date information be corrected **Right to deletion** Request the erasure of their personal information under certain circumstances **Right to object to or limit processing of data** Request to opt out of processing of their data **Right to data security** Having data protects against common issues, such as data breaches ### Why cookies as part of DPDP India compliance While the DPDP does not explicitly mention cookies and consent management in this context, cookies are central to ensuring data protection. Thus, cookies used for advertising, analytics, or profiling often collect personal data require user consent under the DPDP. Unlike functional or strictly necessary cookies, these must be opt-in rather than opt-out. Non-compliance in how cookies are used and consented to can trigger regulatory scrutiny. ### Penalties for DPDP India non-compliance Violations of the DPDP can lead to significant financial penalties. The Data Protection Board of India may impose fines of up to ₹250 crore (~30 million USD) depending on the nature and severity of the breach. Non-compliance can also lead to reputational and brand damage reputation and cause restrictions on data processing activities. ### How to comply with the DPDP India To check your compliance with the DPDP India, businesses should: **Review data practices:** Conduct a data audit to identify all cookies and trackers on their websites **Categorize cookies:** Understand what kinds of data you collect and how it must be treated, e.g., necessary, preference, analytics, marketing cookies **Implement consent management:** Ensure consent banners are implemented correctly and maintain consent logs **Check partner contracts:** Review third-party data-sharing practices **Train employees:** Ensure that employees have training to understand and comply with DPDP #### Frequently Asked Questions **What is the scope of the Digital Personal Data Protection (DPDP) law in India?** The DPDP law applies to the processing of digital personal data by government and private entities within India, as well as to entities outside India if they process data of individuals located in India. **What is personal data under India’s DPDP?** Personal data refers to any data about an individual who is identifiable, either directly or indirectly, through identifiers like name, address, phone number, or other information. **What is sensitive data according to the DPDP in India?** Sensitive personal data includes information that can significantly impact an individual's privacy, such as financial data, health records, biometric details, caste, religion, sexual orientation, and political opinions. **Who is the regulatory authority for India’s DPDP?** The Data Protection Board of India is the designated regulatory authority responsible for enforcing and overseeing compliance with the DPDP law. **Who is exempt from India’s DPDP rules?** Certain entities like the government in specific circumstances, data processed for personal or domestic purposes, and data related to national security may be exempt from some provisions of the DPDP law. **Where can I get more information about India’s Digital Personal Data Protection law?** You can visit the official website of the Ministry of Electronics and Information Technology (MeitY) or refer to the published DPDP Act and related guidelines for detailed information. --- # Delaware DPDPA Cookie Consent and Compliance URL: https://www.cookiehub.com/dpdpa-delaware Last updated: June 16, 2026 ## Delaware DPDPA Cookie Consent and Compliance The DPDPA requires businesses to implement a cookie consent mechanism—such as a banner with a preference center—to provide transparency and collect opt-ins or opt-outs for targeted advertising, data sales, profiling, and the processing of sensitive data. Are you compliant? ### What your business needs to know about DPDPA Delaware The Delaware Personal Data Privacy Act (DPDPA) was signed into law on September 11, 2023, and took effect January 1, 2025 . It’s a comprehensive state privacy law granting rights to Delaware consumers and imposing obligations on controllers/processors regarding personal data handling. ### \ What does DPDPA Delaware compliance require? Businesses should do the following to comply with DPDPA Delaware: **Update privacy policy:** Updating privacy policies with Delaware-specific disclosures. **Implement consent management:** Implement cookie consent banners and opt-out flows to obtain clear, affirmative consent **Data subject handling:** Establishing processes for handling data subject requests. **Data security:** Ensuring data security measures are in place. **Review and disclose data and cookie practices:** Disclose data handling practices, including collection, storage and sharing of cookie types, purposes, etc. Consult legal counsel and consider using a consent management platform (CMP) for ease of compliance. ### Who needs to comply with DPDPA Delaware? DPDPA Delaware applies to any controller or processor that: - Conducts business in Delaware or targets Delaware residents; **and** - In the previous year, either processed data of ≥ 35,000 consumers (excluding payment-only data) **or** processed data of ≥ 10,000 consumers and derived over 20% of gross revenue from sale of personal data . Exemptions include government bodies (excluding higher-ed), GLBAregulated financial institutions, entitylevel nonprofit carve-outs (e.g., antiinsurancefraud), as well as datalevel exemptions (HIPAAcovered info, FERPA, FCRA, DPPA, Airline Deregulation, COPPA for children under 13, etc.). ### Consumer rights under DPDPA Delaware Delaware consumers have the right to: **Right to access** Consumers can access and confirm processing of personal data **Right to correct** Consumers can request to correct inaccuracies **Right to delete** Consumers can request that their personal data be deleted **Right to data portability** Consumers have a right to port/download/transmit their information in a usable format **Right to opt-out** Consumers can opt out of the sale of personal data, targeted advertising, and profiling that produces legal/significant effect **Right to know** Consumers can obtain a list of specific third parties who received their data Additionally, controllers must respond within 45 days (with a possible 45-day extension) and provide an appeals process. ### Why cookies as part of DPDPA Delaware compliance Cookies that collect data linked to an identifiable individual—such as IP addresses, browser history, or geolocation—are considered personal information. As such, businesses must: - Disclose cookie usage (types, purposes, third parties). - Obtain clear, affirmative consent for non-essential cookies tied to targeted advertising, profiling, data sales, and processing of sensitive data. - Honor opt-outs via both on-site flows and universal preference signals by 2026. ### Penalties for DPDPA Delaware non-compliance Penalties apply for DPDPA non-compliance, which are enforced by the Delaware Department of Justice: - Up to 10,000 USD per violation. - Enforcement includes a 60-day cure period (in effect until December 31, 2025). Post-sunset, cure is discretionary. - No private right of action—only DOJ enforcement. ### How to comply with DPDPA Delaware To check your compliance with the DPDPA, organizations should: **Audit:** Conduct a data audit to identify all cookies and trackers on their websites **Categorize:** Categorize cookies (e.g., necessary, preference, analytics, marketing) **Implement consent management:** Ensure consent banners are implemented correctly with granular choices, enable users to withdraw consent at any time, and maintain consent logs **Check third-party contracts:** Review third-party data-sharing practices #### Frequently Asked Questions **What is the scope of DPDPA Delaware?** The DPDPA covers controllers and processors doing business in Delaware or targeting its residents and meeting data volume or revenue thresholds (≥ 35k users or ≥ 10k users plus over 20% revenue from data sales). **What is personal data under DPDPA Delaware?** Any information linked or reasonably linkable to an identified or identifiable individual—excluding de-identified or publicly available info (e.g., names, emails, IPs). **What is sensitive data according to DPDPA Delaware?** Data revealing race, religion, health/medical conditions (including pregnancy), sex life/orientation (including trans/non-binary), citizenship, genetic or biometric data, precise geolocation, and personal data of a known child. **Who is the regulatory authority for DPDPA Delaware?** The Delaware Department of Justice, Consumer Protection Unit, enforces the law—there’s no private lawsuit provision. **Who is exempt from DPDPA Delaware rules?** Exemptions include state agencies (except universities), GLBA-regulated financial entities, specified nonprofits, and data already regulated under laws like HIPAA, FERPA, FCRA, COPPA, Airline Deregulation Act, DPPA, etc. **Where can I get more information about DPDPA Delaware?** Consult Delaware DOJ FAQs and statute: Delaware AG website and HB 154 in Delaware Code. --- # Rwanda DPPL Cookie Consent and Compliance URL: https://www.cookiehub.com/dppl Last updated: June 19, 2026 ## Rwanda DPPL Cookie Consent and Compliance The Data Protection and Privacy Law in Rwanda now brings the country in line with international data protection standards, vital for modern digital economies powered by e-commerce, international financial transactions, and various online services. Are you ready to comply? ### What your business needs to know about the DPPL Rwanda Rwanda’s Data Protection and Privacy Law (Law No. 058/2021 of 13 October 2021) establishes a comprehensive legal framework regulating the collection, processing, transfer, and protection of personal data. One of the tenets of the Data Protection and Privacy Law in Rwanda is the requirement to obtain the clear and unambiguous consent of an individual to collect, store, and process their personal data, which is a fundamental right. ### What does DPPL Rwanda compliance require? Businesses must undertake a number of processes to be compliant with the law in Rwanda. Among these include: **Register:** Registration with the NCSA as a data controller or processor within 30 working days **Appoint a DPO:** Appointing a Data Protection Officer (DPO) if processing is large-scale or involves sensitive data **Keep records:** Maintaining processing records, performing DPIAs for high-risk activities, and implementing security measures **Notify about breaches:** Notifying the NCSA of breaches within 48 hours as well as affected individuals as it pertains to risk to their rights. **Privacy notices:** Publishing privacy notices disclosing data use, retention, transfers abroad, subject rights Obtaining consent, including for cookies, for non-essential processing Evaluating cross-border data transfer ### Who needs to comply with the DPPL Rwanda? The law applies to: - All data controllers or processors in Rwanda (public or private) - Foreign entities processing personal data of Rwandan subjects or transferring data out of the country This includes SMEs, NGOs, public bodies, tech startups, fintechs, ecommerce platforms—any organization handling personal data of Rwandans. ### Consumer rights under the DPPL Rwanda Rwanda’s DPPL gives residents a set of data privacy rights, including: **Right to access** Request access to their personal information **Right to be informed** Request to know how personal data is being collected and used **Right to correction** Request that inaccurate, incomplete or out-of-date information be corrected **Right to deletion** Request the erasure of their personal information under certain circumstances **Right to object to or limit processing of data** Request to opt out of processing of their data **Right to data portability** Request data in a structured, commonly used format **Right to object to automated decision-making** Request that decisions not be made solely on automated processing **Right to consent** Organizations must obtain consumer consent before processing data ### Why cookies as part of DPPL Rwanda compliance Although the law doesn’t mention cookies explicitly, cookie usage falls under processing of personal data (e.g. online identifiers, profiling). Consent must be: - Freely given, specific, informed, and explicit, covering distinct purposes (e.g. analytics vs advertising) - Able to be withdrawn at any time Implementing cookie banners with granular controls (accept/decline categories) and a preferences centre — aligning with EU-style consent principles – is considered best practice for businesses operating in Rwanda. ### Penalties for Data Protection and Privacy Law Rwanda non-compliance The law outlines administrative and criminal sanctions for non-compliance: Administrative penalties (Article 53) include: - Fines between 2 million–5 million RWF (~$2 000–5 000 USD) or up to 1% of global annual turnover for corporations Criminal offences (Articles 56–61) include: - Intentional data misuse, unauthorized reidentification, false info, mishandling sensitive data: 1–3 years imprisonment and fines from 7 million–10 million RWF (or 5% of global turnover for entities) Courts may also impose business closures or revoke registration certificates. ### How to comply with the DPPL Rwanda DPPL compliance is within reach by implementing a number of data privacy best practices: **Conduct data and cookie audits:** Review current data practices to identify areas for aligning with the DPPL **Update privacy and cookie policies:** Revise privacy notices to clearly outline data practices, consumer rights, and how to exercise those rights **Implement consent management:** Manage cookie use and consent with a comprehensive consent management platform like CookieHub **Educate employees:** Give employees training on the importance of compliance with DPPL **Implement breach processes:** Ensure clear pathways for notifying consumers about data breaches **Assign a privacy officer:** Add a privacy officer to your organization to manage compliance #### Frequently Asked Questions **What is the scope of the Data Protection and Privacy Law in Rwanda?** The Data Protection and Privacy Law (DPPL) in Rwanda governs the collection, processing, storage, and sharing of personal data. It applies to both public and private entities that handle personal data of individuals in Rwanda, as well as organizations outside Rwanda that process data of Rwandan residents. The law ensures that personal data is handled lawfully, fairly, and transparently. **What is personal data under Rwanda’s DPPL?** Personal data is any information relating to an identified or identifiable natural person. This includes, but is not limited to, names, identification numbers, location data, online identifiers, or any data that can directly or indirectly identify an individual. **What is sensitive data according to the DPPL in Rwanda?** Sensitive data refers to a special category of personal data that requires enhanced protection. This includes information related to racial or ethnic origin, political opinions, religious or philosophical beliefs, health status, genetic or biometric data, sexual orientation, or trade union membership. **Who is the regulatory authority for Rwanda’s DPPL?** The regulatory authority responsible for overseeing the implementation and enforcement of the DPPL in Rwanda is the National Cyber Security Authority (NCSA), particularly through its Data Protection Office. **Who is exempt from Rwanda’s DPPL rules?** Exemptions to the DPPL may apply in certain cases, such as processing for personal or household activities, national security, law enforcement, public interest, or research and statistical purposes—provided appropriate safeguards are in place. Specific exemptions are defined in the law and relevant regulations. **Where can I get more information about Rwanda’s Data Protection and Privacy Law?** You can access the full text of the DPPL and related guidelines through the [National Cyber Security Authority (NCSA)](https://cyber.gov.rw/) website or consult legal professionals specializing in data protection in Rwanda. --- # Kuwait DPPR Cookie Consent and Compliance URL: https://www.cookiehub.com/dppr Last updated: June 18, 2026 ## Kuwait DPPR Cookie Consent and Compliance While not a comprehensive data privacy law in the same sense as GDPR, Kuwait’s Personal Data Privacy Protection Regulation requires organizations to obtain consent before processing personal data, including cookies and other tracking technologies. Is your website ready for compliance? ### What your business needs to know about the Kuwait’s DPPR Kuwait’s Personal Data Privacy Regulation sets out rules for the collection, processing, storage, and transfer of personal data. Similar in scope to other regional data protection frameworks, the law aims to protect individuals’ fundamental right to privacy while ensuring data is used lawfully by businesses. And it is set to be expanded in the near future. Organizations must obtain explicit consent before processing personal data unless a lawful basis applies (such as legal obligations, the performance of a contract, or legitimate interest as defined under the law). They must provide clear privacy notices that explain why data is collected, how it will be used, and how long it will be retained. Cross-border data transfers are subject to strict conditions and may require either explicit consent from the data subject or approval from Kuwait’s data protection authority. ### What does DPPR Kuwait compliance require? To check compliance with PDPR, your organization should: **Conduct a data review:** Map out how your business collects, processes, and stores personal data. **Implement consent management:** Ensure your cookie banner, privacy policy, and consent mechanisms are transparent and compliant. **Keep records:** Maintain up-to-date documentation and carry out regular audits. **Train staff:** Educate employees about the law’s requirements and responsibilities **Complete vendor checks:** Verify that partners and third-party providers (such as analytics and marketing platforms) comply with Kuwait’s law. ### Who needs to comply with the Kuwait’s data privacy law? All organizations—public, private, non-profit, and foreign companies—that process the personal data of individuals in Kuwait must comply. This applies to local businesses, online platforms, and international service providers targeting Kuwaiti residents. ### Consumer rights under DPPR Kuwait Under the law, individuals (data subjects) in Kuwait have the following rights: **Right to be informed** To know what personal data is collected, for what purposes, and with whom it is shared. **Right to access** To learn whether their personal data is being processed and request access to it. **Right to rectification** To correct incomplete or inaccurate data. **Right to erasure (right to be forgotten)** To request deletion of personal data when it is no longer needed or if consent is withdrawn. **Right to restrict processing** To request limitations on data use in certain circumstances. **Right to object** To object to processing, including profiling or marketing. **Right to data portability** To request transfer of data to another controller, where feasible. **Right to compensation** To seek damages for unlawful data processing. ### Why cookies as part of Kuwait data privacy compliance Cookies and tracking technologies are considered personal data processing under Kuwait’s law when they identify or can be linked to a user. - **Essential cookies** (necessary for site functionality) may not require consent. - **Non-essential cookies** (analytics, advertising, personalization) require **explicit opt-in consent.** Websites must provide a clear cookie policy, allow users to withdraw consent at any time, and ensure consent logs are properly maintained. ### Penalties for DPPR Kuwait non-compliance The Kuwaiti data protection authority can impose substantial administrative fines for violations. Penalties will vary based on the nature and severity of the breach and may include: - Monetary fines - Orders to suspend data processing activities - Deletion of unlawfully processed data - Corrective actions and ongoing oversight Non-compliance risks not only financial consequences but also significant reputational damage. ### How to comply with the DPPR Kuwait To prepare your business for compliance: **Audit:** Identify all cookies and trackers on your site. **Categorize:** Organize cookies into categories (necessary, preferences, analytics, marketing). **Implement consent management:** Deploy consent banners, allow easy withdrawal, and log consent activity. **Review partners and vendors:** Ensure all third-party tools and platforms are compliant. **Train employees:** Build awareness of compliance requirements and internal policies. #### Frequently Asked Questions **What is the scope of Kuwait’s Data Privacy Law?** The law regulates the processing of personal data by individuals and organizations in Kuwait. It protects individuals’ privacy rights when their data is collected, used, stored, or transferred. **What is personal data under the law?** Any information that relates to an identified or identifiable individual. This includes names, IDs, contact details, financial data, or any data that can directly or indirectly reveal someone’s identity. **What is sensitive personal data?** Sensitive data includes information on race, religion, political beliefs, union membership, health, sexual life, biometric or genetic identifiers, and criminal records. Processing such data requires heightened safeguards and explicit consent. **Who is the regulatory authority in Kuwait?** A dedicated Data Protection Authority (to be formally established under the law) will oversee compliance, issue guidance, and enforce penalties. **Who is exempt from the law?** The law does not apply to data processed by individuals for purely personal or household activities, as long as the data is not shared or used for professional/commercial purposes. **Where can I get more information?** Further details, guidelines, and official resources will be made available by Kuwait’s Data Protection Authority once established. --- # ePrivacy Directive & Cookie Consent Compliance | Understand EU Cookie Law URL: https://www.cookiehub.com/eprivacy-directive Last updated: September 24, 2026 ## ePrivacy Directive, cookie consent and compliance The ePrivacy Directive (ePD) is a European data privacy and protection directive that regulates cookie use, data minimization and email marketing. The ePrivacy Directive is informally referred to as the “cookie law” – and that’s where you need to be compliant. ### What your business needs to know about the ePrivacy Directive The ePrivacy Directive is a set of rules that address data privacy and protection in the European Union. Much like GDPR, which also governs data privacy protection for European citizens, the directive requires user consent before cookies can be used. The GDPR extends this by defining cookies as a way to obtain personal data (which – again – requires explicit, unambiguous and informed consent). Unlike a regulation such as the GDPR, the ePrivacy Directive does not apply directly: it is binding on EU member states, which implement it through their own national laws on data privacy and electronic communications. ### What does ePrivacy Directive compliance require? First of all, the ePrivacy Directive does not apply directly to businesses. It is binding on EU member states, which must transpose it into their own national laws, and it is those national laws that businesses must comply with. An example here is France’s CNIL, the data privacy regulator, which has been aggressive about pursuing and fining violators of data privacy regulations. Organizations that adhere to GDPR should be on the right side of safeguarding user privacy, but it is important to note that the ePD aims to: **Prevent unlawful data capture and interactions:** Do not intercept, store, monitor, scan or surveil electronic communications unless the users concerned have consented. **Track only with explicit consent:** Only use cookies and similar tracking technologies for non-essential purposes after the user has given explicit, specific consent. **Get consent for data access:** Only access information stored on a user’s device with their consent, unless it is strictly necessary for the service they requested. **Prevent unsolicited communication:** Do not send unsolicited emails, texts, automated calls or other electronic communications (“spam”) to people who have not agreed to receive them. **Avoid unconsented processing of metadata:** Only process metadata from electronic communications, such as location data or recipient data, with the user’s consent or another legal right to do so. ### Who needs to comply with the ePrivacy Directive? The directive is applicable to any organization that processes personal data from EU residents or provides digital communications services. This could include: - Any business (worldwide) that processes personal data of EU residents, engaged in digital marketing, cookie-based tracking, or any other tracking methods to collect personal data of users - Third parties using tracking technologies - Website owners and operators who use tracking technologies - Communications service providers, such as internet companies, telephone operating companies, and so on, which enable personal data collection ### Consumer rights under the ePrivacy Directive The ePrivacy Directive, intersecting as it does with the GDPR, confers a number of similar data privacy rights to consumers, including: **Right to information** Consumers can expect to be informed about what data is collected, why and by whom, typically in the form of cookie banners and privacy notices **Right to consent** Consumers must give informed and explicit consent before any non-essential cookies or similar tracking technologies are used **Right to withdraw consent** Consumers may refuse or withdraw consent at any time **Right to privacy in communications** Consumers are entitled to confidentiality of communications, including protection against interception or surveillance of communication or unauthorized data retention **Right to control device storage and access** Consumers have control over any attempt to store information or access information on their devices, such as cookies, local storage or tracking pixels **Right to protection against unsolicited communication** Consumers have the right not to receive unsolicited marketing communications, such as emails, SMS, etc. ### Why cookies as part of ePrivacy Directive compliance Dubbed the “cookie law”, the ePrivacy Directive is one of the main reasons cookie banners appear on most websites, prompting users to consent to opting in or out of cookie use. The directive requires that websites get user consent before storing cookies in a user’s browser unless for strictly functional cookies that are required for the website to work. This consent-gathering practice also requires that users be informed of the cookies’ purpose(s) before consenting to their use. ### Penalties for ePrivacy Directive non-compliance Penalties for violating parts of the ePD are indirect in that they are imposed by the data protection regulators of each EU member state. Many fines have been issued for cookie consent breaches. The fines issued mirror those of the GDPR, and individuals adversely affected by violations have the right to compensation from the offending organization. ### How to comply with the ePrivacy Directive **Review data practices:** Review which cookies, trackers and third-party services your website uses and why, and document the purpose of each **Respect user consent rights to choose and withdraw:** Obtain explicit, prior consent for non-essential cookies and tracking, give users the ability to make granular choices about accepting and rejecting cookies, and let them withdraw consent at any time **Provide accessible information:** Explain what data is being collected, how it will be used and shared, and with whom **Ensure partner and third-party compliance:** Check that third parties and partners are also compliant with the directive #### Frequently Asked Questions **What is the scope of the European ePrivacy Directive (ePD)?** The ePrivacy Directive (also known as the "Cookie Law") governs the processing of personal data and the protection of privacy in electronic communications. It covers areas such as confidentiality, tracking technologies (like cookies), unsolicited communications (spam), and data retention by telecom providers. It applies to businesses offering electronic communication services within the EU. **What is personal data under the ePD?** Personal data refers to any information that can identify an individual, either directly or indirectly. This includes names, email addresses, IP addresses, phone numbers, and even online identifiers that can be traced back to a person. **What is sensitive data according to the ePD?** While the ePD itself doesn't define "sensitive data" explicitly, it complements the General Data Protection Regulation (GDPR), which defines sensitive data as information revealing racial or ethnic origin, political opinions, religious beliefs, health status, sexual orientation, and more. If such data is processed via electronic communications, the ePD’s provisions may also apply. **Who is the regulatory authority for Europe’s ePD?** Each EU member state enforces the ePD through its national Data Protection Authority (DPA). These authorities monitor compliance, handle complaints, and may impose sanctions. The European Data Protection Board (EDPB) provides guidance and coordination across the EU. **Who is exempt from ePD rules?** Some exceptions apply, such as when cookies are strictly necessary for providing a service explicitly requested by the user (e.g., items in a shopping cart). Law enforcement or national security activities may also be exempt from certain provisions. **Where can I get more information about the European ePrivacy Directive?** You can find official information on the European Commission’s [ePrivacy Directive page](https://digital-strategy.ec.europa.eu/en/policies/eprivacy-directive), or consult your national Data Protection Authority’s website for localized guidance. --- # EU AI Act Compliance: Consent, Cookies & Legal Obligations URL: https://www.cookiehub.com/eu-ai-act Last updated: September 24, 2026 ## The European Union AI Act, consent and compliance The EU Artificial Intelligence Act (AI Act) is the European Union’s first comprehensive legal framework for regulating how artificial intelligence (AI) is used. Transparency and risk management are central to the AI Act; consent comes from the GDPR and the ePrivacy rules where AI systems process personal data or use cookies. AI systems that use biometric identification, emotion recognition, or profiling must inform the people affected, and where personal data is processed, need a lawful basis under GDPR, such as consent. Are you ready for the AI Act? ### What your business needs to know about the EU AI Act Adopted in 2024, the AI Act classifies AI systems into four categories based on risk: unacceptable, high, limited, and minimal. The Act aims to ensure AI systems are safe, transparent, and respect fundamental rights, particularly those related to data privacy. High-risk systems face stricter requirements, meaning that they demand risk assessments, documentation, and human oversight. Some practices, such as social scoring and real-time biometric identification in public spaces, are completely prohibited. ### What does EU AI Act compliance require? Businesses that develop, distribute, or use AI in the EU need to take note of several key points: **Oversight:** High-risk systems (e.g. in hiring, education, law enforcement) require strict oversight **Documentation:** Detailed technical documentation and conformity assessments are required **Transparency:** AI systems that interact with humans or use biometric data must include transparency notices **Global application:** The Act applies globally—if your system impacts EU residents, compliance is mandatory ### Who needs to comply with the EU AI Act? The following entities must comply with the AI Act: - AI system providers operating in or targeting the EU - Deployers of AI systems within the EU - Distributors and importers placing AI systems on the EU market - Non-EU businesses whose AI systems affect EU users This includes startups, SMEs, and global corporations across industries. ### Consumer rights under the EU AI Act The EU AI Act intersects with data privacy laws like GDPR and thus confers a number of data privacy rights to consumers, including: **Right to transparency** Consumers can expect to be informed when interacting with an AI system **Right to human oversight** Consumers can expect that there is human oversight monitoring AI systems and human intervention is possible **Right to data privacy and protection** Consumers’ data is covered by GDPR, which extends to AI use **Right to non-discrimination** Consumers can expect that AI decisions are fair and that they are protected from algorithmic discrimination **Right to contest automated decisions** Consumers are entitled to challenge automated decisions and request human review **Right to safety and risk mitigation** Consumers have a right to expect that AI systems have undergone risk assessments for safety and reliability ### Why cookies as part of EU AI compliance While the AI Act doesn’t directly regulate cookies, if cookie data is used for profiling or AI-driven decision-making, it can fall under the regulation: - You must disclose AI-driven personalization or profiling based on cookie data - Collecting data via non-essential cookies requires consent under the ePrivacy rules, and processing biometric or other sensitive data requires explicit consent (or another Article 9 GDPR condition) – requirements of EU data protection law, not of the AI Act itself - Make sure AI models using cookie data are auditable and transparent ### Penalties for EU AI Act non-compliance Penalties under the AI Act can be substantial: - Up to 35 million EUR or 7% of global annual revenue, whichever is higher, for violations of prohibited practices - Up to 15 million EUR or 3% of global annual revenue, whichever is higher, for non-compliance with high-risk obligations - Lesser fines can be imposed for issues such as documentation errors or lack of cooperation Regulators can also suspend system deployment or require product recalls for non-compliant systems. ### How to comply with the EU AI Act To assess your compliance with the AI Act: **Review data practices:** Determine if your AI systems are used within the EU or affect EU residents **Assess risk:** Classify each system according to its risk level **Implement governance:** Implement proper documentation, data governance, and human oversight **Adopt a CMP:** Use third-party tools and official EU checklists to assess your readiness **Add human oversight:** Designate internal compliance officers where necessary #### Frequently Asked Questions **What is the scope of the European Union AI Act?** The EU AI Act applies to providers, users, importers, and distributors of artificial intelligence systems that are placed on the EU market, used within the EU, or impact people in the EU—even if the developer is located outside the EU. It classifies AI systems by risk level (unacceptable, high, limited, and minimal) and sets corresponding regulatory obligations. **What is personal data under the EU AI Act?** Personal data refers to any information that relates to an identified or identifiable individual, as defined under the EU General Data Protection Regulation (GDPR). This includes names, email addresses, biometric data, and other information that could directly or indirectly identify a person. **What is sensitive data according to the EU AI Act?** Sensitive data includes special categories of personal data under GDPR, such as racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, biometric data for identification, health data, and data concerning a person’s sex life or sexual orientation. AI systems processing this type of data face stricter requirements. **Who is the regulatory authority for Europe’s AI Act?** The EU AI Act establishes a European Artificial Intelligence Board to coordinate enforcement across the EU. Each member state will designate one or more national supervisory authorities responsible for enforcing the AI Act within their territory. **Who is exempt from EU AI Act rules?** Certain AI systems are exempt, including those used exclusively for military, defense, or national security purposes. Research and development activities not placed on the market or used in real-world applications may also be excluded, provided they meet specific conditions. **Where can I get more information about the European Union AI Act?** You can learn more by visiting the official European Commission website or reviewing the full text of the AI Act. Legal advisories, compliance organizations, and national data protection authorities also provide guidance and updates on implementation. --- # EU Data Act Compliance & Consent: What Your Business Needs to Know URL: https://www.cookiehub.com/eu-data-act Last updated: September 24, 2026 ## EU Data Act consent and compliance Unlike the GDPR, which focuses on personal data, the EU Data Act primarily targets non-personal data. However, user consent remains critical, especially when data overlaps with personal identifiers. ### What your business needs to know about the EU Data Act The EU Data Act (Regulation (EU) 2023/2854), adopted in late 2023, in force since 11 January 2024 and applicable since 12 September 2025, is a key legislative component of the European Union’s broader data strategy. It regulates access to and use of non-personal data generated by connected devices (IoT), services, and products within the EU. The Act is designed to prevent consumer lock-in, whereby manufacturers and service providers retain control over data generated by connected devices. The idea is to promote competition and better service for consumers, which also involves protecting consumers’ data and right to consent to how it is used. ### What does EU Data Act compliance require? Ultimately the Act is about sharing data. But another aspect of this fair access data-sharing mandate is safeguarding user consent around any personally identifying data. Businesses are required to implement mechanisms to keep users informed and to obtain their consent. Compliance involves putting contractual, technical, and organizational measures in place to allow fair, secure, and interoperable data sharing and to document how this data, and consent, is managed. To ensure compliance: **Contract review:** Review all contracts involving data sharing, particularly with third parties or across jurisdictions **Data review:** Assess your data collection methods: Is data generated by devices shared transparently? **Assess access and portability:** Implement data portability and access mechanisms as outlined in the Act **Check data governance:** Evaluate your internal data governance policies and align them with the Act’s interoperability, security, and transparency requirements **Monitor consent status:** Continue to ensure that user consent is secured and auditable ### Who needs to comply with the EU Data Act? Both EU and non-EU companies must comply with the EU Data Act if they offer services or products within the EU market. The Act applies to: - Manufacturers of connected products and digital services - Users of connected/IoT products within the EU - Data holders (entities that control access to data) - Public sector bodies requesting data in emergencies or for public interest use ### Consumer rights under the EU Data Act The EU Data Act confers a number of data privacy rights to consumers, including: **Right to access** Consumers can access data generated by their connected products and services **Right to share** Consumers can share data with any third party of their choosing, excluding gatekeepers as defined by the Digital Markets Act (DMA) **Right to data portability** Consumers’ data can be ported to new providers **Right to protection against unfair contract terms** Consumers are protected against unfair contract terms related to data access, use, liability and remedies **Right to transparency** Consumers are entitled to transparency in data use and porting **Right to interoperability** Consumers have a right to harmonized standards or common specifications to avoid technical or contractual lock-in ### Why cookies as part of EU Data Act compliance While cookies fall under the ePrivacy Directive and GDPR, the EU Data Act could indirectly affect cookie use, especially when cookie-collected data is integrated with non-personal data from connected devices. Businesses should evaluate how cookies and tracking technologies contribute to broader data ecosystems and ensure transparency in their use, especially when aggregating data for analytics or service improvements. ### Penalties for EU Data Act non-compliance While each EU member state will designate supervisory authorities, penalties for non-compliance can include: - Administrative fines - Contractual liability - Exclusion from public contracts - Reputational damage ### How to comply with the EU Data Act Compliance with the EU Data Act can be achieved by taking a few key actions: **Review data practices for consent:** Ensure that you obtain explicit, informed consent before storing or accessing non-essential cookies. **Provide clear choices:** Allow users to accept or reject different categories of cookies without influencing their choice and make consent withdrawal transparent. **Provide clarity about data collection:** Ensure that users are aware of data being collected and how it is being used. **Implement consent management:** Platforms like CookieHub provide an easy way to manage consumer consent for data processing. #### Frequently Asked Questions **What is the scope of the European Union Data Act?** The EU Data Act establishes a framework for fair access to and use of non-personal data generated by connected products and related services across the EU. It applies to businesses, public sector bodies, and users of connected devices, ensuring data can be accessed and shared in a secure, competitive, and transparent environment. **What is personal data under the EU Data Act?** While the EU Data Act focuses on non-personal data, it acknowledges the General Data Protection Regulation (GDPR) as the main legal framework for personal data. Personal data refers to any information that can directly or indirectly identify an individual, such as names, identification numbers, location data, or online identifiers. **What is sensitive data according to the EU Data Act?** The EU Data Act does not redefine "sensitive data" but respects existing data protection laws. Under the GDPR, sensitive data includes information such as racial or ethnic origin, political opinions, religious beliefs, genetic data, biometric data, health information, and data concerning a person’s sex life or sexual orientation. **Who is the regulatory authority for Europe’s Data Act?** The enforcement of the EU Data Act is the responsibility of national authorities designated by each EU member state. These authorities will coordinate with the European Commission and other relevant EU bodies to ensure uniform application and compliance. **Who is exempt from EU Data Act rules?** Micro and small enterprises (those with fewer than 50 employees and annual turnover or balance sheets below €10 million) are generally exempt from certain obligations of the Data Act, unless they are in contractual relationships with larger companies or are part of larger enterprise groups. **Where can I get more information about the European Union Data Act?** You can find more details on the [European Commission’s official website](https://ec.europa.eu/info/law/law-topic/data-protection/eu-data-act_en), including the full text of the regulation, explanatory documents, and updates on implementation. You may also consult national data authorities for country-specific guidance. --- # Switzerland FADP Cookie Consent and Compliance URL: https://www.cookiehub.com/fadp Last updated: June 16, 2026 ## Switzerland FADP Cookie Consent and Compliance The Federal Act on Data Protection (FADP) is Switzerland’s data privacy law designed to protect the personal data of individuals and regulate how businesses collect, process, and store that data. Is your website ready for consent management requirements? ### What your business needs to know about the FADP The FADP is the federal data privacy law in Switzerland. The revised FADP, which came into effect on September 1, 2023, aligns more closely with the EU’s GDPR and strengthens the rights of individuals while increasing obligations for organizations. ### What your business needs to know about the FADP The FADP is the federal data privacy law in Switzerland. The revised FADP, which came into effect on September 1, 2023, aligns more closely with the EU’s GDPR and strengthens the rights of individuals while increasing obligations for organizations. The FADP is the federal data privacy law in Switzerland. The revised FADP, which came into effect on September 1, 2023, aligns more closely with the EU’s GDPR and strengthens the rights of individuals while increasing obligations for organizations. If your company handles the personal data of individuals in Switzerland—whether you’re based in Switzerland or abroad—you must comply with the FADP. The revised law introduces stricter requirements around data security, transparency, and individual rights, including: **Purpose specification:** Clear communication about how data is used **Privacy by design:** Build with privacy as the default **Breach notification:** Data breach notification within a reasonable timeframe **Recordkeeping:** Maintaining a record of processing activities (RoPA) **Data protection and risk assessment:** Carrying out Data Protection Impact Assessments (DPIAs) where needed ### Who needs to comply with the FADP? The FADP applies to all businesses that process personal data of individuals located in Switzerland, regardless of where the company is based. This includes: - Swiss-based businesses - International companies offering goods/services in Switzerland - Third-party data processors handling Swiss data If your website tracks users or processes customer data in any way, you are likely subject to FADP compliance. ### Consumer rights under the FADP The FADP gives consumers in Switzerland various data privacy rights, including: **Right to information** Request to be informed about how personal information is being collected, processed, used and shared; this also includes the right to access **Right to correction and/or erasure** Request that inaccurate, incomplete or out-of-date information be corrected or entirely deleted **Right to object** Restrict or object to the processing of personal data **Right to explanation** Request explanations regarding rules and logic behind automated decision-making **Right to data portability** Request to receive and transfer data collected **Data protection by design and by default** Organizations must consider data protection principles when designing new products and services ### Why cookies as part of FADP compliance The FADP does not include specific cookie requirements like the EU ePrivacy Directive, but transparency in data handling, including around cookies, is included. If cookies collect identifiable data, users must be informed about and consent to their use. Businesses should clearly disclose cookie usage in their privacy and cookie policies and offer users meaningful control over their preferences. Under the revised FADP, businesses must obtain valid consent before processing personal data through tracking technologies, especially for purposes like analytics, advertising, and profiling. This means: - No implied consent – users must opt-in voluntarily - Separate consents for different data processing purposes - Ability to withdraw consent at any time - Detailed information about the types of cookies in use To be compliant, companies must ensure that their cookie banners and consent mechanisms are transparent, user-friendly, and legally valid under the FADP. ### Penalties for FADP non-compliance The revised FADP introduces stricter penalties, including: - Fines of up to 250,000 CHF for individuals (e.g., company executives) - Possible criminal liability for intentional breaches - Reputational damage and loss of consumer trust Non-compliance can have serious consequences, especially for businesses that process large volumes of data or rely heavily on user tracking. ### How to comply with the FADP Some best practices to bring your data privacy approach in line with FADP compliance include: **Audit:** Conduct a data audit to identify all cookies and trackers on their websites **Categorize:** Categorize cookies (e.g., necessary, preference, analytics, marketing) **Implement consent management:** Ensure consent banners are implemented correctly, allow users to withdraw consent any time, and maintain consent logs **Check partner contracts:** Review third-party data-sharing practices **Train staff:** Ensure that employees have training to understand and comply with FADP #### Frequently Asked Questions **What is the scope of the Federal Act on Data Protection (FADP)?** The FADP regulates the processing of personal data by private individuals, companies, and federal authorities in Switzerland. It aims to protect the privacy and fundamental rights of individuals when their data is collected, stored, used, or shared. **What is personal data under the FADP?** Personal data refers to any information relating to an identified or identifiable natural person. This includes data such as names, addresses, identification numbers, online identifiers, or any other information that can directly or indirectly reveal someone’s identity. **What is sensitive data according to the FADP?** Sensitive data includes personal information that reveals racial or ethnic origin, political opinions, religious or philosophical beliefs, health status, sexual orientation, or trade union membership. It also covers genetic data and biometric data used for identification. **Who is the regulatory authority for Switzerland’s FADP?** The Swiss Federal Data Protection and Information Commissioner (FDPIC) is the supervisory authority responsible for overseeing compliance with the FADP. **Who is exempt from FADP rules?** The FADP does not apply to data processing by Swiss cantonal authorities and private persons or companies when processing data exclusively for personal use or household activities without a professional or commercial interest. **Where can I get more information about Switzerland’s Federal Act on Data Protection?** More detailed information, guidance, and resources are available on the official website of the [Swiss Federal Data Protection and Information Commissioner](https://www.edoeb.admin.ch/) (FDPIC). --- # Stay GDPR Compliant & Manage Consent URL: https://www.cookiehub.com/gdpr Last updated: June 16, 2026 ## GDPR Cookie Consent and Compliance Offering privacy protection to people who use the web in Europe, the GDPR is global in scale because it governs how anyone – from anywhere in the world – can collect and process the personal data of individuals who live in the European Union. Are you in compliance? ### What your business needs to know about GDPR The General Data Protection Regulation (GDPR) is the European Union’s powerful data privacy and personal data protection law. Failure to comply with GDPR can result in hefty fines in addition to a loss of brand trust. One of the world’s strongest data privacy regulations, the GDPR took effect in 2018 and continues to be updated. ### What does GDPR compliance require? GDPR requires organizations to perform a number different consumer requests and data handling standards to be considered compliant. Among these are: **Fair processing of personal information:** Data collection and processing must be lawful, fair, and transparent **Legitimate purpose collection:** Personal data may only be collected for legitimate purposes at the specific time it is collected **Appoint a data controller:** A data collector must be appointed who will be responsible for demonstrating full GDPR compliance **Adhere to data collection and storage limitations:** Data minimization (collect only what is necessary) is a core proviso, and data can only be stored as long as needed for the specified purpose **Accuracy:** All data stored must be accurate and up to date **Ensure data security:** All stored data must be safeguarded with proper security, integrity and confidentiality applied ### Who needs to comply with GDPR? If your website is accessible to anyone in Europe, you need to ensure that it complies with all GDPR privacy rules. And that is not always easy. The laws are complex; they change frequently. One big example is the UK’s own GDPR rules, which replaced the EU GDPR after the UK exited the EU. While the laws remain almost identical, there are minor changes that could affect compliance. Similarly, ever since the GDPR came into force in 2018, there have been efforts to simplify it and make it easier for small and medium-sized businesses to adopt and comply with. While debate and inevitable change continue, your business can still be at risk of non-compliance while trying to figure out exactly how to implement your cookie banners and collect consent. ### Consumer rights under the GDPR Ultimately GDPR give consumers a set of actionable data-privacy rights: **The right to know** Consumers can request personal data collected about them. **The right to delete** Consumers can ask that their data be removed or deleted. **The right to opt out** Consumers can refuse data collection for profiling and targeted advertising. **The right to limit use and disclosure of sensitive personal information** Consumers can direct businesses to restrict the use of their sensitive data. **The private right of action** Consumers can take legal action against businesses if their personal information is exposed. ### Why cookies as part of GDPR compliance Cookies are a cornerstone of the GDPR and how consent is obtained and maintained. The cookie consent banner acts as a kind of gateway to websites, offering users a way to opt in or out of having their data collected. GDPR, widely considered to be one of the toughest privacy laws in the world, requires websites to do several things, and cookie consent is the first step: - Obtain informed, specific** **consent before placing any non-essential cookies - Transparently disclose categories, purposes, and retention periods of personal data - Easily allow users to withdraw consent at any time ### Penalties for GDPR non-compliance Simplifying compliance doesn’t sound like the sexiest thing in the world, but with GDPR penalties that can reach up to 20 million EUR or 4% of a company’s global annual revenue, non-compliance is no joke. GDPR is not something you can afford to ignore. Right now, in fact, your website is likely collecting personal data from cookies even if you are not aware of it. CookieHub will shine a light on everything you are not seeing and help you stay compliant in the face of regulatory complexity. ### How to comply with the GDPR Businesses can take a number of steps to help stay in compliance with the GDPR and fulfill general data privacy best practices: **Review data practices:** Conduct a comprehensive audit of your data handling practices, including collection, storage and sharing. Identify where personal data is being used and check that it complies with GDPR requirements. **Implement consent management:** Platforms like CookieHub provide an easy way to manage consumer consent for data processing. **Check partner contracts:** Review third-party service provider contracts to ensure agreements meet GDPR standards for data protection. **Update privacy policies:** Keep your privacy policy up to date and accessible, including detailed information on how data is collected, processed and shared. **Train staff:** Educate employees about GDPR and its implications, and their role in maintaining compliance. #### Frequently Asked Questions **What is the scope of GDPR?** The General Data Protection Regulation (GDPR) applies to all organizations that process the personal data of individuals in the European Union (EU), regardless of where the organization is based. This includes businesses outside the EU that offer goods or services to, or monitor the behavior of, EU residents. **What is personal data under GDPR?** Personal data refers to any information that can directly or indirectly identify an individual. This includes names, email addresses, IP addresses, phone numbers, and even data such as location or online identifiers. **What is sensitive data according to GDPR?** Sensitive data—also known as "special categories of personal data"—includes information related to racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic and biometric data, health information, and data concerning a person’s sex life or sexual orientation. **Who is the regulatory authority for GDPR enforcement?** Each EU member state has its own supervisory authority responsible for enforcing GDPR. These authorities work together through the European Data Protection Board (EDPB). For example, in Ireland, the regulatory authority is the Data Protection Commission (DPC). **Who is exempt from GDPR?** GDPR does not apply to data processing by individuals for purely personal or household activities. It also doesn’t cover data processing for national security, law enforcement, or certain public authority activities outside the scope of EU law. **Where can I get more information about GDPR?** You can find more information on GDPR from the official [European Commission GDPR portal](https://ec.europa.eu/info/law/law-topic/data-protection_en) or from your local data protection authority's website. The [European Data Protection Board (EDPB)](https://edpb.europa.eu/) also provides guidelines and updates. --- # HIPAA Compliance: Cookies, consent and managing PHI URL: https://www.cookiehub.com/hipaa Last updated: June 16, 2026 ## HIPAA Consent and Compliance While HIPAA does not explicitly reference cookies, it applies to any digital technology that collects, stores, or transmits Protected Health Information (PHI)**.** If your website uses cookies, trackers, or pixels to gather data that could identify a patient or their health information, this may fall under HIPAA. ### What your business needs to know about HIPAA The Health Insurance Portability and Accountability Act (HIPAA) is a U.S. federal law enacted in 1996 to protect individuals' health information. It establishes national standards for safeguarding Protected Health Information (PHI) and applies to covered entities and their business associates. HIPAA is enforced by the U.S. Department of Health and Human Services (HHS) and the Office for Civil Rights (OCR)**. **Organizations covered by HIPAA must ensure the** **confidentiality, integrity, and availability of all PHI they create, receive, maintain, or transmit and implement physical, administrative, and technical safeguards to protect PHI. Non-compliance can lead to significant legal, financial, and reputational consequences. ### What does HIPAA compliance require? To check your HIPAA compliance, follow these principles: **Data minimization:** Limit data sharing to the minimum necessary. **Risk assessments and training:** Conduct a HIPAA risk assessment and employee training **Secure data handling:** Implement policies in place for the secure handling and sharing of PHI and ensure proper encryption, access controls, and audit trails **Control third-party relationships:** Sign Business Associate Agreements (BAAs) with all third-party service providers handling PHI If any of these areas are lacking, your organization may be out of compliance and at risk. ### Who needs to comply with HIPAA? HIPAA applies to: - Covered entities, which include: - Healthcare providers (hospitals, clinics, doctors, dentists, etc.) - Health plans (insurers, HMOs) - Healthcare clearinghouses - Business Associates**, **which are service providers handling PHI on behalf of covered entities (e.g., billing services, cloud providers, analytics platforms). Any organization working with PHI must evaluate its HIPAA obligations. ### Consumer rights under the US’s HIPAA regulation HIPAA gives individuals the right to: **Access their health records** Consumers can access their health records. **Request corrections** Consumers can correct inaccurate health information. **Request information** Consumers can receive an accounting of disclosures. **Request restrictions** Consumers can limit the use or sharing of their health data. **Obtain data copies** Consumers can request a port/download of their data in electronic format. **File a complaint** Consumers can complain to HHS if they believe their rights have been violated. ### Why cookies as part of HIPAA compliance Consent is required for the use of technologies and tools like cookies unless for permitted operations under the law. HIPAA-covered entities must ensure that any third-party service collecting data through cookies is HIPAA-compliant and governed by a Business Associate Agreement (BAA). Cookies may become a HIPAA concern when they collect or transmit individually identifiable health information — for example: - Tracking a user’s interaction with a patient portal. - Monitoring behavior on healthcare websites where users input PHI. - Using ad trackers that gather data from pages related to diagnoses, treatments, or insurance. HIPAA requires that explicit consent and BAAs are in place when cookies are used in these contexts. De-identified cookies used for purely functional purposes (and not linked to PHI) may not fall under HIPAA—but caution is essential. ### Penalties for HIPAA non-compliance HIPAA violations can result in: - **Civil penalties** ranging from 100 to 50,000 USD per violation, up to 1.5 million USD per year for identical violations. - **Criminal penalties** including fines and imprisonment for knowingly or willfully violating HIPAA. - **Corrective action plans**, audits, and mandatory reporting. - Reputational damage and loss of trust from patients and partners. ### How to comply with HIPAA HIPAA compliance focuses on working with PHI, and any organizations working with PHI must evaluate its HIPAA obligations. While cookies and consent make up a small fraction of this due diligence, HIPAA and data privacy/cookie consent best practices should be followed including: **Audit:** Conduct a data audit to identify all cookies and trackers on their websites **Categorize:** Categorize cookies (e.g., necessary, preference, analytics, marketing) **Implement consent management:** Ensure consent banners are implemented correctly with granular choices, enable users to withdraw consent at any time, and maintain consent logs **Check third parties:** Review third-party data-sharing practices #### Frequently Asked Questions **What is the scope of HIPAA?** HIPAA governs the privacy and security of protected health information handled by healthcare organizations and their business associates across the US. **What is personal data under HIPAA?** Under HIPAA, personal data is called Protected Health Information (PHI), and includes any health-related information that can identify an individual (e.g., name, diagnosis, medical records, insurance details). **What is sensitive data according to HIPAA?** Sensitive data under HIPAA includes PHI that could be used to identify an individual, such as genetic data, biometric records, diagnoses, prescriptions, or test results. **Who is the regulatory authority for HIPAA?** The US Department of Health and Human Services (HHS) and its Office for Civil Rights (OCR) are responsible for enforcing HIPAA. **Who is exempt from HIPAA rules?** Employers (in their role as employers), educational institutions, and non-healthcare entities not handling PHI are generally exempt from HIPAA. However, if they handle PHI, even indirectly, they may fall under its jurisdiction. **Where can I get more information about HIPAA?** Visit the U.S. Department of Health and Human Services HIPAA website for official rules, compliance guides, and enforcement updates. --- # Iowa ICDPA Cookie Consent Management and Compliance URL: https://www.cookiehub.com/icdpa-iowa Last updated: April 1, 2026 ## Iowa ICDPA cookie consent and compliance Under the Iowa Consumer Data Protection Act (ICDPA), businesses must manage data privacy and consent in order to be compliant. Is your consent management ready for the challenge? ### What your business needs to know about Iowa ICDPA The Iowa Consumer Data Protection Act (ICDPA) was signed on March 29, 2023 and entered into force January 1, 2025. It empowers Iowa residents with new rights governing how their personal data is collected, used, sold, shared, and processed. ### What does Iowa ICDPA compliance require? To comply with ICPDA Iowa: **Update privacy and cookie policy:** Updating privacy and cookie policies with Iowa-specific disclosures. **Implement consent management:** Implementing cookie consent banners and opt-out mechanisms to obtain clear, affirmative consent **Data subject handling:** Establishing processes for handling data subject requests. **Data security:** Ensuring data security measures are in place. **Review and disclose data and cookie practices:** Disclose data handling practices, including collection, storage and sharing of cookie types, purposes, etc. **Response deadlines:** Responds to consumer rights requests within 90 days (plus possible 45-day extension) ### Who needs to comply with Iowa ICDPA? Compliance is required for any business that controls or processes personal data of at least 100,000 Iowa residents annually or** c**ontrols or processes data of at least 25,000 Iowa residents **and** earns over 50% of gross revenue from selling personal data. This includes companies operating in Iowa or targeting Iowa consumers—even small businesses without revenue thresholds. ### Consumer rights under Iowa ICDPA Iowa residents (consumers) gain several rights under ICDPA: **Right to access** Consumers can access and confirm processing of personal data **Right to delete** Consumers can request that their personal data be deleted **Right to data portability** Consumers have a right to port/download/transmit their information in a usable format **Right to opt-out** Consumers can opt out of the sale of some personal data Unlike some states, Iowa does **not** grant the right to correct inaccurate data or the right to opt out of profiling or targeted advertising. ### Why cookies as part of Iowa ICDPA compliance Cookies that store or collect personal data—especially for targeted advertising, sale of data, or processing sensitive info—are within the scope of ICDPA. Businesses must clearly disclose these cookies, provide options for users to opt-out of data sale or sensitive data collection, and ensure cookie banners and notices are compliant. Since cookies that collect or process personal data are regulated, your site’s cookie policy and banner must categorize cookies by type (e.g., functional, analytics, targeting), disclose their purpose, and offer opt-out choices for personal data processing or sale. Persistent consent tracking and documentation may also be needed to prove compliance. ### Penalties for Iowa ICDPA non-compliance Iowa’s ICDPA is enforced exclusively by the Iowa Attorney General. Businesses receive a written warning and 90-day cure period to fix violations. Failure to resolve issues triggers maximum fines of 7,500 USD per violation. There is no private right of action—only AG enforcement. ### How to comply with Iowa ICDPA To check your compliance with ICDPA, organizations should follow several data privacy best practices: **Audit:** Conduct a data audit to identify all cookies and trackers on their websites **Categorize:** Categorize cookies (e.g., necessary, preference, analytics, marketing) **Implement consent management:** Ensure consent banners are implemented correctly with granular choices, enable users to withdraw consent at any time, and maintain consent logs **Check third-party contracts:** Review third-party data-sharing practices #### Frequently Asked Questions **What is the scope of ICDPA Iowa?** ICDPA Iowa applies to controllers and processors that operate in Iowa or target Iowa residents, meeting thresholds: ≥ 100K residents’ data processed annually, or ≥ 25K residents’ data plus ≥ 50% of revenue derived from data sales. **What is personal data under ICDPA Iowa?** Any information that identifies, relates to, describes, or is reasonably linkable to an individual—excluding publicly available data. **What is sensitive data according to ICDPA Iowa?** Data revealing racial or ethnic origin, religious beliefs, health data, precise geolocation, biometrics, sexual orientation, etc. Requires notice and optout before processing. **Who is the regulatory authority?** The Iowa Attorney General has exclusive enforcement power, including issuing cure notices and penalties. **Who is exempt from ICDPA Iowa rules?** Exemptions from ICDPA include: - State/government entities - Entities regulated under HIPAA**, **HITECH, or GLBA - Financial institutions under GLBA - Nonprofits** **and higher education institutions **Where can I get more information about ICDPA Iowa?** Authoritative sources include the official statute (SF 262) within the Iowa legislature records. --- # Indiana INCDPA Cookie Consent and Compliance URL: https://www.cookiehub.com/incdpa-indiana Last updated: June 16, 2026 ## Indiana INCDPA Cookie Consent and Compliance Under the INCDPA, businesses must obtain **clear affirmative consent** before processing sensitive personal data—and this includes cookies that collect precise geolocation or biometric details. Consent must be documented, retractable, and tied directly to specific cookie purposes. Is your consent management aligned with best practices? ### What your business needs to know about INCPDA Indiana The Indiana Consumer Data Protection Act (INCDPA), signed on May 1, 2023, and effective from January 1, 2026, is a comprehensive state privacy law modeled after Virginia’s VCDPA. It establishes consumer data rights and controller/processor obligations. Businesses targeting Indiana residents must assess applicability, update cookie banners, refine consent mechanisms, perform DPIAs, and put strong privacy notices in place—using tools like consent management platforms to streamline compliance and reduce risk. ### What does INCDPA Indiana compliance require? To determine whether INCDPA applies, ask whether you do business in Indiana or target Indiana residents. If so, do you process personal data for ≥ 100,000 Indiana residents annually, or ≥ 25,000 residents while generating over 50% of revenue from selling their data? If yes, compliance requires that you: **Review data practices:** Map all personal and sensitive data collected (including cookies). **Implement consent management:** Review consent banners and cookie notices. **Put opt-out measures in place:** Ensure opt-out options for data sales, profiling and targeted advertising. **Provision data security:** Implement data security measures and DPIAs for high-risk activities. ### Who needs to comply with INCDPA Indiana? Controllers or processors must comply with INCDPA if: - They do business in Indiana or target its residents, and - Either process personal data of ≥ 100,000 residents/year or - Process ≥ 25,000 residents/year and derive >50% of revenue from selling personal data Exemptions include: - Governmental bodies, nonprofits, educational institutions, utilities, GLBA- or HIPAA-covered entities, employment-related data, and riverboat casinos using state-approved facial recognition. ### Consumer rights under INCDPA Indiana Indiana residents have the following rights: **Right to access** Consumers can access and confirm processing of personal data **Right to correct** Consumers can request to correct inaccuracies **Right to delete** Consumers can request that their personal data be deleted **Right to data portability** Consumers have a right to port/download/transmit their information in a usable format **Right to opt-out** Consumers can opt out of the sale of personal data, targeted advertising, and profiling that produces legal/significant effect Requests must be handled within 45 days (extendable to 90 days) and denial must allow appeal. ### Why cookies as part of INCDPA Indiana compliance Cookies that track sensitive or personal data (e.g., location, usage profiling) require explicit user consent. Even analytics cookies can fall under the law if they process personal data of enough Indiana residents. Clear cookie banners, optouts, and granular consent controls are essential. ### Penalties for INCDPA Indiana non-compliance Organizations that fail to comply with INCDPA may face penalties for non-compliance. Enforced by the Indiana Attorney General, post-cure, civil penalties can reach 7,500 USD per violation. ### How to comply with INCDPA Indiana To check your compliance INCDPA, organizations should: **Audit:** Conduct a data audit to identify all cookies and trackers on their websites **Categorize:** Categorize cookies (e.g., necessary, preference, analytics, marketing) **Implement consent management:** Ensure consent banners are implemented correctly with granular choices, enable users to withdraw consent at any time, and maintain consent logs **Check third-party contracts:** Review third-party data-sharing practices #### Frequently Asked Questions **What is the scope of INCDPA Indiana?** Applies to businesses targeting Indiana residents (or operating there) that process ≥ 100,000 consumers’ personal data, or ≥ 25,000 whose data revenue exceeds 50% of their gross revenue. Exclusions apply. **What is personal data under INCDPA Indiana?** Any information that is linked or reasonably linkable to an identified or identifiable individual—like name, email, IP address, health info, browsing behavior. **What is sensitive data according to INCDPA Indiana?** Includes data revealing race, religion, sexual orientation, citizenship, health, biometrics, precise geolocation, and known children’s data. Requires explicit opt-in consent. **Who is the regulatory authority for INCDPA Indiana?** The Indiana Attorney General, with exclusive enforcement authority and power to issue penalties after a 30-day cure notice. **Who is exempt from INCDPA Indiana rules?** Exempt entities include government agencies, nonprofits, schools, utilities, GLBA or HIPAA-regulated institutions, employer-employee data, and riverboat casinos following facial recognition rules. **Where can I get more information about INCDPA Indiana?** More information can be found by consulting Indiana Senate Bill 5 (Indiana Code § 24-15) and the Indiana Attorney General’s website for sample notices. --- # Kentucky KCDPA Cookie Consent and Compliance URL: https://www.cookiehub.com/kcpda-kentucky Last updated: June 23, 2026 ## Kentucky KCDPA Cookie Consent and Compliance Under the KCDPA, processing of sensitive personal data (e.g., precise geolocation, biometric, child data, health, etc.) requires clear, affirmative consent—for example via a cookie banner or preference center. Are you compliant? ### What your business needs to know about KCDPA Kentucky The Kentucky Consumer Data Protection Act (KCDPA), effective from January 1, 2026, is the state's first comprehensive privacy law. It imposes data governance and transparency requirements on entities doing business or targeting residents of Kentucky, designed along Virginia’s CDPA framework. Obligations under the KCDPA include data minimization, transparency, technical and organizational safeguards, nondiscrimination, prior consent for sensitive data, and DPIAs for high risk processing. ### What does KCDPA Kentucky compliance require? Take the following actions as part of KCDPA Kentucky compliance: **Update privacy policy:** Updating privacy and cookie policies covering purpose, categories, third parties and opt-out methods. **Implement consent management:** Implementing cookie consent banners and opt-out flows to obtain clear, affirmative consent, give consumers mechanisms to exercise rights, and log consent and opt-outs **Conduct assessments:** Undertake Data Protection Assessments (DPIAs) for sensitive processing, profiling, targeted ads, or data sale. **Manage third parties:** Have data processing agreements with vendors and processors. You should be taking these actions to comply with KCDPA. ### Who needs to comply with KCDPA Kentucky? Businesses conducting instate or targeting Kentucky residents. Organizations that process data of ≥ 100,000 Kentucky consumers or ≥ 25,000 and earn > 50% revenue from data sales are subject to KCDPA. Exemptions include** **government entities, GLBA regulated firms, HIPAA-covered providers, nonprofits, higher-ed institutions, small telecoms/utilities, law-enforcement-related uses, health, FERPA, FCRA and similar regulated data. ### Consumer rights under KCDPA Kentucky Kentucky consumers enjoy the right to: **Right to access** Consumers can access and confirm processing of personal data **Right to correct** Consumers can request to correct inaccuracies **Right to delete** Consumers can request that their personal data be deleted **Right to data portability** Consumers have a right to port/download/transmit their information in a usable format **Right to opt-out** Consumers can opt out of the sale of personal data, targeted advertising, and profiling that produces legal/significant effect Businesses have 45 days to comply (extendable by another 45 days). ### Why cookies as part of KCDPA Kentucky compliance Cookies may drop personal or sensitive data. Nonsensitive cookie usage (e.g., analytics) is optout permissible, but sensitive data via cookies requires explicit optin consent. ### Penalties for KCDPA Kentucky non-compliance Organizations that fail to comply with KCDPA may face penalties up to 7,500 USD per violation. There is a 30-day cure period in place, and penalties may be applied in cases where issues remain unresolved. Compliance is enforced by the Kentucky Attorney General. In Kentucky, there is no private right of action. ### How to comply with KCDPA Kentucky To check that your approach to data privacy is in line with best practices and compliant with KCDPA Kentucky, organizations should: **Audit:** Conduct a data audit to identify all cookies and trackers on their websites **Categorize:** Categorize cookies (e.g., necessary, preference, analytics, marketing) **Implement consent management:** Ensure consent banners are implemented correctly with granular choices, enable users to withdraw consent at any time, and maintain consent logs **Check third-party contracts:** Review third-party data-sharing practices #### Frequently Asked Questions **What is the scope of KCDPA Kentucky?** KCDPA applies to natural persons in individual/household contexts in Kentucky, not  to business/employment. The regulation covers controllers and processors meeting data volume or revenue thresholds and targeting Kentucky residents. **What is personal data under KCDPA Kentucky?** "Any information linked or reasonably linkable to an identified or identifiable natural person," excluding deidentified or public data. Includes names, IPs, emails, purchase history, device fingerprints. **What is sensitive data according to KCDPA Kentucky?** Sensitive data includes: racial/ethnicity, religion, health, sexual orientation, citizenship, biometric/genetic data for ID, personal data of known children, and precise geolocation (within ~533m). **Who is the regulatory authority for KCDPA Kentucky?** The Kentucky Attorney General has exclusive enforcement authority; there is no consumer private right of action. **Who is exempt from KCDPA Kentucky rules?** Exempt categories include: government, GLBA/HIPAA-regulated entities, nonprofits, higher education, small telecoms/utilities, law enforcement/fraud prevention data handlers, federal-regulated data types (health, FERPA, FCRA, etc.). **Where can I get more information about KCDPA Kentucky?** Consult the full HB 15 legislation and AG guidance for official definitions, effective dates, and compliance rules. --- # Turkey KVKK Cookie Consent and Compliance URL: https://www.cookiehub.com/kvkk Last updated: June 18, 2026 ## Turkey KVKK Cookie Consent and Compliance Turkey’s Law on the Protection of Personal Data (KVKK) no 6698 requires organizations to obtain consent before processing personal data, including cookies and other tracking technologies. Is your website ready for compliance? ### What your business needs to know about the KVKK Turkey The Law on the Protection of Personal Data (KVKK) sets out rules for the collection, processing, storage, and transfer of personal data. Modeled partly onr the EU’s GDPR, the KVKK aims to protect individuals’ fundamental rights to privacy while allowing lawful business use of data. Organizations must obtain explicit consent before processing personal data unless a lawful basis applies (such as legal obligations, performance of a contract, or legitimate interest as defined under KVKK). Organizations must provide clear notices explaining why data is collected, how it will be used, and how long it will be stored. Cross-border transfers of personal data are subject to strict controls and may require the approval of the KVKK Authority or the data subject’s explicit consent. ### What does KVKK Turkey compliance require? To check compliance with KVKK, your organization should: **Conduct a data review:** Review how your organization collects, processes, and stores personal data. **Implement consent management:** Ensure that your cookie banner, privacy policy, and consent mechanisms are clear and compliant. **Keep records:** Maintain recordkeeping and complete regular audits **Train staff:** Educate employees about KVKK and its implications **Complete vendor checks:** Ensure partners and third-party tools such as analytics or marketing platforms are compliant. ### Who needs to comply with the KVKK Turkey? All organizations—public, private, non-profit, and foreign companies—that process the personal data of individuals in Turkey must comply with KVKK. This includes local businesses, online platforms, and international service providers targeting Turkish users. ### Consumer rights under KVKK Turkey Under the KVKK, individuals (data subjects) in Turkey are granted the following rights: **Right to be informed** To know what personal data is being collected, for what purposes, and with whom it is shared. **Right to access** To learn whether their personal data is processed and to request access to it. **Right to rectification** To request corrections of incomplete or inaccurate personal data. **Right to erasure (right to be forgotten)** To request deletion of personal data if the purposes of processing are no longer valid or consent is withdrawn. **Right to restrict processing** To request limitation of processing in certain circumstances. **Right to object** To object to the processing of personal data, including for marketing or profiling purposes. **Right to data portability** To request transfer of personal data to another controller, where technically feasible. **Right to compensation** To seek compensation for damages caused by unlawful data processing ### Why cookies as part of KVKK Turkey compliance Cookies and similar tracking technologies are considered a form of personal data processing under KVKK when they identify or can be linked to an individual. Essential cookies required for website functionality may not require consent, but analytics, advertising, and personalization cookies generally do. Websites must provide a cookie policy and obtain explicit opt-in consent for non-essential cookies. ### Penalties for KVKK Turkey non-compliance The KVKK Authority can impose significant penalties for non-compliance. Administrative fines may reach up to TRY 2,000,000 (indexed and subject to annual updates) depending on the nature of the violation. The Authority may also order suspension of data processing activities, deletion of unlawfully processed data, and corrective actions. Non-compliance risks not only financial penalties but also reputational damage. ### How to comply with the KVKK Turkey To check your compliance with the KVKK Turkey, businesses should: **Audit:** Audit their data to identify all cookies and trackers on their websites **Categorize:** Categorize cookies (e.g., necessary, preference, analytics, marketing) **Implement consent management:** Implement consent banners and check they are working correctly, make it easy and transparent for users to withdraw consent at any time, and keep consent logs **Check on partners and third parties:** Review third-party data-sharing practices **Train employees:** Make sure staff understand and comply with KVKK #### Frequently Asked Questions **What is the scope of the Law on the Protection of Personal Data (KVKK)?** The KVKK regulates the processing of personal data by natural persons or legal entities in Turkey. It aims to protect the fundamental rights and freedoms of individuals, particularly the right to privacy, when their data is collected, stored, used, or transferred. **What is personal data under the KVKK?** Personal data refers to any information relating to an identified or identifiable natural person. This includes details such as name, surname, identification number, address, phone number, email, financial information, or any other data that can directly or indirectly reveal someone’s identity. **What is sensitive personal data according to the KVKK?** Sensitive personal data includes information on race, ethnic origin, political opinions, philosophical beliefs, religion, sect or other beliefs, attire, association/union membership, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data. Processing this category of data requires stricter safeguards and legal bases. **Who is the regulatory authority for Turkey’s KVKK?** The Personal Data Protection Authority (KVKK Kurumu) is the independent regulatory and supervisory authority responsible for overseeing compliance with the law. **Who is exempt from KVKK rules?** The KVKK does not apply to the processing of personal data by individuals for purely personal or household activities, provided that the data is not shared with third parties or used for professional or commercial purposes. **Where can I get more information about Turkey’s Law on the Protection of Personal Data?** More detailed information, guidelines, and resources are available on the official website of the [Turkish Personal Data Protection Authority](https://kvkk.gov.tr/) (KVKK). --- # Louisiana LDPA Cookie Consent and Compliance URL: https://www.cookiehub.com/ldpa Last updated: June 16, 2026 ## Louisiana LDPA Cookie Consent and Compliance The Louisiana Data Privacy Act (LDPA) gives Louisiana residents new rights over their personal data and creates privacy obligations for businesses that collect, sell, share, or process consumer data. The law was signed on May 29, 2026 and takes effect January 1, 2027. ### What your business needs to know about the LDPA The Louisiana Data Privacy Act is a comprehensive state privacy law. It follows the broader US state privacy trend and gives consumers rights to access, correct, delete, obtain a copy of, and opt out of certain uses of their personal data. For websites, the LDPA is especially relevant where cookies, pixels, analytics tools, advertising tags, or tracking technologies are used for targeted advertising, profiling, sensitive data processing, or sale of personal data. ### What does LDPA compliance require? To prepare for LDPA compliance, businesses should: **Data mapping:** Identify what personal data is collected, where it comes from, and which vendors or third parties receive it. **Privacy notice updates:** Provide a clear privacy notice explaining data categories, purposes, consumer rights, appeal rights, data sales, and third-party sharing. **Consent management:** Obtain consent before processing sensitive data and provide clear opt-out options for targeted advertising, sale of personal data, and certain profiling. **Consumer rights handling:** Set up secure methods for Louisiana residents to submit access, correction, deletion, portability, and opt-out requests. **Data protection assessments:** Document assessments for targeted advertising, sale of personal data, sensitive data processing, high-risk profiling, and other high-risk processing activities. ### Who needs to comply with the LDPA? The LDPA applies to businesses that conduct business in Louisiana and meet at least one of these thresholds: - Annual gross revenue above 25 million USD - Processes personal data of 75,000 or more consumers, households, or devices - Derives 50% or more of annual revenue from selling personal data The law includes exemptions for certain entities and data types, including government bodies, nonprofits, higher education institutions, GLBA-regulated financial institutions, and HIPAA-regulated entities. ### Consumer rights under the LDPA Louisiana residents have the right to: **Right to access** Confirm whether a business is processing their personal data and access that data. **Right to correct** Request correction of inaccurate personal data. **Right to delete** Request deletion of personal data maintained by the controller. **Right of data portability** Obtain a copy of their personal data in a portable and usable format. **Right to opt out** Opt out of targeted advertising, sale of personal data, and profiling used for significant automated decisions. **Right to appeal** Appeal a controller’s refusal to act on a consumer rights request. Controllers must generally respond to consumer requests within 45 days, with one possible 45-day extension. ### Why cookies are part of LDPA compliance Cookies and tracking technologies can collect personal data such as device identifiers, IP addresses, browsing behavior, location signals, and advertising identifiers. Under the LDPA, businesses using cookies for targeted advertising, sale of personal data, profiling, or sensitive data processing need clear disclosures and effective opt-out or consent controls. The law also recognizes technology-based opt-out signals, including browser or device-level signals, where consumers use them to communicate their choices. A consent management platform like CookieHub helps businesses manage cookie scanning, categorization, regional consent rules, opt-out signals, consent records, and user preference controls. ### Penalties for LDPA non-compliance The Louisiana Attorney General has enforcement authority. The law does not create a private right of action. Violations may be treated as unfair or deceptive trade practices. The LDPA includes a temporary 30-day notice and cure period from January 1, 2027 through July 21, 2027. ### How to comply with the LDPA Businesses can prepare by taking the following steps: **Audit cookies and trackers:** Identify analytics, marketing, personalization, and third-party tracking technologies. **Categorize data use:** Separate necessary, preference, analytics, marketing, targeted advertising, and sensitive data processing. **Update privacy notices:** Explain what data is collected, why it is processed, who it is shared with, and how users can exercise their rights. **Implement consent and opt-out controls:** Use a CMP to provide clear choices, support opt-outs, store consent logs, and allow users to change preferences. **Review vendor contracts:** Make sure processors and third-party vendors support LDPA obligations. #### Frequently Asked Questions **What is the Louisiana Data Privacy Act?** The Louisiana Data Privacy Act is a state privacy law that gives Louisiana residents rights over their personal data and places obligations on covered businesses. **When does the LDPA take effect?** The LDPA takes effect on January 1, 2027. **Who enforces the LDPA?** The Louisiana Attorney General enforces the law. **Does the LDPA require cookie consent?** It can. Consent is required before processing sensitive data, and businesses must provide opt-out rights for targeted advertising, sale of personal data, and certain profiling. **Does the LDPA have a private right of action?** No. Enforcement is handled by the Louisiana Attorney General. --- # LFPDPPP Mexico Cookie Consent Management & Data Privacy Compliance URL: https://www.cookiehub.com/lfpdppp Last updated: June 16, 2026 ## Mexico LFPDPPP Cookie Consent and Compliance The Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP) in Mexico requires businesses to obtain informed consent before collecting or processing users’ personal data, including data gathered through cookies. Are you prepared to do this the right way? ### What your business needs to know about the LFPDPPP The LFPDPPP is Mexico’s main data protection law, enacted in 2010 to regulate the processing of personal data by private entities. It aims to protect individuals' privacy and gives them rights over their personal information, including the right to access, rectify, cancel, and oppose (ARCO) the use of their data. ### What does LFPDPPP compliance require? Businesses operating in Mexico or handling data of Mexican residents must understand that the LFPDPPP requires clear consent mechanisms, transparent privacy policies, and secure data handling procedures. It also mandates the designation of a Data Protection Officer (DPO) and the establishment of procedures to respond to data subject requests. Steps to LFPDPPP compliance: **Review data practices:** Assess whether your organization collects, stores, processes, or shares personal data of individuals in Mexico **Update privacy policy:** Review your privacy policy, data processing practices, and cookie consent mechanisms **Implement consent management:** Ensure you have consent management in place before beginning data collection **Conduct an audit:** Perform an audit or gap assessment to help identify non-compliant areas and guide remediation steps ### Who needs to comply with the LFPDPPP? Any individual or organization—domestic or foreign—that collects, uses, stores, or transfers personal data of individuals located in Mexico must comply with the LFPDPPP. This includes businesses with websites accessible in Mexico that track users via cookies. ### Consumer rights under the LFPDPPP Mexico’s law gives residents a set of data privacy rights, including: **Right to access** Request access to their personal information **Right to be informed** Request to know how personal data is being collected and used **Right to correction** Request that inaccurate, incomplete or out-of-date information be corrected **Right to deletion** Request the erasure of their personal information under certain circumstances **Right to object to or limit processing of data** Request to opt out of processing of their data **Right to data portability** Request data in a structured, commonly used format **Right to object to automated decision-making** Request that decisions not be made solely on automated processing ### Why cookies as part of LFPDPPP compliance Cookies fall under the LFPDPPP when they collect personal data, such as user preferences, location, or IP address. Under this law, cookie usage must be disclosed in a privacy notice, and consent must be collected for any non-essential cookies. This includes tracking cookies for analytics, marketing, or profiling purposes. ### Penalties for LFPDPPP non-compliance Non-compliance with the LFPDPPP can lead to significant penalties, including fines ranging from approximately 500 to over 1.5 million USD. In severe cases involving intentional misuse of personal data, criminal charges and imprisonment may also apply. ### How to comply with the LFPDPPP LFPDPPP compliance can be achieved with a few key data privacy best practices: **Conduct data and cookie audits:** Review current data practices to align with LFPDPPP **Update privacy and cookie policies:** Revise privacy notices to clearly outline data practices, consumer rights, and how to exercise those rights **Implement consent management:** Manage cookie use and consent with a comprehensive consent management platform like CookieHub **Educate employees:** Give employees training on the importance of compliance with LFPDPPP **Implement breach processes:** Ensure clear pathways for notifying consumers about data breaches **Assign a privacy officer:** Add a privacy officer to your organization to manage compliance #### Frequently Asked Questions **What is the scope of the Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP) in Mexico?** The LFPDPPP applies to all private individuals and entities in Mexico that process personal data as part of their commercial or professional activities. This includes businesses, professionals, and organizations that collect, use, store, or transfer personal data, regardless of their size or sector. **What is personal data under Mexico’s LFPDPPP?** Personal data is any information concerning an identified or identifiable individual. This includes names, addresses, phone numbers, email addresses, and any other data that can be used to identify a person directly or indirectly. **What is sensitive data according to the LFPDPPP in Mexico?** Sensitive data refers to personal data that, if misused, could significantly affect an individual's privacy or lead to discrimination. This includes data related to racial or ethnic origin, health status, genetic information, religious beliefs, political opinions, sexual orientation, and union membership. **Who is the regulatory authority for Mexico’s LFPDPPP?** The National Institute for Transparency, Access to Information and Personal Data Protection (INAI) was the main regulatory body responsible for overseeing compliance with the LFPDPPP. The INAI was eliminated and now data protection falls under the Secretariat of Anti-Corruption and Good Governance. **Who is exempt from Mexico’s LFPDPPP rules?** The law does not apply to individuals who use personal data for personal or household purposes, or to entities that process data solely for journalistic, artistic, or literary purposes. Certain government entities are also regulated under a different legal framework. **Where can I get more information about Mexico’s Federal Law on the Protection of Personal Data Held by Private Parties?** For more information, you can visit the official website of[the Secretariat of Anti-Corruption and Good Governance](https://directoriolegislativo.org/en/following-inais-closure-changes-in-transparency-and-access-to-information-in-mexico/). The site provides some information about data privacy following the closure of Mexico’s National Institute for Public Information Access and Personal Data Protection (INAI). --- # Minnesota MCDPA cookie consent and compliance URL: https://www.cookiehub.com/mcdpa-minnesota Last updated: June 16, 2026 ## Minnesota MCDPA cookie consent and compliance Under the MCDPA, websites targeting Minnesota residents must obtain explicit, unambiguous consent—prior to placing non-essential cookies—especially when processing sensitive data or profiling individuals. Transparency and a valid consent mechanism are mandatory for compliance. Are you compliant? ### What your business needs to know about MCDPA Minnesota The Minnesota Consumer Data Privacy Act (MCDPA) is a statewide data privacy law, signed on May 24, 2024, that takes effect on July 31, 2025. It empowers Minnesota residents with rights over their personal data and imposes obligations—such as transparency, data inventory, and security—on qualifying businesses. ### What does MCDPA Minnesota compliance require? Businesses should perform a compliance checklist: **Update privacy policy:** Updating privacy policies with Minnesota-specific disclosures. **Implement consent management:** Implement cookie consent banners and opt-out flows to obtain clear, affirmative consent and manage consumer rights **Data subject handling:** Establishing processes for handling data subject requests. **Data security:** Ensuring data security measures are in place. **Conduct data assessments:** Conduct required privacy impact or protection assessments and maintain a data inventory. ### Who needs to comply with MCDPA Minnesota? Different business types must comply with MCDPA: - Businesses that process data of 100,000+ MN consumers annually; or - Businesses with 25,000+ MN consumers and over 25% of revenue from selling personal data Exemptions apply to small businesses (per SBA), government, Indian tribes, certain nonprofits, banks, insurance companies, HIPAA/GLBA-covered entities, and employment contexts. ### Consumer rights under MCDPA Minnesota Minnesota consumers have the: **Right to access** Consumers can access and confirm processing of personal data **Right to correct** Consumers can request to correct inaccuracies **Right to delete** Consumers can request that their personal data be deleted **Right to challenge profiling** Consumers can challenge profiling outcomes and receive explanations and can appeal refusals **Right to opt-out** Consumers can opt out of the sale of personal data, targeted advertising, and profiling that produces legal/significant effect **Right to know** Consumers can obtain a list of specific third parties who received their data Businesses must have DSAR processes and response timelines. ### Why cookies as part of MCDPA Minnesota compliance Cookies that collect personal data from Minnesota users must be disclosed clearly, and non-essential or profiling cookies require opt-in consent. Consent mechanisms must integrate with cookie banners and CMPs to comply with opt-out and transparency obligations. ### Penalties for MCDPA Minnesota non-compliance Enforcement is by the Minnesota Attorney General. Businesses get a 30-day cure period (ending Jan 31, 2026), after which fines can be imposed up to 7,500 USD per violation. Consumers do not have a private right of action. ### How to comply with MCDPA Minnesota Organizations should ensure adherence to data privacy best practices as a part of their MCDPA Minnesota compliance: **Audit:** Conduct a data audit to identify all cookies and trackers on their websites **Categorize:** Categorize cookies (e.g., necessary, preference, analytics, marketing) **Implement consent management:** Ensure consent banners are implemented correctly with granular choices, enable users to withdraw consent at any time, and maintain consent logs **Check third-party contracts:** Review third-party data-sharing practices #### Frequently Asked Questions **What is the scope of MCDPA Minnesota?** The MCDPA covers Minnesota residents in their individual or household capacities, not B2B or employee data, and applies to businesses meeting data volume or revenue thresholds targeting those consumers. **What is personal data under MCDPA Minnesota?** Any information linked or reasonably linkable to an identifiable person—not including deidentified or public data—such as names, emails, IP addresses, geolocation, device IDs, biometric data and more. **What is sensitive data according to MCDPA Minnesota?** Sensitive categories include racial or ethnic origin, religious beliefs, health data, sexual orientation, genetic/biometric data, citizenship status, precise geolocation, and personal data of known children. **Who is the regulatory authority for MCDPA Minnesota?** The Minnesota Attorney General is the sole enforcement authority. **Who is exempt from MCDPA Minnesota rules?** Exemptions apply to small businesses (SBA standard), government, federally recognized tribes, certain banks/insurers, nonprofits detecting insurance fraud, HIPAA/GLBA-regulated data, employment contexts, and public records. **Where can I get more information about MCDPA Minnesota?** Visit the Minnesota AG’s office website, review the enacted HF 4757/Minnesota statutes (chapter 325O). --- # Maryland MODPA Cookie Consent and Compliance URL: https://www.cookiehub.com/modpa-maryland Last updated: June 16, 2026 ## Maryland MODPA Cookie Consent and Compliance MODPA is Maryland’s comprehensive data privacy law, effective from October 1, 2025, and enforceable for data processing after April 1, 2026. It grants Maryland residents enhanced rights over their personal and sensitive data and places strict obligations on controllers and processors. ### What your business needs to know about MODPA Maryland MODPA is Maryland’s comprehensive data privacy law, effective from October 1, 2025, and enforceable for data processing after April 1, 2026. It grants Maryland residents enhanced rights over their personal and sensitive data and places strict obligations on controllers and processors. ### \ What does MODPA Maryland compliance require? MODPA compliance measures include: **Update privacy policy:** Updating privacy policies. **Implement consent management:** Implement cookie consent banners and opt-out flows to obtain clear, affirmative consent **Data subject handling:** Establishing processes for handling data subject requests. **Data security:** Ensuring data security measures are in place. **Review and disclose data and cookie practices:** Disclose data handling practices, including collection, storage and sharing of cookie types, purposes, etc. **Data management:** Practice data minimization (collect only what is needed) and conduct data protection assessments. ### Who needs to comply with MODPA Maryland? Compliance with MODRA Maryland is required of any entity that: - Does business in Maryland or targets its residents; **and** - In the prior calendar year, processed: - Personal data of ≥ 35,000 Maryland consumers, **or** - Personal data of ≥ 10,000 plus > 20% of gross revenue from data sales. Exemptions include: - Maryland state and local government bodies - Entities under GLBA or securities laws - Certain nonprofits and first responders - Data regulated by HIPAA, FCRA, FERPA, Driver’s Privacy Protection Act, Farm Credit, etc. ### Consumer rights under MODPA Maryland Under MODPA, consumers have the: **Right to access** Consumers can access and confirm processing of personal data **Right to correct** Consumers can request to correct inaccuracies **Right to delete** Consumers can request that their personal data be deleted **Right to data portability** Consumers have a right to port/download/transmit their information in a usable format **Right to opt-out** Consumers can opt out of the sale of personal data, targeted advertising, and profiling that produces legal/significant effect **Right to know** Consumers can obtain a list of specific third parties who received their data Controllers must honor optout within 30 days and offer consent withdrawal mechanisms as accessible as consent itself. ### Why cookies as part of MODPA Maryland compliance Under MODPA, any cookies used for targeted advertising, profiling, or sale of personal data is subject to consumer rights. Cookies must be restricted to what is “reasonably necessary and proportionate” for the service requested. Non-essential cookies require opt-out options, and sensitive data cookies are banned unless strictly necessary. Clear, conspicuous notices must inform users about cookie use and provide a user-friendly mechanism to decline non-essential cookies. Required cookie banners must include an opt-out option for non-essential cookies (i.e., not strictly necessary for product/service delivery). Cookies used for targeted ads or profiling must be minimized, with explicit user consent and easy withdrawal mechanisms. ### Penalties for MODPA Maryland non-compliance Maryland’s Consumer Protection Act classifies violations of data privacy as unfair or deceptive trade practices. The Attorney General may issue a 60 day cure period (until April 1, 2027) before enforcement. Penalties can include up to 10,000 USD per violation and up to 25,000 for repeated violations. ### How to comply with MODPA Maryland Compliance with MODPA Maryland requires a number of specific actions but also, organizations should work toward the following data privacy best practices: **Audit:** Conduct a data audit to identify all cookies and trackers on their websites **Categorize:** Categorize cookies (e.g., necessary, preference, analytics, marketing) **Implement consent management:** Ensure consent banners are implemented correctly with granular choices, enable users to withdraw consent at any time, and maintain consent logs **Check third-party contracts:** Review third-party data-sharing practices #### Frequently Asked Questions **What is the scope of MODPA Maryland?** It applies to organizations doing business in Maryland or targeting its residents and meeting thresholds (data volume or revenue from selling data). Data processing after April 1, 2026, falls under enforcement. **What is personal data under MODPA Maryland?** Any information linked or reasonably linkable to an identifiable consumer (excluding deidentified or public data). **What is sensitive data according to MODPA Maryland?** Personal data revealing race, religion, health, sex life, sexual orientation, gender identity, citizenship, genetic/biometric data, child data, or precise geolocation (within 1,750 ft). **Who is the regulatory authority for MODPA Maryland?** Enforcement is done by the Maryland Attorney General’s Consumer Protection Division. **Who is exempt from MODPA Maryland rules?** Exemptions cover state bodies, GLBA-regulated financial entities, certain nonprofits/first responders, and data already regulated by HIPAA, FCRA, FERPA, etc. **Where can I get more information about MODPA Maryland?** Visit the Maryland General Assembly website (SB 541) for guidance. --- # Montana MTCDPA Cookie Consent and Compliance URL: https://www.cookiehub.com/mtcdpa Last updated: June 16, 2026 ## Montana MTCDPA Cookie Consent and Compliance Under MTCDPA, businesses must implement clear, affirmative optin consent for data collection through cookies or other tracking. Is your consent management ready to comply? ### What your business needs to know about MTCDPA Montana The Montana Consumer Data Privacy Act (MTCDPA) is a comprehensive privacy law that took effect October 1, 2024, granting residents rights over their personal data and imposing obligations on data controllers and processors. ### \ What does MTCDPA Montana compliance require? To check MTCDPA compliance, ensure your business does the following: **Update privacy policy:** Updating privacy policies. **Implement consent management:** Implement cookie consent banners and opt-out flows to obtain clear, affirmative consent **Data subject handling:** Establishing processes for handling data subject requests. **Data security:** Ensuring data security measures are in place. **Review and disclose data and cookie practices:** Disclose data handling practices, including collection, storage and sharing of cookie types, purposes, etc. ### Who needs to comply with MTCDPA Montana? Applies to entities that either: - Control or process personal data of ≥ 50,000 Montana residents, or - Control/process data of ≥ 25,000 residents and earn >25% revenue from its sale. Also applies when offering products/services targeting Montana residents via location or intent. Exemptions include government bodies, nonprofits, highered, financial institutions under GLBA, HIPAAcovered entities, and more. ### Consumer rights under MTCDPA Montana Montana residents enjoy the: **Right to access** Consumers can access and confirm processing of personal data **Right to correct** Consumers can request to correct inaccuracies **Right to delete** Consumers can request that their personal data be deleted **Right to data portability** Consumers have a right to port/download/transmit their information in a usable format **Right to opt-out** Consumers can opt out of the sale of personal data, targeted advertising, and profiling that produces legal/significant effect Businesses must comply within 45 days (with a possible 45day extension) and allow appeals within 60 days. ### Why cookies as part of MTCDPA Montana compliance Businesses must: - Obtain explicit consent before setting non-essential cookies or processing sensitive data. - Disclose cookie categories, thirdparties, and data purposes in privacy notices. - Provide a clear cookie preferences interface and honor universal optout signals. ### Penalties for MTCDPA Montana non-compliance Enforced exclusively by the Montana Attorney General, who issues a 60day cure notice before pursuing enforcement, MTCDPA can have penalties for non-compliance. After April 1, 2026, noncompliance that is not remedied may lead to enforcement actions or legal proceedings. The Montana Attorney General can seek civil penalties of up to 7,500 USD per violation. ### How to comply with MTCDPA Montana MTCDPA Montana compliance requires adherence both to specific actions as well as best practices for data privacy management, including: **Audit:** Conduct a data audit to identify all cookies and trackers on their websites **Categorize:** Categorize cookies (e.g., necessary, preference, analytics, marketing) **Implement consent management:** Ensure consent banners are implemented correctly with granular choices, enable users to withdraw consent at any time, and maintain consent logs **Review third parties:** Review third-party data-sharing practices #### Frequently Asked Questions **What is the scope of MTCDPA Montana?** MTCDPA Montana applies to entities doing business in Montana or targeting its residents, meeting the data volume or revenue thresholds described above. **What is personal data under MTCDPA Montana?** Personal data is any data that identifies or reasonably relates to an identified or identifiable individual. **What is sensitive data according to MTCDPA Montana?** Sensitive data includes race/ethnicity, health, precise geolocation, genetic/biometric info, religious beliefs, sexual orientation, immigration status, and data from minors. **Who is the regulatory authority for MTCDPA Montana?** The Montana Attorney General has exclusive enforcement authority. **Who is exempt from MTCDPA Montana rules?** Exemptions include government bodies, nonprofits, higher education institutions, GLBA regulated financial institutions, HIPAA-covered entities/business associates, and similar entities. **Where can I get more information about MTCDPA Montana?** Refer to the full legislative text (MCA Title 30, Chapter 14, Part 28) and official guidance from the Montana AG’s office. --- # Nebraska NDPA Cookie Consent and Compliance URL: https://www.cookiehub.com/ndpa-nebraska Last updated: June 16, 2026 ## Nebraska NDPA Cookie Consent and Compliance To comply with Nebraska’s Data Privacy Act, businesses must integrate clear cookie consent banners, explain cookie usage in privacy notices, and offer optout options when cookies involve personal data sales, targeted advertising, or profiling. Are you ready to comply with NDPA? ### What your business needs to know about NDPA Nebraska The Nebraska Data Privacy Act (NDPA), also known as LB 1074, is the state’s first comprehensive data privacy law, signed by Governor Pillen on April 17, 2024, and effective January 1, 2025. It grants Nebraska residents robust rights over their personal data and imposes obligations on qualifying businesses. ### What does NDPA Nebraska compliance require? To determine if your business complies with NDPA, consider the following activities: **Audit data:** Audit data collected via cookies and trackers. **Classify cookies:** Determine whether cookies involve sensitive or personal data. **Implement consent management:** Ensure opt-in consent for sensitive data cookies and provide opt-out mechanisms. **Embed functionality:** Enable the exercise of consumer rights (access, deletion, correction). **Document:** Keep records of all processes, contracts, assessments, and privacy notices. ### Who needs to comply with NDPA Nebraska? Compliance is required for any controller or processor that meets **all** of the following conditions; they conduct business in Nebraska or provide products/services to Nebraska residents, they process or sell personal data, and it is not a small business according to criteria set forth by the Federal Small Business Act. Exemptions include: - Purely personal/household activities - State government or political subdivisions - GLBA, HIPAA, FCRA, DPPA, FERPA data - Nonprofits and higher education - Utility providers. ### Consumer rights under NDPA Nebraska Nebraska residents have the: **Right to access** Consumers can access and confirm processing of personal data. **Right to correct** Consumers can request to correct inaccuracies **Right to delete** Consumers can request that their personal data be deleted **Right to data portability** Consumers have a right to port/download/transmit their information in a usable format **Right to opt-out** Consumers can opt out of the sale of personal data, targeted advertising, and profiling that produces legal/significant effect Violations must be responded to within 45 days (plus one 45-day extension), and appeals resolved within 60 days. Appeals denied trigger accessible complaints via the Nebraska Attorney General. ### Why cookies as part of NDPA Nebraska compliance Cookie compliance is required as a part of NDPA Nebraska. - **Opt-in consent** required for cookies processing sensitive personal data (e.g., biometric, precise location, children’s data). - **Opt-out options** necessary if cookies support personal data sales, targeted ads, or profiling ### Penalties for NDPA Nebraska non-compliance Organizations that fail to comply with NDPA Nebraska may face: - **Civil fines** up to 7,500 USD per violation, as enforced by the Nebraska Attorney General. - **30-day cure period** after notice, indefinitely renewable until cured. - **No private right of action** – consumers cannot sue; obligations enforced only by AG. ### How to comply with NDPA Nebraska To check your compliance with NDPA Nebraska and data privacy best practices, organizations should: **Audit:** Conduct a data audit to identify all cookies and trackers on their websites **Categorize:** Categorize cookies (e.g., necessary, preference, analytics, marketing) **Implement consent management:** Ensure consent banners are implemented correctly with granular choices, enable users to withdraw consent at any time, and maintain consent logs **Check third-party contracts:** Review third-party data-sharing practices #### Frequently Asked Questions **What is the scope of NDPA Nebraska?** Nebraska’s NDPA applies to controllers/processors doing business in Nebraska or serving its residents, processing or selling personal data, and exceeding smallbusiness thresholds (no revenue/data volume limits). **What is personal data under NDPA Nebraska?** Any information reasonably linked to an identifiable person, including pseudonymized data when re-identifiable. Excludes public or deidentified data. **What is sensitive data according to NDPA Nebraska?** Data revealing race, religion, health, sexual orientation, citizenship, genetic/biometric info, precise geolocation, and known children’s data. Processing this requires optin consent. **Who is the regulatory authority for NDPA Nebraska?** The Nebraska Attorney General has exclusive enforcement power—no private actions allowed. **Who is exempt from NDPA Nebraska rules?** Small businesses, purely personal data processing, state agencies, GLBA/HIPAA/FERPA/FCRA-regulated entities, nonprofits, utilities, higher education, and certain covered data types are exempt from NDPA compliance. **Where can I get more information about NDPA Nebraska?** See the Nebraska AGO Data Privacy Homepage, LB 1074 (Neb. Rev. Stat. §§ 871101–1130), and consult privacy experts or legal counsel for more information about NDPA Nebraska. --- # Chile nDPL Cookie Consent and Compliance URL: https://www.cookiehub.com/ndpl Last updated: June 18, 2026 ## Chile nDPL Cookie Consent and Compliance The new Data Protection Law (nDPL) in Chile establishes strict requirements for collecting, processing, and storing personal data—especially through cookies and online tracking technologies. Are you prepared to do this the right way? ### What your business needs to know about the nDPL The nDPL (nueva Ley de Protección de Datos Personales) is Chile’s updated data protection legislation, replacing the outdated 1999 law. Inspired by global standards such as the GDPR, it modernizes Chile's data privacy framework, expanding the rights of data subjects and imposing obligations on both public and private organizations handling personal data. It introduces a dedicated Data Protection Agency, mandates data breach notifications, and requires data protection impact assessments for high-risk processing. Websites must obtain explicit, informed, and prior consent from users before deploying non-essential cookies, such as those used for marketing or analytics. This aligns with global trends in data privacy and emphasizes transparency and user autonomy. ### What does nDPL compliance require? Businesses operating in or serving users in Chile must: **Consent management:** Obtain valid consent for collecting and processing personal data. **Appoint a Data Protection Officer (DPO):** Hire a DPO if large-scale processing is involved. **Give users their rights:** Ensure data subjects can exercise their rights (access, correction, deletion, objection). **Data security:** Implement security and accountability measures. **Recordkeeping:** Keep documentation of data processing activities and risk assessments. **Audits:** Prepare for inspections and audits from the future data protection authority. ### Who needs to comply with the nDPL? The nDPL Chile applies to: - Companies established in Chile. - Foreign businesses offering goods/services or monitoring behavior of people in Chile. - Public institutions processing personal data. - Startups and SMEs, regardless of size, if they handle personal data. Exemptions are limited and depend on the nature and scale of the data processing. ### Consumer rights under the nDPL Chile’s law gives residents a set of data privacy rights, including: **Right to access** Request access to their personal information **Right to be informed** Request to know how personal data is being collected and used **Right to correction** Request that inaccurate, incomplete or out-of-date information be corrected **Right to deletion** Request the erasure of their personal information under certain circumstances **Right to object to or limit processing of data** Request to opt out of processing of their data **Right to data portability** Request data in a structured, commonly used format ### Why cookies as part of nDPL compliance Cookies that collect identifiable information—such as IP addresses or user behavior—fall under the scope of the nDPL Chile. Consent is not optional for non-essential cookies. Cookie banners must: - Appear clearly when users first visit the site. - Allow opt-in, not just opt-out. - Provide detailed cookie policies explaining data usage and retention. Offer equal ease of acceptance and rejection of cookie use. ### Penalties for nDPL non-compliance Violating the nDPL can lead to significant penalties, including: - Fines categorized into minor, serious, and very serious, ranging up to 10,000 UTM (approx. 750,000 USD) or more depending on severity. - Legal action by affected individuals. - Reputational damage and loss of user trust. Suspension of data processing operations in extreme cases. ### How to comply with the nDPL To check your compliance with the nDPL Chile, businesses should: **Audit:** Conduct a data audit to identify all cookies and trackers on their websites. **Categorize:** Categorize cookies (e.g., necessary, preference, analytics, marketing). **Implement consent management:** Ensure consent banners are implemented correctly with granular choices, enable users to withdraw consent at any time, and maintain consent logs. **Check on partners:** Review third-party data-sharing practices. #### Frequently Asked Questions **What is the scope of the New Data Protection Law (nDPL) in Chile?** The nDPL applies to all individuals and organizations—public or private—that process personal data in Chile or handle data of individuals located in Chile. It covers the collection, storage, use, and sharing of personal data to ensure privacy rights are protected. **What is personal data under Chile’s nDPL?** Personal data refers to any information relating to an identified or identifiable natural person. This includes details like names, identification numbers, contact information, location data, or any other data that can directly or indirectly identify an individual. **What is sensitive data according to the nDPL in Chile?** Sensitive data includes personal information that reveals racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, health information, or data concerning a person’s sexual life. **Who is the regulatory authority for Chile’s nDPL?** The regulatory authority overseeing the enforcement of the nDPL in Chile is the Transparency Council (Consejo para la Transparencia), responsible for monitoring compliance and handling complaints related to data protection. **Who is exempt from Chile’s nDPL rules?** Certain data processing activities are exempt, including data processed exclusively for personal, family, or household purposes without any commercial intent. Additionally, some governmental activities may have specific exemptions under the law. **Where can I get more information about Chile’s New Data Protection Law?** For more detailed information, you can visit the official website of the Transparency Council or consult legal resources specializing in Chilean data protection laws. Official government publications and legal advisories also provide comprehensive guidance on the nDPL. --- # Nigeria NDPR Cookie Consent and Compliance URL: https://www.cookiehub.com/ndpr Last updated: June 19, 2026 ## Nigeria NDPR Cookie Consent and Compliance The Nigeria Data Protection Regulation (NDPR) requires websites and digital platforms that collect personal data to obtain clear, informed consent from users—especially for cookies that track behavior. Cookie consent banners must be explicit, provide users with choices, and comply with NDPR principles such as data minimization and transparency. ### What your business needs to know about the NDPR The NDPR is the Nigerian framework for data protection, established in 2019 by the National Information Technology Development Agency (NITDA). It aims to safeguard the rights of natural persons to data privacy, regulate the processing of personal data, and ensure organizations handle data responsibly and transparently. ### What does NDPR compliance require? Businesses must understand that the NDPR applies to any organization—whether based in Nigeria or abroad—that processes the personal data of Nigerian residents. It mandates data protection policies, user consent for data collection, employee training, and the appointment of a Data Protection Officer (DPO) where applicable. Compliance not only avoids penalties but also builds consumer trust. Businesses operating online in Nigeria must implement technical and organizational measures to ensure data privacy and user consent. To check your NDPR compliance: **Review data practices:** Assess whether your organization collects, stores, processes, or shares personal data of individuals in Nigeria **Update privacy policy:** Review your privacy policy, data processing practices, and cookie consent mechanisms **Audit:** Perform an audit or gap assessment to help identify non-compliant areas and guide remediation steps **Implement consent management:** Platforms like CookieHub provide an easy way to manage consumer consent for data processing. ### Who needs to comply with the NDPR? All public and private organizations that process personal data of Nigerian citizens or residents must comply with the NDPR. This includes local companies, international businesses targeting Nigerian users, government agencies, educational institutions, and nonprofits. ### Consumer rights under the NDPR Nigeria’s law gives residents a set of data privacy rights, including: **Right to access** Request access to their personal information **Right to be informed** Request to know how personal data is being collected and used **Right to correction** Request that inaccurate, incomplete or out-of-date information be corrected **Right to deletion** Request the erasure of their personal information under certain circumstances **Right to object to or limit processing of data** Request to opt out of processing of their data **Right to data portability** Request data in a structured, commonly used format **Right to object to automated decision-making** Request that decisions not be made solely on automated processing **Right to consent** Organizations must obtain consumer consent before processing data and consumers can withdraw consent **Right to report to supervisory authority** File complaints in the event of a data breach ### Why cookies as part of NDPR compliance Cookies that collect or store personal data—such as IP addresses, device identifiers, or browsing history—fall under NDPR regulations. Users must be informed about the type of cookies used, their purpose, and must be given the option to accept or decline non-essential cookies. Default cookie acceptance is not considered valid consent under the NDPR. ### Penalties for NDPR non-compliance Non-compliance with the NDPR can lead to substantial penalties. Organizations may face fines of up to 2% of annual gross revenue or ₦10 million—whichever is greater—for serious breaches. Additional consequences may include public sanctions, reputational damage, or even suspension of data processing rights. ### How to comply with the NDPR Implementing a few key data privacy best practices can help you comply with NDPR: **Conduct data and cookie audits:** Review current data practices to identify areas for aligning with the NDPR **Update privacy and cookie policies:** Revise privacy notices to clearly outline data practices, consumer rights, and how to exercise those rights **Implement consent management:** Manage cookie use and consent with a comprehensive consent management platform like CookieHub **Educate employees:** Give employees training on the importance of compliance with NDPR **Implement breach processes:** Ensure clear pathways for notifying consumers about data breaches **Assign a privacy officer:** Add a privacy officer to your organization to manage compliance #### Frequently Asked Questions **What is the scope of the Nigerian Data Protection Regulation (NDPR)?** The NDPR applies to all transactions intended for the processing of personal data of Nigerian citizens and residents, whether by individuals or organizations within Nigeria or outside the country, provided the data subjects are in Nigeria. **What is personal data under NDPR?** Personal data refers to any information relating to an identified or identifiable natural person. This includes names, addresses, phone numbers, email addresses, and any other data that can be used to identify an individual. **What is sensitive data according to the NDPR?** Sensitive data includes information such as a person’s race, ethnic origin, political opinions, religious or philosophical beliefs, health status, genetic or biometric data, sexual orientation, or trade union membership. **Who is the regulatory authority for Nigeria’s NDPR?** The Nigeria Data Protection Commission (NDPC) is the regulatory authority responsible for enforcing and overseeing compliance with the NDPR. **Who is exempt from NDPR rules?** The NDPR does not apply to purely personal or household activities with no connection to a professional or commercial purpose. Additionally, data processed for national security or public interest by authorized government agencies may be exempt under specific legal conditions. **Where can I get more information about Nigeria’s NDPR?** You can find detailed information, official guidelines, and updates on the NDPR by visiting the [Nigeria Data Protection Commission](https://ndpc.gov.ng/)’s official website. --- # New Zealand Privacy Act Cookie Consent and Compliance URL: https://www.cookiehub.com/new-zealand-privacy-act Last updated: June 19, 2026 ## New Zealand Privacy Act Cookie Consent and Compliance The Privacy Act 2020 New Zealand, governed by 13 information privacy principles (IPP 3) requires websites to inform users about cookies and trackers that process identifiable data—detailing their purpose, who they share data with, and providing opt-in transparency. This ensures users see consent prompts _before_ cookies deploy. Are you compliant? ### What your business needs to know about the Privacy Act NZ The Privacy Act 2020, effective from 1 December 2020, modernizes and replaces the 1993 Act. It strengthens protections for personal information and aligns New Zealand with international standards via 13 Information Privacy Principles (IPP) covering collection, storage, security, correction, access, disclosure, and cross-border data flow. ### What does Privacy Act NZ compliance require? Organizations both public and private that operate in or target individuals in New Zealand and collect or handle personal information from individuals in New Zealand must comply with the Privacy Act, regardless of where their business is located. To ensure compliance, organizations must respect and follow the 13 IPPs: **Purpose:** Demonstrate and explain the purpose for data collection **Data source:** Information should only be collected directly from the person it is about **Openness:** Organizations must inform about why they are collecting data, who will receive it, whether giving the data is required or voluntary, and what will happen if it is not shared **Lawful collection:** Fair and reasonable manner of data collection must be ensured **Data protection:** Organizations must make every effort to secure and protect data **Right of access:** Individuals have the right to request access to their own information **Right to correct:** Individuals have the right to request that misinformation and inaccuracies be corrected **Accuracy:** Organizations must check before using or disclosing personal information that it is accurate and up to date **Retention:** Information may not be kept longer than required for stated purpose **Limits on use of personal information:** Personal information may only be used for the purposes for which it was collected **Disclosure:** Organizations can only disclose personal information for the purpose for which it was collected **Data outside New Zealand:** Organizations must adhere to rules about sending personal information to organizations outside of New Zealand **Use of unique identifiers:** Organizations can only assign unique identifiers to people when it is necessary for its functions ### Who needs to comply with Privacy Act NZ? Most individuals and organizations that collects, holds, processes, or uses personal data in New Zealand must comply with IPP 3/New Zealand’s privacy act. This includes both private businesses and public entities, as well as foreign companies offering goods or services to New Zealand residents. The only exceptions include members of parliament operating in an official capacity, the courts, and media engaging in news activities. ### Consumer rights under the Privacy Act NZ The Privacy Act gives NZ residents a number of rights concerning their data, including allowing consumers to: **Right to access** Request access to their personal data held by businesses **Right to correct** Correct inaccuracies in their data **Right to delete** Request the deletion of their personal data, with certain exceptions **Right to opt-out** Opt out of the processing of their personal data for targeted advertising, the sale of their data, or for profiling ### Why cookies as part of Privacy Act NZ compliance Cookies that handle personal information—such as IP addresses or device identifiers—fall under the Act’s definition of personal data. Websites must include cookie management in their privacy notices, and cookies should only be used with proper disclosure and valid user consent. ### Penalties for Privacy Act NZ non-compliance Fines of up to 10,000 NZD may be issued for individuals or organizations for offenses like misleading information or failure to comply with access requests. The Privacy Commissioner can issue compliance notices and force organizations to change practices, release data, or redress harm; breaches may be escalated to the Human Rights Review Tribunal, which could involve further costs and penalties. ### How to comply with the Privacy Act NZ Businesses can get ahead of compliance and implement a consent-first posture by introducing some data privacy best practices: **Conduct data and cookie audits:** Review current data practices to identify areas that need adjustment to align with the Privacy Act 2020 and document cookie and tracker purposes **Update privacy and cookie policies:** Revise privacy notices to clearly outline data practices, consumer rights, and how to exercise those rights **Implement consent management:** Get effective management and control of cookie use with a comprehensive consent management platform like CookieHub **Educate employees:** Offer staff education programs on the importance of data privacy and Privacy Act compliance **Implement breach processes:** Develop internal systems to detect, evaluate, and notify breaches within specified time period **Assign a privacy champion:** Appoint a privacy officer to oversee compliance #### Frequently Asked Questions **What is the scope of New Zealand’s Privacy Act 2020?** The Privacy Act 2020 applies to all agencies (including businesses, government departments, and organizations) that collect, store, and use personal information in New Zealand. It also applies to overseas agencies that carry out business in New Zealand, even if they do not have a physical presence in the country. **What is personal data under New Zealand’s Privacy Act 2020?** Personal data—referred to as personal information—includes any information about an identifiable individual. This can include names, contact details, financial records, health information, and other data that can be used to identify someone. **What is sensitive data according to the New Zealand Privacy Act 2020?** While the Act does not use the term “sensitive data” specifically, certain types of personal information, such as health records, biometric data, and information about someone's race, ethnicity, or political views, are generally considered more sensitive and may require greater protection and care in handling. **Who is the regulatory authority for New Zealand’s Privacy Act?** The Office of the Privacy Commissioner (OPC) is the independent authority responsible for enforcing and overseeing the Privacy Act 2020. The OPC provides guidance, investigates complaints, and ensures compliance with privacy principles. **Who is exempt from NZ Privacy Act rules?** Certain individuals and entities are exempt, including members of parliament in their official capacity, courts and tribunals (in relation to their judicial functions), news media (when engaged in news activities), and personal or household affairs (e.g., individuals managing their own personal contact lists). **Where can I get more information about New Zealand’s Privacy Act 2020?** You can visit the [Office of the Privacy Commissioner’s website](http://www.privacy.org.nz/) for detailed guidance, resources, and tools related to the Privacy Act 2020. --- # New Hampshire NHDPA Cookie Consent and Compliance URL: https://www.cookiehub.com/nhdpa-new-hampshire Last updated: June 18, 2026 ## New Hampshire NHDPA Cookie Consent and Compliance The New Hampshire Data Privacy Act (NHDPA)** **requires businesses to obtain clear, opt-in consent from users before collecting and processing their personal data through cookies and similar technologies. Are you ready to comply? ### What your business needs to know about the NHDPA The New Hampshire Data Privacy Law (NHDPA) is a comprehensive state-level data privacy law that aligns with national trends such as the California Consumer Privacy Act (CCPA) and the Virginia Consumer Data Protection Act (VCDPA). It grants New Hampshire residents specific rights over their personal data and imposes obligations on businesses handling that data. ### What does NHDPA compliance require? Businesses operating in or targeting New Hampshire residents should: **Update privacy policy:** Updating privacy and cookie policies **Implement consent management:** Implement cookie consent banners and opt-out flows to obtain clear, affirmative consent **Data subject handling:** Establishing processes for handling data subject requests. **Data security:** Ensuring data security measures are in place. **Review and disclose data and cookie practices:** Disclose data handling practices, including collection, storage and sharing of cookie types, purposes, etc. ### Who needs to comply with NHDPA? NHDPA applies to any business that: - Conducts business in New Hampshire or targets its residents; - Meets data processing thresholds, i.e., control or process the data of at least 35,000 New Hampshire residents (or 10,000 residents and derive over 25% of revenue from data sales). - Processes personal data for commercial purposes. Nonprofits, small businesses under the threshold, and certain government agencies may be exempt. ### Consumer rights under NHDPA Consumers in New Hampshire have the: **Right to access** Consumers can access and confirm processing of personal data **Right to correct** Consumers can request to correct inaccuracies **Right to delete** Consumers can request that their personal data be deleted **Right to data portability** Consumers have a right to port/download/transmit their information in a usable format **Right to opt-out** Consumers can opt out of the sale of personal data, targeted advertising, and profiling that produces legal/significant effect **Right to know** Consumers can obtain a list of specific third parties who received their data NHDPA includes a 30-day cure period before enforcement action may be taken. ### Why cookies as part of NHDPA compliance Cookies that collect personal data—especially for analytics, advertising, or profiling—are covered under NHDPA. Businesses must: - Obtain consent for non-essential cookies. - Provide a clear opt-out mechanism. - Inform users of cookie purposes and third-party involvement. ### Penalties for NHDPA non-compliance Violations of NHDPA may result in civil penalties of up to 10,000 USD per violation. The New Hampshire Attorney General is responsible for enforcement and may provide a 30-day cure period to remedy non-compliance before legal action is taken. ### How to comply with NHDPA Compliance with NHDPA demands adherence with NHDPA-specific actions. In achieving compliance, organizations should also: **Audit:** Conduct a data audit to identify all cookies and trackers on their websites **Categorize:** Categorize cookies (e.g., necessary, preference, analytics, marketing) **Implement consent management:** Ensure consent banners are implemented correctly with granular choices, enable users to withdraw consent at any time, and maintain consent logs **Check third-party contracts:** Review third-party data-sharing practices #### Frequently Asked Questions **What is the scope of NHDPA?** NHDPA applies to businesses that process the personal data of New Hampshire residents and meet certain thresholds for volume or revenue from data processing. **What is personal data under NHDPA?** Personal data is any information that can be reasonably linked to an identifiable individual, such as names, IP addresses, email addresses, or device IDs. **What is sensitive data according to NHDPA?** Sensitive data includes racial or ethnic origin, religious beliefs, health information, sexual orientation, biometric data, and precise geolocation. **Who is the regulatory authority for NHDPA?** The New Hampshire Attorney General’s Office enforces the NHDPA. **Who is exempt from NHDPA rules?** Exempt entities include government bodies, nonprofits, and businesses that do not meet the data processing thresholds. **Where can I get more information about NHDPA?** You can visit the New Hampshire Department of Justice or consult a data privacy attorney for detailed guidance. --- # Oregon OCPA Cookie Consent and Compliance URL: https://www.cookiehub.com/ocpa Last updated: June 18, 2026 ## Oregon OCPA Cookie Consent and Compliance Under OCPA Oregon, data privacy and cookie consent are required for compliance. Are you ready to comply? ### What your business needs to know about OCPA Oregon The Oregon Consumer Privacy Act, enacted via Senate Bill 619 in June 2023, took effect July 1, 2024—with an enforcement window opening January 2026. It regulates how businesses handle personal data of Oregon residents and grants them strong privacy rights. Key responsibilities include: - Recognizing whether you are a _controller_ (decides data use) or _processor_ (acts on behalf of a controller) - Offering a clear privacy policy covering data categories, purposes, third-party sharing, consumer rights, contact info, profiling, and related opt-outs - Only collecting necessary data and protecting it with reasonable administrative, technical, and physical measures - Performing data protection assessments when processing sensitive data, engaging in profiling, targeted ads, or selling personal data - Establishing contracts between controllers and processors that reflect OCPA obligations ### What does OCPA Oregon compliance require? Businesses should: **Conduct an audit:** Perform a full audit of data collection and sharing practices and identify personal data collected and its purposes **Update privacy policy:** Review and update privacy and cookie policies with OCPA-specific disclosures **Implement consent management:** Implement cookie consent banners and opt-out flows to automate consent capture and preference management **Ensure consumer rights:** Establish mechanisms to respond to consumer rights requests within 45 days **Perform Data Protection Assessments:** Safeguard privacy with regard to targeted advertising, data sales, profiling, or processing sensitive data. ### Who needs to comply with OCPA Oregon? OCPA applies if, during a calendar year, your business processes personal data of 100,000 or more Oregon consumers (excluding payment-only data), or processes 25,000**+** consumers while deriving 25%**+ **revenue from data sales. It applies to entities conducting business in Oregon or serving its residents—this includes nonprofits, which received a delayed compliance deadline that took effect July 1, 2025. Exemptions include government agencies, financial institutions under GLBA, HIPAA-covered entities, educational, public-interest nonprofit groups (e.g. fraud prevention, press associations). ### Consumer rights under OCPA Oregon The law guarantees Oregon residents these rights: **Right to access** Consumers can access and confirm processing of personal data **Right to correct** Consumers can request to correct inaccuracies **Right to delete** Consumers can request that their personal data be deleted **Right to data portability** Consumers have a right to port/download/transmit their information in a usable format **Right to opt-out** Consumers can opt out of the sale of personal data, targeted advertising, and profiling that produces legal/significant effect **Right to know and confirm** Consumers can find out what third parties have received their data and confirm whether an entity is processing it Controllers must respond within 45 days, with a possible additional 45-day extension, and must explain any denials with appeal instructions. Parents must consent to data processing of children under 13 in accordance with COPPA. ### Why cookies as part of OCPA Oregon compliance Cookies that facilitate sensitive data tracking, targeted ads, or data sharing fall under OCPA regulation. Businesses must: - Inform users clearly in banner notices - Obtain explicit consent for non-essential cookies - Provide an easy mechanism to opt-out and withdraw consent Under the OCPA, businesses must implement clear cookie banners or consent interfaces when cookies are used for targeted advertising, profiling, or data sharing—including cookie consent specifically tailored to Oregonians. The banner must clearly inform users what types of cookies are used, allow opt-in or opt-out, and let users withdraw consent easily. ### Penalties for OCPA Oregon non-compliance The Oregon Attorney General enforces the OCPA. After identifying a violation, they may issue a 30-day cure notice; post-January 1, 2026, violations can result in civil fines of up to 7,500 USD per violation, plus legal fees. There's no private right of action—only AG enforcement is permitted. ### How to comply with OCPA Oregon In addition to undertaking certain actions to comply with OCPA Oregon, organizations should also adhere to data privacy best practices, such as: **Audit:** Conduct a data audit to identify all cookies and trackers on their websites **Categorize:** Categorize cookies (e.g., necessary, preference, analytics, marketing) **Implement consent management:** Ensure consent banners are implemented correctly with granular choices, enable users to withdraw consent at any time, and maintain consent logs **Check third-party contracts:** Review third-party data-sharing practices #### Frequently Asked Questions **What is the scope of OCPA Oregon?** It applies to entities conducting business or serving Oregon residents and meeting thresholds: ≥ 100k consumers or ≥ 25k + 25% revenue from data sales. **What is personal data under OCPA Oregon?** Any data that can reasonably be linked to an individual—names, emails, device IDs, geolocation, browsing habits, etc. **What is sensitive data according to OCPA Oregon?** Racial/ethnic origin, religion, health, biometric/genetic data, sexual orientation, precise geolocation, citizenship, crime victim status, transgender status, and children’s data under 13. **Who is the regulatory authority for OCPA Oregon?** Enforcement rests solely with the Oregon Attorney General’s Office. **Who is exempt from OCPA Oregon rules?** Government bodies, HIPAA/GLBA-covered entities, certain nonprofits (fraud prevention, broadcast reporting), employment-related data, deidentified publicly available data. **Where can I get more information about OCPA Oregon?** Visit the Oregon DOJ’s Consumer Privacy site for more detailed information about OCPA compliance and enforcement. --- # Argentina PDPA Cookie Consent and Compliance URL: https://www.cookiehub.com/pdpa-argentina Last updated: September 24, 2026 ## Argentina PDPA Cookie Consent and Compliance Argentina’s Personal Data Protection Act (Law 25.326), often referred to as the PDPA, defines personal and sensitive data, mandates free and informed consent for data processing, and establishes obligations for public and private entities processing data in Argentina—or targeting individuals there. The CookieHub consent management platform was built specifically to help manage these challenges. ### What your business needs to know about PDPA Data Protection Law Argentina Businesses must register any personal data databases with Argentina’s Data Protection Authority (AAIP); ensure data collection is limited, accurate, and secure; obtain express, informed consent; respect data subject rights (access, correction, deletion); regulate transfers abroad only to “adequate” countries or with valid safeguards; and implement confidentiality/security measures. ### What does PDPA Argentina compliance require? To comply, businesses need to: **Categorize:** Classify cookies into essential vs. nonessential **Enable clear opt-in and opt-out options:** Block nonessential ones until the user opts in **Cookie management:** Provide clear cookie banners explaining each cookie’s purpose **Implement consent measures:** Let users withdraw consent anytime This mirrors GDPR-style practices and aligns with AAIP standards. ### Who needs to comply with PDPA Data Protection Law Argentina? The law applies to: - Anyone (individual or legal entity) controlling or processing personal data in Argentina—even if data is processed abroad Exceptions are limited: purely personal/family use, public authority duties, minimal data lists (e.g., name, NID), financial or contractual data. ### Consumer rights under PDPA Argentina Argentina consumers are granted the following rights: **Right to access and be informed** Consumers can access, confirm processing and its purposes and get copies of personal data **Right to correct** Consumers can request to correct or update inaccurate information **Right to delete** Consumers can request that their personal data be deleted **Right to object** Consumers can object to certain types of processing, such as direct marketing or automated decisions **Right to judicial action (habeas data)** Consumers can file court actions to access, update, correct, suppress or restrict the confidentiality of their personal data **Right to enforcement and remedy** Consumers can make claims through individual or collective judicial or administrative actions; enforcement authority may impose fines or corrective measures ### Why cookies as part of PDPA Argentina compliance While the PDPA doesn’t specifically refer to cookies, AAIP and industry guidance treat cookies that process personal data as subject to the same rules. Consent must be prior, explicit optin, freely given, informed, and specific—with no preticked boxes for nonessential cookies (e.g., analytics, advertising). ### Penalties for PDPA Data Protection Law Argentina non-compliance Penalties can come in several forms based on what is allowable within the AAIP’s authority, including: - Warnings - Database suspensions - Fines up to 15 million ARS - Criminal sanctions including prison (up to 3 years) for hacking, sharing false data, or unauthorized access ### How to comply with the PDPA Argentina To check your compliance with the PDPA Argentina, businesses should: **Audit:** Conduct a data audit to identify all cookies and trackers on their websites. **Categorize:** Categorize cookies (e.g., necessary, preference, analytics, marketing). **Implement consent management:** Ensure consent banners are implemented correctly with granular choices, enable users to withdraw consent at any time, and maintain consent logs. **Check on partners:** Review third-party data-sharing practices. #### Frequently Asked Questions **What is the scope of the PDPA Data Protection Law in Argentina?** Argentina’s PDPA applies to any individual or organization that processes personal data within Argentina, as well as those outside the country who handle data of individuals located in Argentina. It covers all types of data processing, including collection, storage, use, and transfer of personal information. **What is personal data under Argentina’s PDPA?** Personal data refers to any information relating to an identified or identifiable natural person. This includes details such as name, identification number, location data, online identifiers, or any other data that can directly or indirectly identify a person. **What is sensitive data according to the PDPA in Argentina?** Sensitive data includes information related to a person’s racial or ethnic origin, political opinions, religious beliefs, health or sexual life, genetic or biometric data, and any data that could lead to discrimination or harm if disclosed. **Who is the regulatory authority for Argentina’s PDPA?** The Agency for Access to Public Information (Agencia de Acceso a la Información Pública, AAIP) is the regulatory authority responsible for overseeing compliance with Argentina’s PDPA. It took over this role in 2017 from the former National Directorate for Personal Data Protection. **Who is exempt from Argentina’s PDPA rules?** Certain public agencies and processing activities related to national security, criminal investigations, or judicial proceedings may be exempt from the PDPA’s rules. However, these exemptions are limited and subject to specific legal requirements. **Where can I get more information about Argentina’s Data Protection Law?** For detailed information, official guidelines, and updates, you can visit the website of Argentina’s Agency for Access to Public Information (AAIP) or consult legal resources specializing in Argentine data protection laws. --- # Singapore PDPA Cookie Consent and Compliance URL: https://www.cookiehub.com/pdpa-singapore Last updated: June 18, 2026 ## Singapore PDPA Cookie Consent and Compliance Under the Personal Data Protection Act (PDPA) Singapore, the collection, use, or disclosure of personal data—whether through cookies or other means—requires consent. Is your website ready for compliance? ### What your business needs to know about the PDPA Singapore The Personal Data Protection Act (PDPA) is Singapore’s primary data protection law, first enacted in 2012 and enforced by the Personal Data Protection Commission (PDPC). It governs the collection, use, disclosure, and care of personal data by organizations, aiming to protect individuals’ personal data while enabling legitimate business use. ### What does PDPA Singapore compliance require? If your website uses cookies that track users' behavior, preferences, or identity (such as analytics or marketing cookies), you must obtain clear and informed consent before activating those cookies. This aligns with the PDPA’s emphasis on notifying individuals and obtaining their permission before collecting personal data. Your business must inform individuals of the purposes for collecting personal data, obtain their consent, and ensure that data is properly protected. You are also responsible for safeguarding personal data from unauthorized access, use, or disclosure. Any third-party services you use (e.g., for marketing or analytics) that handle personal data must also comply with PDPA standards. Website cookies and tracking technologies are included in this scope. To be in compliance, businesses operating in or serving users in Singapore must: **Implement consent management:** Obtain proper consent for collecting and processing personal data **Audit:** Audit all data collection practices, including consent mechanisms, data security, third-party data sharing, across customer touchpoints **Update privacy policy:** Implement and keep up-to-date privacy policies **Check partner compliance:** Ensure that third parties used also comply with PDPA **Data protection:** Secure data against breaches and unauthorized access ### Who needs to comply with the PDPA Singapore? All private sector organizations, including businesses, associations, and non-profit entities operating in Singapore or collecting personal data from individuals in Singapore, are required to comply with the PDPA. This includes online businesses, e-commerce platforms, and mobile app developers. ### Consumer rights under the PDPA Singapore Singapore’s law grants consumers various data privacy rights, including: **Right to access** Request access to their personal information **Right to be informed** Request to know how personal data is being collected and used **Right to correction** Request that inaccurate, incomplete or out-of-date information be corrected **Right to deletion** Request the erasure of their personal information under certain circumstances **Right to object to or limit processing of data** Request to opt out of processing of their data **Right to data portability:** Request data in a structured, commonly used format ### Why cookies as part of PDPA Singapore compliance Cookies that store or track personal data fall under the PDPA. While functional cookies may not require explicit consent, cookies used for analytics, advertising, or profiling generally do. You must clearly disclose the use of such cookies in a cookie policy and give users the ability to accept or reject them before they are set. ### Penalties for PDPA Singapore non-compliance Non-compliance with the PDPA can result in significant penalties. The PDPC may impose financial penalties of up to 1 million SGD or 10% of an organization’s annual turnover in Singapore, whichever is higher, depending on the severity of the breach. The commission may also issue directions to stop data collection, delete personal data, or take corrective actions. ### How to comply with the PDPA Singapore To check your compliance with the PDPA Singapore, businesses should: **Audit:** Conduct a data audit to identify all cookies and trackers on their websites **Categorize:** Categorize cookies (e.g., necessary, preference, analytics, marketing) **Consent management:** Ensure consent banners are implemented correctly, enable users to withdraw consent, and maintain consent logs **Check partners:** Review third-party data-sharing practices **Train staff:** Ensure that employees have training to understand and comply with PDPA #### Frequently Asked Questions **What is the scope of the Personal Data Protection Act (PDPA) law in Singapore?** \ The PDPA governs the collection, use, disclosure, and protection of personal data by organizations in Singapore. It applies to all private sector organizations and sets rules on how personal data must be handled to protect individuals’ privacy rights. **What is personal data under Singapore’s PDPA?** Personal data refers to any information, whether true or not, about an individual who can be identified from that data alone or together with other information held by the organization. This includes details such as name, identification number, contact information, and more. **What is sensitive data according to the PDPA in Singapore?** Sensitive data is a subset of personal data that includes information about an individual’s race, ethnic origin, political opinions, religious beliefs, health, sexual orientation, or biometric data. It requires a higher level of protection due to its sensitive nature. **Who is the regulatory authority for Singapore’s PDPA?** The Personal Data Protection Commission (PDPC) is the regulatory authority responsible for enforcing and overseeing compliance with the PDPA in Singapore. **Who is exempt from Singapore’s PDPA rules?** The PDPA does not apply to public agencies, political parties, and individuals acting in a personal or domestic capacity. Some specific activities and data types are also exempt, as outlined in the PDPA. **Where can I get more information about Singapore’s Personal Data Protection Act?** More information is available on the official website of the [Personal Data Protection Commission](http://www.pdpc.gov.sg/) (PDPC). The website offers detailed guidance, resources, and updates on the PDPA. --- # Thailand PDPA Cookie Consent and Compliance URL: https://www.cookiehub.com/pdpa-thailand Last updated: June 18, 2026 ## Thailand PDPA Cookie Consent and Compliance Under Thailand’s PDPA, cookies that collect personal data—such as identifiers, tracking information, or user preferences—require informed consent from the user before activation. Is your website set up for compliance? ### What your business needs to know about the PDPA The Personal Data Protection Act (PDPA) Thailand is a comprehensive data privacy law that came into effect on June 1, 2022. It governs the collection, use, and disclosure of personal data by both public and private entities within Thailand, as well as organizations outside Thailand that offer goods or services to individuals in the country. The PDPA is modeled after the EU’s GDPR and aims to protect the privacy rights of individuals while promoting responsible data usage. ### What does PDPA compliance require? Businesses must understand that PDPA compliance involves more than just updating privacy policies. It requires implementing systems for obtaining and managing consent, ensuring lawful data processing, enabling data subject rights (such as access and deletion requests), and maintaining data security. Organizations should also assign a Data Protection Officer (DPO) if their core activities involve regular processing of personal data on a large scale. To be in compliance, businesses operating in or serving users in Thailand must: **Consent management:** Obtain valid consent for collecting and processing personal data **Audit:** Audit all data collection practices, including consent mechanisms, data security, third-party data sharing **Update privacy policy:** Implement and keep up-to-date privacy policies ### Who needs to comply with the PDPA? All organizations that collect, use, or disclose personal data in Thailand—regardless of their location—must comply with the PDPA. This includes Thai companies, multinational corporations with Thai customers, and online platforms targeting Thai residents. Both data controllers and data processors have defined responsibilities under the law. ### Consumer rights under the PDPA Thailand’s law grants consumers various data privacy rights, including: **Right to access** Request access to their personal information **Right to be informed** Request to know how personal data is being collected and used **Right to correction** Request that inaccurate, incomplete or out-of-date information be corrected **Right to deletion** Request the erasure of their personal information under certain circumstances **Right to object to or limit processing of data** Request to opt out of processing of their data **Right to data portability** Request data in a structured, commonly used format ### Why cookies as part of PDPA compliance Cookies are treated as a form of personal data under the PDPA if they can identify an individual directly or indirectly. As such, using cookies for analytics, advertising, or personalization purposes typically requires prior user consent. Only strictly necessary cookies can be deployed without consent. Transparency, user control, and clear opt-out options are essential to align with PDPA rules. ### Penalties for PDPA non-compliance Non-compliance with the PDPA can result in significant penalties, including administrative fines up to 5 million THB, civil liabilities (including compensation for damages), and criminal penalties such as imprisonment or additional fines depending on the severity of the violation. These consequences underline the importance of proactive compliance measures. ### How to comply with the PDPA To check your compliance with the PDPA Thailand, businesses should: **Audit:** Conduct a data audit to identify all cookies and trackers on their websites **Categorize:** Categorize cookies (e.g., necessary, preference, analytics, marketing) **Consent management:** Ensure consent banners are implemented correctly, enable users to withdraw consent at any time, and maintain consent logs **Check with partner contracts:** Review third-party data-sharing practices **Train staff:** Ensure that employees have training to understand and comply with PDPA #### Frequently Asked Questions **What is the scope of the Personal Data Protection Act (PDPA) in Thailand?** The PDPA applies to the processing of personal data conducted by data controllers and data processors in Thailand. It also applies to processing personal data of individuals located in Thailand, even if the data controller or processor is outside Thailand, when the processing is for offering goods or services or monitoring behavior of individuals in Thailand. The law covers both private and public sectors, regulating collection, use, disclosure, and retention of personal data. **What is personal data under Thailand’s PDPA?** Personal data is defined as any information relating to an identified or identifiable natural person (data subject). This includes names, ID numbers, location data, online identifiers, or other information that can directly or indirectly identify a person. **What is sensitive data according to the PDPA in Thailand?** Sensitive data (also called sensitive personal data) is a subset of personal data that, if disclosed or misused, could cause harm or discrimination. Examples include racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data (for identification purposes), health data or sex life or sexual orientation data. Processing sensitive data generally requires stricter protections and explicit consent. **Who is the regulatory authority for Thailand’s PDPA?** The Personal Data Protection Committee (PDPC) is the main regulatory body overseeing enforcement, issuing guidelines, and ensuring compliance with the PDPA in Thailand. **Who is exempt from Thailand’s PDPA rules?** The PDPA includes some exemptions, such as data processing for personal or household activities without commercial or professional intent; data processed solely for journalistic, artistic, academic, or research purposes under specific conditions; and data processed for national security, public safety, or legal enforcement. Government agencies may have some exemptions depending on specific laws and circumstances. **Where can I get more information about Thailand’s PDPA?** Thailand’s Personal Data Protection Committee (PDPC) website provides the primary information about the PDPA, while government gazettes publish the legal text. Thai law firms specializing in data privacy will be best placed to advise on more specific matters. --- # Saudi Arabia PDPL Cookie Consent and Compliance URL: https://www.cookiehub.com/pdpl Last updated: June 18, 2026 ## Saudi Arabia PDPL Cookie Consent and Compliance As Saudi Arabia becomes a more attractive market and companies’ web presence there grows, the country’s personal data protection, PDPL, comes into focus.  Are you PDPL-ready? ### What your business needs to know about PDPL The Saudi Arabia Personal Data Protection Law (PDPL) governs how businesses operating in the country collect, use, store, transfer, share, and update data about residents of the kingdom. With few exceptions, personal data cannot be processed without the consent of the user/data owner, and the purpose of the processing cannot be changed. The Saudi Data and Artificial Intelligence Authority is responsible for issuing licenses to organizations whose activities fall under the purview of the PDPL. ### What does PDPL compliance require? To comply with PDPL, businesses need to manage: **Data handling policies:** Set clear policies for handling personal data **Consent:** Obtain clear consent before collecting data **Data protection:** Protect personal data from breaches **Transparency:** Provide transparency about data collection and usage **Consumer rights:** Allow individuals to exercise their rights regarding their data ### Who needs to comply with PDPL? Saudi Arabia’s PDPL applies to businesses that operate in the country and requires that they collect, use, share, store, update, or transfer data about Saudi Arabians only for the purpose of providing goods and services or for monitoring the behavior of website visitors. Like most other data protection laws, the Saudi Arabia PDPL applies to businesses even if they do not have a physical presence in the country. ### Consumer rights under the PDPL The PDPL grants Saudi residents very similar rights regarding their personal data as those set forth in other privacy laws, such as GDPR. Among these are: **Right to access** Request access to their personal data and information on how it is being processed **Right to correct** Rectify inaccuracies in their data **Right to request deletion** Request the deletion of their personal data, with certain exceptions **Right to be informed** Request to know the legal basis and purpose for collecting their data **Right to object** Object to processing of their data under certain circumstances ### Why cookies as part of PDPL compliance The_ _PDPL requires businesses to process personal data (including data collected through cookies) with user consent, except under limited circumstances. ### Penalties for PDPL non-compliance Non-compliance with Saudi Arabia's PDPL can result in significant penalties, including fines, imprisonment, and compensation claims. Violations may lead to fines of up to SAR 5 million (1.3 million USD) per breach, with the possibility of doubling for repeat offenses. Intentional disclosure of sensitive data could result in imprisonment for up to two years. Affected individuals may also pursue compensation claims. ### How to comply with the PDPL PDPL compliance and a consent-first approach can be sped along by following a number of best practices: **Conduct data audits:** Align data practices with PDPL requirements **Update privacy policies:** Ensure privacy notices make data practices, consumer rights, and how to exercise those rights clear to consumers **Implement consent management:** Control cookie consent and oversight with a comprehensive consent management platform like CookieHub **Employee training:** Make sure staff know the importance of data privacy and what steps they can take to support PDPL compliance #### Frequently Asked Questions **What is the scope of the Saudi Arabia Personal Data Protection Law (PDPL)?** The PDPL applies to the processing of personal data by both public and private entities operating within Saudi Arabia. It also extends to entities outside the Kingdom if they process personal data related to individuals located in Saudi Arabia. The law aims to protect individuals’ privacy and regulate how personal data is collected, used, stored, and shared. **What is personal data under PDPL?** Under the PDPL, personal data refers to any information—regardless of its source or form—that can identify an individual directly or indirectly. This includes data such as names, identification numbers, contact details, and personal characteristics. **What is sensitive data according to the PDPL?** Sensitive data is a specific category of personal data that requires higher protection due to its nature. According to the PDPL, this includes data related to an individual’s racial or ethnic origin, religious or philosophical beliefs, political opinions, health, genetic and biometric information, and criminal records. **Who is the regulatory authority for Saudi Arabia’s PDPL?** The Saudi Data & Artificial Intelligence Authority (SDAIA), through its National Data Management Office (NDMO), is responsible for overseeing and enforcing the PDPL. SDAIA issues regulations, monitors compliance, and provides guidance on best practices for data protection. **Who is exempt from PDPL rules?** Certain exemptions apply under the PDPL. These include personal data processing for non-commercial personal use, and data handled for security or judicial purposes. Government entities may also be exempt in specific scenarios, especially where national security or public interest is involved. **Where can I get more information about the Saudi Arabia Personal Data Protection Law?** For official information, resources, and regulatory guidance, you can visit the website of the [National Data Management Office](https://sdaia.gov.sa/en/default.aspx) (NDMO). Updates and enforcement details are also available through the Saudi Data & Artificial Intelligence Authority (SDAIA). --- # Egypt PDPL Compliance & Cookie Consent | Personal Data Law 151/2020 URL: https://www.cookiehub.com/pdpl-egypt Last updated: June 18, 2026 ## Egypt PDPL Cookie Consent and Compliance Egypt’s Personal Data Protection Law (PDPL) requires organizations to **obtain **explicit consent before processing personal data, including through cookies and other online tracking technologies. Businesses operating in or targeting Egypt must ensure that their websites and digital platforms comply with PDPL requirements for data transparency and consent. Is your website ready for compliance? ### What your business needs to know about PDPL Egypt The Personal Data Protection Law No. 151/2020 establishes the legal framework for the collection, processing, storage, and transfer of personal data in Egypt. Similar to and aligned with the EU’s GDPR, it aims to safeguard individuals’ data privacy rights while supporting responsible data use by businesses. Under PDPL Egypt, organizations must obtain prior explicit consent from individuals before collecting or processing personal data, unless another lawful basis applies (e.g., legal obligation, contract performance, or legitimate interest). Data subjects must be clearly informed about how their data is collected, why it is processed, how long it will be retained, and with whom it will be shared. Cross-border data transfers are strictly regulated and may require prior approval from the Egyptian Data Protection Center (EDPC) or the explicit consent of the data subject. ### What does PDPL Egypt compliance require? To check compliance with PDPL, your organization should review how personal data is collected, processed, and stored; ensure your cookie banners, privacy notices, and consent mechanisms are clear, accurate, and compliant; conduct regular compliance audits and vendor assessments, especially for analytics and marketing tools; provide staff training on PDPL principles and data-handling practices. **Review data handling:** Review how personal data is collected, processed, and stored **Manage cookie banners:** Ensure your cookie banners, privacy notices, and consent mechanisms are clear, accurate, and compliant **Audit and assess:** Conduct regular compliance audits and vendor assessments, especially for analytics and marketing tools **Train staff:** Provide staff training on PDPL principles and data-handling practices. ### Who needs to comply with the PDPL Egypt? All organizations across the public, private and non-profit sectors that process personal data of individuals located in Egypt must comply. This applies to both local and foreign businesses, online platforms, and international service providers targeting Egyptian users. If your website serves Egyptian users, PDPL compliance is a must. ### Consumer rights under PDPL Egypt Under the PDPL, individuals (data subjects) in Egypt are granted the following rights: **Right to be informed** To know what personal data is being collected, for what purposes, and with whom it is shared. **Right to access** To learn whether their personal data is processed and to request access to it. **Right to rectification** To request corrections of incomplete or inaccurate personal data. **Right to erasure (right to be forgotten)** To request deletion of personal data if the purposes of processing are no longer valid or consent is withdrawn. **Right to restrict processing** To request limitation of processing in certain circumstances. **Right to object** To object to the processing of personal data, including for marketing or profiling purposes. **Right to data portability** To request transfer of personal data to another controller, where technically feasible. **Right to compensation** To seek compensation for damages caused by unlawful data processing ### Why cookies as part of PDPL Egypt compliance Cookies and similar tracking technologies are considered a form of personal data processing under PDPL when they identify or can be linked to an individual. Essential cookies required for website functionality do not require consent, but analytics, advertising, and personalization cookies generally do. Websites must clearly disclose cookie usage, provide granular consent options, and allow users to withdraw consent easily at any time. ### Penalties for PDPL Egypt non-compliance Failure to comply with PDPL Egypt can result in: - Administrative fines of up EGP 2 million - Orders to suspend or restrict data processing activities - Mandatory data deletion or correction of unlawful processing - Reputational damage and potential loss of consumer trust ### How to comply with the PDPL Egypt To check your compliance with the PDPL Egypt, businesses should: **Audit:** Audit their data to identify all cookies and trackers on their websites **Categorize:** Classify cookies into categories (e.g., necessary, functional, analytics, marketing) **Implement consent:** Implement compliant consent banners and check they are working correctly and enable easy opt-ins and opt-outs **Keep logs:** Keep consent records and make withdrawal of consent straightforward **Manage third parties:** Review third-party data-sharing practices **Keep up to date:** Update your privacy and cookie policies for transparency **Provide training:** Train employees on data protection responsibilities under PDPL #### Frequently Asked Questions **What is the scope of the Personal Data Protection Law (PDPL) in Egypt?** The Personal Data Protection Law No. 151 of 2020 (PDPL) governs the collection, processing, storage, transfer, and use of personal data in Egypt. It applies to both public and private entities that handle personal data of individuals located in Egypt, regardless of whether the data processing takes place inside or outside the country. The PDPL aims to protect individuals’ privacy rights and regulate how organizations handle personal data, establishing key principles such as transparency, consent, data minimization, and accountability in all data processing activities. **What is personal data under Egypt’s Personal Data Protection Law?** Under the PDPL, personal data refers to any information related to an identified or identifiable natural person. This includes any data that can directly or indirectly identify a person, such as: - Name, address, phone number, or email - Identification numbers such as national ID, passport, or driver’s license - Financial, health, or family data - Online identifiers (e.g., IP addresses or digital profiles) The law distinguishes between personal data and sensitive personal data, requiring stricter protection for the latter. **What is sensitive personal data according to Egypt’s PDPL?** Sensitive personal data includes information that, if disclosed or misused, could harm an individual or result in discrimination. Examples include: - Health condition or medical records - Genetic or biometric data - Religious or political beliefs - Criminal records - Financial data - Children’s data The processing of sensitive personal data generally requires the explicit written consent of the data subject, except in specific cases permitted by the law (e.g., for public interest, health protection, or judicial purposes). **Who is the regulatory authority for Egypt’s Personal Data Protection Law?** The Egyptian Data Protection Center (EDPC), under the Ministry of Communications and Information Technology, is the primary regulatory authority responsible for enforcing the PDPL. The EDPC’s roles include: - Supervising and ensuring compliance with the PDPL and its executive regulations - Issuing licenses and permits for data controllers and processors - Handling complaints and investigating data breaches - Promoting awareness and providing guidance on data protection practices **Who is exempt from the PDPL rules?** Certain types of data processing are exempt from the PDPL, including: - Processing carried out by individuals for personal or household purposes - Processing necessary for national security or defense purposes - Processing for judicial, prosecutorial, or law enforcement functions - Processing for media, artistic, or literary purposes, provided freedom of expression is upheld - Processing of anonymized or aggregated statistical data These exemptions are subject to conditions and oversight as defined by the executive regulations. **What are the penalties for violating Egypt’s PDPL?** Violations of the PDPL can result in administrative fines and criminal penalties, depending on the nature and severity of the breach. Organizations that process personal data without proper consent, transfer data abroad without approval, or fail to implement adequate data security measures may face substantial fines and possible imprisonment for responsible individuals. **Where can I get more information about Egypt’s Personal Data Protection Law?** For official updates, guidance, and regulatory details, visit the Ministry of Communications and Information Technology (MCIT) website or refer to the executive regulations of Law No. 151 of 2020, which outline the detailed compliance and enforcement procedures. --- # Indonesia PDP Law Cookie Consent and Compliance URL: https://www.cookiehub.com/pdpl-indonesia Last updated: June 18, 2026 ## Indonesia PDP Law Cookie Consent and Compliance Modeled after the EU’s GDPR, the Personal Data Protection Law governs the processing, collection, storage, and transfer of personal data within and outside Indonesia. It applies to both electronic and non-electronic systems and aims to strengthen individual privacy rights while regulating how businesses manage personal data. Is your website ready for compliance? ### What your business needs to know about the Personal Data Protection Law Indonesia Indonesia's Personal Data Protection Law (PDPL), enacted in 2022 and effective from October 2024 after a two-year transition period, is the country’s first comprehensive data protection regulation. ### What does Personal Data Protection Law Indonesia compliance require? Businesses must obtain valid consent before processing personal data, ensure data security, appoint a Data Protection Officer (DPO) under certain conditions, notify authorities and users in case of data breaches, and fulfill data subject rights including access, correction, deletion, and withdrawal of consent. Cross-border data transfers are permitted but require safeguards and coordination with Indonesia’s data protection authority. To be in compliance with PDPL Indonesia, businesses should: **Review data practices:** Implement robust data governance policies and publish and keep up-to-date a comprehensive Privacy Policy **Implement consent management:** Obtain proper consent for collecting and processing personal data and ensure consumers can withdraw consent easily **Audit:** Audit all data collection practices, including consent mechanisms, data security, third-party data sharing **Data minimization:** Adhere to data minimization principles, collecting only what data is required and using it only for the stated purposes **Data security:** Secure data against breaches and unauthorized access ### Who needs to comply with the Personal Data Protection Law Indonesia? The PDPL applies to any organization—local or foreign—that processes personal data within Indonesia or targets goods and services to individuals in Indonesia. This includes companies operating websites or apps accessible by Indonesian users. ### Consumer rights under the Personal Data Protection Law Indonesia The PDPL Indonesia gives consumers various data privacy rights, including: **Right to access** Request access to their personal information **Right to be informed** Request to know how personal data is being collected and used **Right to correction** Request that inaccurate, incomplete or out-of-date information be corrected **Right to deletion** Request the erasure of their personal information under certain circumstances **Right to lodge a complaint and seek compensation** File a complaint to the relevant data protection authority and seek damages for violations **Right to not be subject to automated decision-making** Request to be free from data processing and profiling that can lead to automated decision-making ### Why cookies as part of Personal Data Protection Law Indonesia compliance Under the PDPL, cookies are considered a form of personal data when they can be used to identify individuals, either directly or indirectly. Therefore, businesses using tracking, advertising, or analytical cookies must inform users clearly and obtain explicit, informed consent before collecting or processing such data. ### Penalties for Personal Data Protection Law Indonesia non-compliance Non-compliance with the PDPL can result in administrative sanctions such as warnings, suspension of data processing, fines, and even criminal penalties including imprisonment and monetary penalties up to 2% of annual revenue, depending on the severity of the violation. ### How to comply with the Personal Data Protection Law Indonesia Some best practices to bring your data privacy approach in line with PDPL compliance include: **Audit:** Conduct a data audit to identify all cookies and trackers on their websites **Categorize:** Categorize cookies (e.g., necessary, preference, analytics, marketing) **Implement consent management:** Ensure consent banners are implemented correctly, enable users to withdraw consent at any time, and maintain consent logs **Review partner and third-party contracts:** Review third-party data-sharing practices **Train staff:** Ensure that employees have training to understand and comply with PDPL #### Frequently Asked Questions **What is the scope of the Personal Data Protection Law (PDPL) in Indonesia?** The PDPL applies to the processing of personal data within Indonesia, as well as to Indonesian entities processing personal data abroad. It covers all sectors and governs how personal data must be collected, used, stored, and shared to protect individuals’ privacy rights. **What is personal data under Indonesia’s PDPL?** Personal data refers to any information related to an identified or identifiable individual, either directly or indirectly. This includes names, identification numbers, location data, online identifiers, or any data that can reveal a person’s identity. **What is sensitive data according to the PDPL in Indonesia?** Sensitive data includes special categories of personal data that require higher protection due to their nature. This typically covers data on race, ethnicity, religion, health, genetic data, sexual orientation, political views, and other information that could lead to discrimination or harm if disclosed. **Who is the regulatory authority for Indonesia’s PDPL?** The regulatory authority overseeing the implementation and enforcement of the PDPL is the Personal Data Protection Authority (PDPA) of Indonesia. **Who is exempt from Indonesia’s PDPL rules?** Certain activities and entities may be exempt, such as personal data processed for personal or household activities, government intelligence or national security purposes, and some law enforcement activities. Specific exemptions are detailed within the law. **Where can I get more information about Indonesia’s Personal Data Protection Law?** For more detailed information, you can visit the official website of Indonesia’s Personal Data Protection Authority or consult legal resources specializing in Indonesian data protection regulations. --- # Vietnam PDPL Cookie Consent and Compliance URL: https://www.cookiehub.com/pdpl-vietnam Last updated: September 24, 2026 ## Vietnam PDPL Cookie Consent and Compliance Under the Personal Data Protection Law (PDPL) Vietnam, in effect since 1 January 2026, a unified approach to the collection, use, or disclosure of personal data is harmonized for consent. Is your website ready for compliance? ### What your business needs to know about the PDPL Vietnam The Personal Data Protection Law (PDPL) is Vietnam’s first comprehensive approach to enacting a unified data protection law within a single legal framework to protect personal data. It governs the collection, use, disclosure, and care of personal data by organizations, aiming to protect individuals’ personal data while enabling legitimate business use, recognizing that protecting personal data is an important economic driver for the country. ### What does PDPL Vietnam compliance require? If your website uses cookies that track users' behavior, preferences, or identity (such as analytics or marketing cookies), you must obtain clear and informed consent before activating those cookies. This aligns with the PDPL’s emphasis on notifying individuals and obtaining their permission before collecting personal data. Taking its cues from GDPR, Vietnam’s PDPL relies on the requirement to inform individuals of the purposes for collecting personal data, obtain their consent, and ensure that data is properly protected. Any third-party services used (e.g., for marketing or analytics) must also comply with PDPL standards. To be in compliance, businesses operating in or serving users in Vietnam must follow six key principles: **Review data practices:** Comply with Vietnam’s constitution, the PDPL and relevant laws **Purpose limitation:** Collect and process personal data within a specific, clear and lawful scope and purpose **Accuracy and storage limitation:** Ensure personal data is accurate and that personal data is stored only for the period allowed for the purpose of processing **Data security:** Protect personal data effectively through institutional, technical and human means **Guard against violations:** Proactively detect and prevent violations of personal data protections and act swiftly to handle and resolve any such violations **Balance national interests and rights:** Protect personal data in alignment with the balance between personal data protection and the protection of legitimate rights held by agencies, organizations and individuals ### Who needs to comply with the PDPL Vietnam? The PDPL applies to all organizations and individuals—both domestic and international—that process personal data of individuals in Vietnam. This means that foreign companies offering services or operating digital platforms accessible to Vietnamese users must also comply. Non-profit organizations, startups, and large enterprises alike fall under its scope. ### Consumer rights under the PDPL Vietnam Vietnam’s law grants consumers various data privacy rights, including: **Right to access** Individuals can request access to their personal data held by an organization and obtain information about how it is being processed. **Right to be informed and consent or withdraw consent** Individuals must be informed about what personal data is being collected, the purpose of processing, retention period, and whether their data will be shared or transferred abroad. Data can only be collected and processed with prior, explicit, and voluntary consent. Consent must be separate for each purpose of processing, and individuals can refuse consent without being denied basic services. At any time, individuals can withdraw their consent to the collection and processing of personal data. **Right to correction or rectification** Individuals can request corrections of updates to their personal data to ensure accuracy. **Right to erasure (right to be forgotten)** Consumers can request the deletion of their personal data when it is no longer needed for stated purposes, when consent has been withdrawn, or the processing is unlawful. **Right to object to or limit processing of data** Individuals can request that organizations limit how their personal data is used, for example, only storing it but not actively processing it, and to object to their personal data being used for certain purposes, such as direct marketing, profiling, or automated decision-making. **Right to data portability** Individuals can request that their personal data be provided in a structured, machine-readable format, or transferred to another organization. **Right to complain, denounce, and seek compensation** Individuals can file complaints with the Ministry of Public Security if they believe their data rights have been violated. They may also seek compensation if misuse of their personal data causes damage. **Right to protection of sensitive data** Individuals have heightened rights in cases where sensitive data is in question, such as financial, health, biometric, or political data. Organizations must implement stricter safeguards relative to these kinds of data. ### Why cookies as part of PDPL Vietnam compliance Cookies that store or track personal data fall under the PDPL. Cookies and tracking technologies that process personal data (such as IP addresses, browsing activity, or profiling data) fall within the scope of the PDPL. Functional cookies necessary for website operations may be exempt from consent, but all other cookies—particularly those for analytics, advertising, and behavioral tracking—require clear disclosure and prior user consent. A transparent cookie policy and consent banner are essential for compliance. ### Penalties for PDPL Vietnam non-compliance Non-compliance with the PDPL can result in penalties. Depending on the severity of the breach, organizations may face administrative fines, suspension of data processing activities, or even criminal liability in serious cases. While specific fine amounts are subject to implementing decrees, non-compliance may also result in reputational damage and operational restrictions, especially for businesses handling sensitive or large-scale data. ### How to comply with the PDPL Vietnam To check your compliance with the PDPL Vietnam, businesses should: **Audit:** Conduct a data audit to identify all cookies and trackers on their websites **Categorize:** Categorize cookies (e.g., necessary, preference, analytics, marketing) **Implement consent:** Ensure consent banners are implemented correctly, enable users to withdraw consent at any time, and maintain consent logs and enable users to withdraw consent at any time **Check with partners:** Review third-party data-sharing practices **Train staff:** Ensure that employees have training to understand and comply with PDPL #### Frequently Asked Questions **What is the scope of Vietnam’s PDPL?** The PDPL regulates the processing of personal data by individuals and organizations in Vietnam, including foreign entities directly involved in processing the personal data of Vietnamese citizens—or persons of Vietnamese origin residing in Vietnam—even if those entities are located outside the country. **What counts as "personal data" under the PDPL?** The PDPL classifies personal data into two categories: - **Basic personal data**, such as names, date of birth, contact information, national ID numbers, photographs, family relationships, digital account details, and more. - **Sensitive personal data**, including political opinions, religious beliefs, medical conditions, ethnicity, biometric or genetic data, sexual orientation, criminal records, financial account data, real-time location, and other unique identifiers requiring enhanced protection. **What is sensitive personal data according to the PDPL?** Sensitive data includes particularly private information—such as health and medical records, ethnicity, genetic/biometric data, sexual orientation, financial and criminal records, real-time location, and other personally identifying or sensitive categories as specified by law. **Who is the regulatory authority for Vietnam’s PDPL?** The Ministry of Public Security (MPS), through its Department of Cybersecurity and High‑Tech Crime Prevention, is the main regulatory and enforcement body overseeing data protection under PDPL and related decrees. **Who is exempt from PDPL rules?** Routine personal or household data processing is exempt, so long as the data isn’t shared with third parties or used commercially. Some additional exemptions may apply for specific contexts (e.g., governmental or emergency processing), as clarified in the implementing decrees, such as Decree No. 356/2025/ND-CP. **What legal bases authorize personal data processing?** Processing is lawful if based on: - The data subject’s voluntary consent (clear, explicit, specific, and removable) - Performance of a contract - Legal obligations - Protecting the vital interests of the individual - Public interest, especially concerning national security or public safety - Other sectoral legal bases as specified by law **Where can I get more information about Vietnam’s PDPL?** Detailed information, guidance, and updates are provided by the Ministry of Public Security, especially through: - The guiding decree, Decree No. 356/2025/ND-CP, issued on 31 December 2025 - The sanction decree outlining penalties These offer clarity on aspects like data categorization, breach reporting, DPO rules, impact assessments, and more --- # Hong Kong PDPO Cookie Consent and Compliance URL: https://www.cookiehub.com/pdpo Last updated: June 18, 2026 ## Hong Kong PDPO Cookie Consent and Compliance The Personal Data (Privacy) Ordinance (PDPO) in Hong Kong requires organizations that collect, process, or store personal data to uphold stringent privacy protections, including transparency in the use of cookies that track user behavior. Is your website ready for compliance? ### What your business needs to know about the PDPO The Personal Data (Privacy) Ordinance (Cap. 486) is the main data protection legislation in Hong Kong, first enacted in 1996 and enforced by the Office of the Privacy Commissioner for Personal Data (PCPD). It governs the collection, use, and handling of personal data through six Data Protection Principles (DPPs), emphasizing transparency, purpose specification, and data security. ### What does PDPO compliance require? Businesses operating in or targeting individuals in Hong Kong must comply with the PDPO when handling personal data. This includes implementing clear consent practices, limiting data use to stated purposes, and ensuring secure data storage. For websites, it's essential to disclose how cookies collect user data and to provide options for consent and control. Non-local companies serving Hong Kong residents may also fall under PDPO jurisdiction. Websites using cookies to gather personal data must provide clear notices and obtain user consent, aligning with the principles of fair and lawful collection under the PDPO. Ensuring cookie consent is compliant with the PDPO is a key step in protecting consumer rights and maintaining trust. To be in compliance with PDPO Hong Kong, businesses should: **Review data practices:** Implement robust data governance policies and publish **Update privacy policy:** Keep up-to-date a comprehensive Privacy Policy **Implement consent management:** Obtain proper consent for collecting and processing personal data and ensure users can withdraw consent **Audit:** Audit all data collection practices, including consent mechanisms, data security, third-party data sharing **Data minimization:** Adhere to data minimization principles, collecting only what data is required and using it only for the stated purposes ### Who needs to comply with the PDPO? Any individual or organization that collects, holds, processes, or uses personal data in Hong Kong must comply with the PDPO. This includes both private businesses and public entities, as well as foreign companies offering goods or services to Hong Kong residents. If your business handles personal data related to Hong Kong individuals, PDPO compliance is mandatory. ### Consumer rights under the PDPO The PDPO gives consumers various data privacy rights, including: **Right to access** Request access to their personal information **Right to be informed** Request to know how personal data is being collected and used **Right to correction** Request that inaccurate, incomplete or out-of-date information be corrected **Right to deletion** Request the erasure of their personal information under certain circumstances **Right to opt out of marketing** Request withdrawal of consent for direct marketing and removal from marketing lists **Right to data breach notification** Notification in the event of a data breach or unauthorized access to affected individuals ### Why cookies as part of PDPO compliance Under the PDPO, cookies that collect personal data—such as tracking user behavior, preferences, or location—may constitute personal data collection. Organizations must inform users about the purpose of such data collection, the types of data collected, and whether the data will be transferred to third parties. Explicit or implied consent should be obtained before using such cookies, in accordance with the PDPO’s transparency requirements. ### Penalties for PDPO non-compliance Non-compliance with the PDPO can lead to enforcement actions by the PCPD, including enforcement notices, public reprimands, and in serious cases, criminal prosecution. Penalties may include fines of up to HK$50,000 and imprisonment for up to two years for individuals, with additional daily fines for continuing offenses. Civil claims for damages may also be pursued by affected individuals. ### How to comply with the PDPO Some best practices to bring your data privacy approach in line with PDPO compliance include: **Audit:** Conduct a data audit to identify all cookies and trackers on their websites **Categorize:** Categorize cookies (e.g., necessary, preference, analytics, marketing) **Implement consent:** Ensure consent banners are implemented correctly, ensure users can withdraw consent at any time, and maintain consent logs and enable **Check partners and third parties:** Review third-party data-sharing practices **Train employees:** Ensure that employees have training to understand and comply with PDPO #### Frequently Asked Questions **What is the scope of the Personal Data Privacy Ordinance (PDPO) in Hong Kong?** The PDPO governs the collection, handling, processing, and use of personal data in Hong Kong. It applies to both public and private sector organizations that control or process personal data, ensuring that individuals' privacy rights are protected. The Ordinance sets out data protection principles that must be followed when managing personal data. **What is personal data under the PDPO?** Under the PDPO, personal data refers to any data that relates directly or indirectly to a living individual that could foreseeably lead to the identification of the individual and which is in a form that makes access to and processing of the data feasible. Examples include names, phone numbers, ID card numbers, addresses and so on. **What is sensitive data according to the PDPO?** The PDPO does not explicitly define or provide special treatment for "sensitive data" as found in some other jurisdictions. However, certain types of personal data, such as identity card numbers, medical records, and biometric data, may require extra care due to their sensitive nature and higher risk of harm if mishandled. **Who is the regulatory authority for Hong Kong’s PDPO?** The Office of the Privacy Commissioner for Personal Data (PCPD) is the independent statutory body responsible for enforcing the PDPO, promoting awareness of data protection rights, and handling complaints and investigations related to personal data privacy. **Who is exempt from PDPO rules?** Certain exemptions apply under the PDPO, including domestic or household purposes (e.g., keeping personal contact lists), data processed for news activities by news media, data held for academic, research, or statistical purposes under specific conditions, or legal and security-related exemptions, such as for crime prevention or legal proceedings. These exemptions are subject to conditions and are not blanket exclusions. **Where can I get more information about Hong Kong’s Personal Data Privacy Ordinance?** \ You can visit the [Office of the Privacy Commissioner for Personal Data](https://www.pcpd.org.hk/) (PCPD) website for official guidelines, resources, and updates related to the PDPO. --- # South Korea PIPA Cookie Consent and Compliance URL: https://www.cookiehub.com/pipa Last updated: June 18, 2026 ## South Korea PIPA Cookie Consent and Compliance South Korea’s Personal Information Protection Act (PIPA) mandates that websites and digital services obtain user consent before collecting personal data through cookies or other tracking technologies. This means businesses must transparently disclose what data they collect, how it's used, and allow users to opt in or out of non-essential cookies. Is your website ready for consent management requirements? ### What your business needs to know about the PIPA The Personal Information Protection Act (PIPA) is South Korea’s main data protection law, enacted in 2011 and significantly amended in 2020 and 2023. It regulates the collection, use, and processing of personal data by both public and private sectors and is considered one of the strictest data protection laws in Asia. ### What does PIPA compliance require? Businesses handling personal data of individuals in South Korea must follow strict rules under the PIPA, including obtaining consent for data collection, providing clear privacy notices, securing data appropriately, and responding to data subject rights such as access and deletion. Even companies located outside Korea may fall under the law if they target Korean users. To be in compliance with PIPA South Korea, businesses should: **Update privacy policy:** Publish and keep up-to-date a comprehensive Privacy Policy **Implement consent management:** Obtain proper consent for collecting and processing personal data **Audit:** Audit all data collection practices, including consent mechanisms, data security, third-party data sharing **Data minimization:** Adhere to data minimization principles, collecting only what data is required and using it only for the stated purposes **Protect data:** Secure data against breaches and unauthorized access ### Who needs to comply with the PIPA? Any organization—domestic or international—that collects, processes, or stores personal data of individuals located in South Korea must comply with PIPA. This includes websites, mobile apps, SaaS providers, and e-commerce businesses that serve Korean users. ### Consumer rights under the PIPA The PIPA gives consumers in South Korea various data privacy rights, including: **Right to access** Request access to their personal information and information about its use **Right to correction** Request that inaccurate, incomplete or out-of-date information be corrected **Right to deletion** Request the erasure of their personal information under certain circumstances **Right to opt out of marketing** Request withdrawal of consent for direct marketing and removal from marketing lists **Right to data portability** Request to receive data collected in a user-friendly manner **Right to refuse automated decision-making** Request to refuse decisions based solely on automated processes ### Why cookies as part of PIPA compliance Under PIPA, cookies that collect identifiable or behavioral data are considered personal information, requiring user consent. Consent must be specific, informed, and obtained prior to the deployment of such cookies. Simply notifying users or offering an opt-out after cookies have been set is not sufficient under PIPA. ### Penalties for PIPA non-compliance Non-compliance with PIPA can result in severe penalties, including administrative fines up to 3% of annual revenue related to the violation, criminal sanctions, and civil damages. Reputational harm and restrictions on business operations may also follow regulatory enforcement actions. ### How to comply with the PIPA Some best practices to bring your data privacy approach in line with PIPA compliance include: **Audit:** Conduct a data audit to identify all cookies and trackers on their websites **Categorize:** Categorize cookies (e.g., necessary, preference, analytics, marketing) **Implement consent management:** Ensure consent banners are implemented correctly, enable users to withdraw consent at any time, and maintain consent logs **Check partner and third-party contract:** Review third-party data-sharing practices **Train staff:** Ensure that employees have training to understand and comply with PIPA #### Frequently Asked Questions **What is the scope of the Personal Information Protection Act (PIPA) in South Korea?** The PIPA applies to any organization—public or private—that collects, uses, or processes personal information of individuals located in South Korea. It governs both online and offline data processing and applies regardless of where the data handler is located, as long as they handle personal information of South Korean residents. **What is personal data under the PIPA?** Under PIPA, personal data refers to any information relating to a living individual that can identify the person, either directly (e.g., name, resident registration number) or indirectly (e.g., combination of data elements such as gender, job, and address). This includes data that can be combined with other information to identify an individual. **What is sensitive data according to the PIPA?** Sensitive data is a special category of personal information that includes details such as an individual’s health records, genetic data, biometric data, criminal records, ideology, beliefs, political opinions, sexual orientation, and other information that could significantly impact an individual’s privacy. Processing sensitive data generally requires explicit consent. **Who is the regulatory authority for South Korea’s PIPA?** The Personal Information Protection Commission (PIPC) is the main regulatory authority responsible for overseeing compliance with PIPA. The PIPC has the authority to investigate, enforce, and issue penalties for violations of the law. **Who is exempt from PIPA rules?** Some exceptions to PIPA may apply to personal information processed by individuals for purely personal or household purposes; media organizations when handling information for journalistic purposes, provided it aligns with the principle of freedom of the press; certain government functions may have tailored rules or exemptions under related laws. **Where can I get more information about South Korea’s Personal Information Protection Act?** You can find more information on the official website of the [Personal Information Protection Commission](https://www.pipc.go.kr/) (PIPC). The site provides resources, guidelines, and updates related to the enforcement and interpretation of PIPA. --- # Alberta PIPA Cookie Consent and Compliance URL: https://www.cookiehub.com/pipa-alberta Last updated: June 16, 2026 ## Alberta PIPA Cookie Consent and Compliance Under Alberta's Personal Information Protection Act (PIPA), businesses must obtain meaningful consent before collecting personal information, including through website cookies. Are you compliant? ### What your business needs to know about the Alberta’s PIPA The Personal Information Protection Act (PIPA) in Alberta is a provincial privacy law that governs the collection, use, and disclosure of personal information by private-sector organizations. It aims to protect individuals’ personal information while allowing reasonable business activities to continue. Enforced by the Office of the Information and Privacy Commissioner of Alberta, the law has been in effect since January 1, 2004. If your website uses cookies that track user behavior or collect identifiers like IP addresses, you are obligated to notify users and secure their consent before activating non-essential cookies. This includes implementing clear cookie banners and privacy policies that outline what data is collected and why. ### What does PIPA Alberta compliance require? To be compliant with PIPA Alberta, do the following: **Conduct an audit:** Perform a full audit of data collection and sharing practices and identify personal data collected and its purposes **Update privacy policy:** Review and update privacy and cookie policies with PIPA-specific disclosures. **Implement consent management:** Implement cookie consent banners and opt-out flows to automate consent capture and preference management **Ensure data minimization:** Limit data collection to what is necessary for legitimate business purposes **Ensure consumer rights:** Inform individuals about why and how their personal information is collected and used, and establish mechanisms to respond to consumer rights requests within 45 days **Perform Data Protection Assessments:** Safeguard privacy with regard to targeted advertising, data sales, profiling, or processing sensitive data. ### Who needs to comply with the PIPA Alberta? PIPA Alberta applies to: - Private sector organizations operating in Alberta. - Non-profits and professional associations engaged in commercial activities. - Out-of-province businesses handling data of Alberta residents. It does not apply to public bodies (governed by FOIP), or federal works and undertakings (covered under Canada’s federal PIPEDA law). ### Consumer rights under Alberta’s PIPA Under Alberta’s PIPA, consumers (individuals) have the following rights: **Right to be informed** Consumers can know about data collection and its purposes. **Right to consent** Consumers must consent to the collection, use, and disclosure of personal information. **Right to access** Consumers can access their own personal data held by an organization. **Right to request corrections** Consumers can rectify inaccurate or incomplete information. **Right to withdraw consent** Consumers can, at any time, withdraw consent, subject to legal or contractual limitations. **Right to data protection** Consumers have the right to data protection, requiring organizations to implement appropriate safeguards. **Right to file complaints** Consumers can complain to the Office of the Information and Privacy Commissioner of Alberta. ### Why cookies as part of PIPA Alberta compliance Cookies that collect or use personal information such as device identifiers, location data, or browsing behavior fall under the scope of PIPA. This means: - You must disclose the use of such cookies in your privacy or cookie policy. - You need user consent before setting non-essential cookies. - Users should have the option to withdraw or manage their cookie preferences at any time. ### Penalties for PIPA Alberta non-compliance Failure to comply with PIPA Alberta can lead to: - Mandatory orders to change your data handling practices. - Reputational damage due to published Commissioner findings. - Legal actions or fines, including penalties up to $100,000 for serious violations. The Commissioner has broad authority to investigate complaints, audit organizations, and enforce compliance. ### How to comply with the PIPA Alberta To check your compliance with the PIPA Alberta, organizations should: **Audit:** Conduct a data audit to identify all cookies and trackers on their websites **Categorize:** Categorize cookies (e.g., necessary, preference, analytics, marketing) **Implement consent management:** Ensure consent banners are implemented correctly with granular choices, enable users to withdraw consent at any time, and maintain consent logs **Check third-party contracts** Review third-party data-sharing practices #### Frequently Asked Questions **What is the scope of the Personal Information Protection Act (PIPA) in Alberta, Canada?** PIPA Alberta applies to private sector organizations and non-profits engaged in commercial activities within the province. **What is personal data under PIPA?** Personal data includes any information that identifies or could identify an individual, such as names, addresses, email addresses, IP addresses, and demographic details. **What is sensitive data according to the PIPA?** While PIPA does not explicitly define “sensitive data,” health, financial, or biometric data is considered more sensitive and requires higher protection. **Who is the regulatory authority for Alberta’s PIPA?** The Office of the Information and Privacy Commissioner of Alberta (OIPC AB) enforces the Act. **Who is exempt from PIPA rules?** Public bodies, individuals collecting data for personal use, and federal organizations governed by Canada’s PIPEDA are exempt. **Where can I get more information about the Alberta Personal Information Protection Act?** You can visit the OIPC Alberta website for legislation details, guidance, and tools. --- # British Columbia PIPA Cookie Consent and Compliance URL: https://www.cookiehub.com/pipa-bc-canada Last updated: June 16, 2026 ## British Columbia PIPA Cookie Consent and Compliance Under the Personal Information Protection Act (PIPA) of British Columbia, organizations must obtain meaningful consent from individuals before collecting, using, or disclosing their personal information. This includes online identifiers collected through cookies. Do you have control over consent management? ### What your business needs to know about the British Columbia’s PIPA The Personal Information Protection Act (PIPA) of British Columbia is a provincial privacy law that governs how private sector organizations collect, use, and disclose personal information. Enacted in 2004, PIPA BC aims to balance individuals’ right to privacy with an organization's need to collect and use personal information for reasonable business purposes. To ensure compliance, businesses operating websites accessible to BC residents must implement cookie banners that inform users about the use of cookies and allow them to opt-in or opt-out. ### \ What does PIPA BC compliance require? To be compliant with PIPA BC you should: **Conduct an audit:** Perform a full audit of data collection and sharing practices and identify personal data collected and its purposes **Update privacy policy:** Review and update privacy and cookie policies with PIPA-specific disclosures. **Implement consent management:** Implement cookie consent banners and opt-out flows to automate consent capture and preference management **Ensure data minimization:** Limit data collection to what is necessary for legitimate business purposes **Ensure consumer rights:** Inform individuals about why and how their personal information is collected and used, and establish mechanisms to respond to consumer rights requests within 45 days **Perform Data Protection Assessments:** Safeguard privacy with regard to targeted advertising, data sales, profiling, or processing sensitive data. ### Who needs to comply with PIPA British Columbia? PIPA BC applies to: - Private sector organizations in British Columbia - Businesses outside BC that handle the personal information of BC residents - Non-profits, associations, and societies that collect personal data in connection with commercial activities Exemptions include employees acting in a personal capacity and data handled solely for journalistic, artistic, or literary purposes. ### Consumer rights under British Columbia’s PIPA Residents of British Columbia are granted several key rights under PIPA regarding their personal information, including: **Right to be informed** Consumers have the right to be told why their personal information is being collected, used, or disclosed at or before the time of collection. **Right to consent** Organizations must obtain meaningful consent (explicit or implied, depending on the situation) before collecting, using, or disclosing personal information. **Right to access personal information** Consumers can request access to their personal information held by an organization, including details on how it is being used and to whom it has been disclosed. **Right to request correction** Individuals have the right to request corrections to their personal information if it is inaccurate or incomplete. **Right to withdraw consent** Consumers may withdraw their consent at any time, subject to legal or contractual restrictions and reasonable notice. **Right to file a complaint** Individuals can file a complaint with the Office of the Information and Privacy Commissioner for British Columbia (OIPC BC) if they believe their rights under PIPA have been violated. **Right to data security** Consumers have the right to expect that their personal information will be protected by appropriate security measures to prevent unauthorized access, collection, use, disclosure, or destruction. **Right to minimal and reasonable use** Organizations may only collect, use, or disclose personal information for reasonable purposes that a reasonable person would consider appropriate in the circumstances. **Right to know retention policies** Consumers have the right to know how long their personal information will be retained and when it will be securely destroyed or anonymized. ### Why cookies as part of PIPA British Columbia compliance Cookies that collect identifiable or behavioral information—such as IP addresses, browsing habits, or login details—fall under PIPA’s definition of personal information. Businesses must: - Disclose the use of such cookies in a privacy or cookie policy - Obtain explicit or implied consent before activating non-essential cookies - Allow users to opt out or manage cookie preferences ### Penalties for PIPA British Columbia non-compliance Non-compliance with PIPA can result in: - Investigations and audits by the Office of the Information and Privacy Commissioner (OIPC) for BC - Mandatory orders to change data handling practices - Public reporting of non-compliance - Legal consequences including fines up to CAD 100,000 for individuals and CAD 500,000 for organizations under related provincial laws ### How to comply with the PIPA British Columbia To check your compliance with the PIPA British Columbia, businesses should: **Audit:** Conduct a data audit to identify all cookies and trackers on their websites **Categorize:** Categorize cookies (e.g., necessary, preference, analytics, marketing) **Implement consent management:** Ensure consent banners are implemented correctly with granular choices, enable users to withdraw consent at any time, and maintain consent logs **Check third-party contracts:** Review third-party data-sharing practices #### Frequently Asked Questions **What is the scope of the Personal Information Protection Act (PIPA) in British Columbia, Canada?** PIPA governs the collection, use, and disclosure of personal information by private sector organizations in BC during commercial activities. **What is personal data under PIPA?** Personal data includes any information about an identifiable individual, such as names, email addresses, IP addresses, or other data that can be linked to a person. **What is sensitive data according to the PIPA?** While PIPA does not formally define “sensitive data,” it places higher expectations for protecting data like health information, financial details, and biometric identifiers due to their potential impact on privacy. **Who is the regulatory authority for British Columbia’s PIPA?** The Office of the Information and Privacy Commissioner (OIPC) for British Columbia enforces PIPA and handles complaints and investigations. **Who is exempt from PIPA rules?** PIPA does not apply to public bodies (covered by the Freedom of Information and Protection of Privacy Act), or individuals collecting data for personal or journalistic purposes. **Where can I get more information about the British Columbia Personal Information Protection Act?** Visit the OIPC BC official website for full details, guidance documents, and compliance resources. --- # PIPEDA/CPPA Canada Compliance Guide and Consent Management URL: https://www.cookiehub.com/pipeda-cppa Last updated: June 16, 2026 ## Canada PIPEDA Cookie Consent and Compliance Under Canada’s current PIPEDA and the upcoming CPPA (Consumer Privacy Protection Act), organizations are required to obtain meaningful consent before collecting, using, or disclosing personal information—this includes data collected via cookies and similar tracking technologies. How do you manage consent? ### What your business needs to know about the Canada’s PIPEDA/CPPA PIPEDA (Personal Information Protection and Electronic Documents Act) is Canada’s federal privacy law that governs how private-sector organizations handle personal data during commercial activities. It has been the main privacy framework since 2000. CPPA** **(Consumer Privacy Protection Act) is Canada’s proposed new privacy law that would replace PIPEDA. It is part of Bill C-27, which aims to modernize federal privacy protections, enhance enforcement powers, and align Canada with global data protection standards like the GDPR. Whether operating under PIPEDA or preparing for CPPA, businesses must: - Obtain valid and informed consent before collecting or using personal information. - Limit data collection to what is necessary for stated purposes. - Protect personal information using appropriate safeguards. - Provide individuals access to their data and correct inaccuracies. - Maintain clear privacy policies and practices. - Under CPPA, businesses must also: - Allow data mobility (data portability between organizations). - Implement transparent algorithms if using automated decision-making. - Enable users to request data deletion. CPPA introduces higher standards, more robust consent rules, and serious penalties for violations. ### What does PIPEDA/CPPA Canada compliance require? To be compliant with PIPEDA/CPPA, you should: **Conduct an audit:** Perform a full audit of data collection and sharing practices and identify personal data collected and its purposes **Update privacy policy:** Review and update privacy and cookie policies. **Implement consent management:** Implement cookie consent banners and opt-out flows to automate consent capture and preference management **Ensure data minimization:** Limit data collection to what is necessary for legitimate business purposes **Ensure consumer rights:** Inform individuals about why and how their personal information is collected and used, and establish mechanisms to respond to consumer rights requests within 45 days **Appoint a privacy officer:** Implement accountability measures and appoint an individual responsible for privacy **Perform Data Protection Assessments:** Safeguard privacy with regard to targeted advertising, data sales, profiling, or processing sensitive data. If your answers are uncertain or negative, your organization may not be compliant and should update its privacy practices. ### Who needs to comply with PIPEDA/CPPA Canada? The laws apply to: - All private-sector organizations across Canada involved in commercial activities. - Foreign businesses offering goods, services, or collecting data from Canadians. - Organizations in federally regulated sectors (e.g., banks, airlines, telecoms). Provincial privacy laws may take precedence in BC, Alberta, and Quebec, but only if deemed “substantially similar” to federal law. ### Consumer rights under Canada’s PIPEDA/CPPA PIPEDA and CPPA both state that consumers have the right to: **Right to be informed** Consumers have the right to be told why their personal information is being collected, used, or disclosed at or before the time of collection. **Right to consent** Organizations must obtain meaningful consent (explicit or implied, depending on the situation) before collecting, using, or disclosing personal information. **Right to access personal information** Consumers can request access to their personal information held by an organization, including details on how it is being used and to whom it has been disclosed. **Right to request corrections** Individuals have the right to request corrections to their personal information if it is inaccurate or incomplete. **Right to deletion** Consumers can ask to have their personal data deleted. **Right to withdraw consent** Consumers may withdraw their consent at any time, subject to legal or contractual restrictions and reasonable notice. **Right to data portability** Consumers can request their data be provided in a usable format. **Right to data security** Consumers have the right to expect that their personal information will be protected by appropriate security measures to prevent unauthorized access, collection, use, disclosure, or destruction. **Right to know when automated decision-making is used** Consumers should be informed and enabled to challenge outcomes (under CPPA). **Right to minimal and reasonable use** Organizations may only collect, use, or disclose personal information for reasonable purposes that a reasonable person would consider appropriate in the circumstances. These rights empower Canadians to control their digital privacy and demand accountability from businesses. ### Why cookies as part of PIPEDA/CPPA Canada compliance Cookies that collect identifiable information—such as device IDs, location data, or behavior profiles—fall under both PIPEDA and CPPA’s definitions of personal data. Therefore: - Consent is required before collecting this information through cookies. - You must clearly explain what cookies do, what data is collected, and why. - You must provide users with a real choice—opt-in or manage preferences. Under CPPA, deceptive or coercive practices around consent (e.g., dark patterns) will be explicitly prohibited. Cookie banners must be clear, provide specific information about data use, and allow users to opt in or manage preferences before any non-essential cookies are activated. The CPPA strengthens these consent requirements with more explicit transparency and accountability obligations. ### Penalties for PIPEDA/CPPA Canada non-compliance Under PIPEDA: - The Privacy Commissioner can investigate and publicly report non-compliance but has limited enforcement power. - Serious violations may be referred to federal court. Under the proposed CPPA: - The Privacy Commissioner would gain order-making powers. - A new Data Tribunal could impose fines up to 10 million CAD or 3% of global revenue, whichever is higher. - Intentional violations could lead to criminal penalties. ### How to comply with the PIPEDA/CPPA Canada To check your compliance with the PIPEDA and CPPA, organizations should: **Audit:** Conduct a data audit to identify all cookies and trackers on their websites **Categorize:** Categorize cookies (e.g., necessary, preference, analytics, marketing) **Implement consent management:** Ensure consent banners are implemented correctly with granular choices, enable users to withdraw consent at any time, and maintain consent logs **Check third-party practices:** Review third-party data-sharing practices #### Frequently Asked Questions **What is the scope of the Personal Information Protection and Electronic Documents Act (PIPEDA) and Consumer Privacy Protection Act (CPPA) in Canada?** These laws govern the collection, use, and disclosure of personal information in the course of commercial activities by private-sector organizations across Canada, including international businesses dealing with Canadians. **What is personal data under PIPEDA/CPPA?** Personal data refers to any information that can identify an individual, including names, contact details, IP addresses, location data, and behavioral profiles. **What is sensitive data according to the PIPEDA/CPPA?** Sensitive data includes financial, health, biometric, and other information that, if misused, could cause significant harm or distress to individuals. **Who is the regulatory authority for Canada’s PIPEDA/CPPA?** The Office of the Privacy Commissioner of Canada (OPC) oversees PIPEDA and will enforce CPPA when it comes into effect. **Who is exempt from PIPEDA/CPPA rules?** Non-commercial entities (e.g., charities), government institutions, and individuals handling data for personal use are generally exempt. Some provinces have their own privacy laws that may override PIPEDA in specific sectors. **Where can I get more information about Canada’s Personal Information Protection and Electronic Documents Act and Consumer Privacy Protection Act?** More information can be had from the Office of the Privacy Commissioner of Canada’s website for full details, compliance tools, and legislative updates. --- # China PIPL Cookie Consent and Compliance URL: https://www.cookiehub.com/pipl Last updated: June 18, 2026 ## China PIPL Cookie Consent and Compliance China’s Personal Information Protection Law (PIPL) requires that organizations obtain clear, informed, and voluntary consent from individuals before collecting or processing their personal information — including data gathered through cookies. Is your website ready for consent management requirements? ### What your business needs to know about the PIPL The Personal Information Protection Law (PIPL) is China’s comprehensive data privacy legislation that came into effect on November 1, 2021. It regulates the collection, use, storage, and transfer of personal information of individuals within China. The PIPL is similar in scope to the EU’s GDPR, emphasizing user rights, lawful processing, and data minimization. ### What does PIPL compliance require? If your business collects or processes data from individuals in China, you must comply with the PIPL—even if your organization is not physically located in China. Key requirements include: **Control consent:** Obtain explicit user consent **Review data practices:** Provide individuals with access to their data, including the ability to correct and delete **Audit and assess risk:** Conduct privacy impact assessments for sensitive or high-risk processing **Appoint a DPO:** Bring onboard a local data representative if operating from abroad Cookie consent mechanisms must allow users to opt in before cookies are placed, especially those used for tracking, profiling, or cross-border transfers of data. Businesses operating online must implement compliant cookie banners and provide clear information on how personal data is used. ### Who needs to comply with the PIPL? Any organization that handles the personal data of individuals in China must comply with the PIPL, regardless of where the company is based in the world. This includes websites, apps, service providers, and international businesses offering goods or services to people in China or analyzing their behavior. ### Consumer rights under the PIPL The PIPL gives consumers in China various data privacy rights, including: **Right to know** Request to be informed about how personal information is being collected, used and shared **Right to correction or erasure** Request that inaccurate, incomplete or out-of-date information be corrected or entirely deleted **Right to limit or deny processing** Restrict or prohibit the processing of personal data **Right to explanation** Request explanations regarding rules and logic behind automated decision-making **Right to data portability** Request to receive and transfer data collected **Right to withdraw consent** Ability to withdraw consent for data processing at any time ### Why cookies as part of PIPL compliance Under the PIPL, cookies that collect personal information require prior, informed, and specific consent from users. This applies to tracking cookies, analytics tools, and advertising technologies. Simply stating cookie use in a privacy policy is not enough; users must actively opt in, and they should be able to withdraw consent just as easily. ### Penalties for PIPL non-compliance Violations of the PIPL can result in severe penalties, including fines of up to 50 million RMB (approx. 7 million USD) or 5% of the previous year's annual revenue. Non-compliant organizations may also face business restrictions, suspension of operations, reputational damage, and legal liability for responsible personnel. ### How to comply with the PIPL Some best practices to bring your data privacy approach in line with PIPA compliance include: **Audit:** Conduct a data audit to identify all cookies and trackers on their websites **Categorize:** Categorize cookies (e.g., necessary, preference, analytics, marketing) **Implement consent management:** Ensure consent banners are implemented correctly, enable users to withdraw consent at any time, and maintain consent logs **Check partner and third-party contracts:** Review third-party data-sharing practices **Give staff training:** Ensure that employees have training to understand and comply with PIPL #### Frequently Asked Questions **What is the scope of the Personal Information Protection Act (PIPL) in China?** The PIPL applies to the processing of personal information of individuals within China. It also applies to data handlers outside China if they process personal data of individuals in China for the purpose of offering products/services or analyzing user behavior. **What is personal data under the PIPL?** Personal data refers to any information, recorded electronically or otherwise, that can identify a natural person—either alone or when combined with other information. This includes names, addresses, ID numbers, and other identifiable information. **What is sensitive data according to the PIPL?** Sensitive personal data includes information that, if leaked or misused, could harm an individual's dignity or personal and property safety. This includes biometric data, religious beliefs, medical health, financial accounts, location tracking, and data of minors under the age of 14. **Who is the regulatory authority for China’s PIPL?** The Cyberspace Administration of China (CAC) is the primary authority responsible for enforcing the PIPL and overseeing data protection matters in China. **Who is exempt from PIPL rules?** PIPL does not apply to personal data handled by individuals for personal or household affairs. However, once such data is used beyond this scope—such as for business or public purposes—the PIPL may apply. **Where can I get more information about China’s Personal Information Protection Act?** You can find official information and updates about the PIPL on the website of the Cyberspace Administration of China (CAC)** **or consult professional legal and data protection resources that specialize in Chinese data privacy law. --- # South Africa POPIA Cookie Consent and Compliance URL: https://www.cookiehub.com/popia Last updated: June 19, 2026 ## South Africa POPIA Cookie Consent and Compliance South Africa’s Protection of Personal Information Act (POPIA) is widely perceived as Africa’s strongest data protection and privacy law.  Does your website comply with POPIA? ### What your business needs to know about POPIA POPIA is the South African Protection of Personal Information Act, which took effect in 2021. While the law is very similar to Europe’s GDPR and Brazil’s LGPD, there are some distinct differences to note relative to how your website collects and stores personal information from people in South Africa. The law’s purpose is to regulate the processing of personal information and protect the privacy of individuals, ensuring that personal data is processed in a fair and transparent way. ### What does POPIA compliance require? POPIA requires organizations to ensure: **User consent:** Individuals must give clear, unambiguous consent before their data can be processed **Data security:** Implement measures to protect data from unauthorized access **Data minimization:** Only collect the data necessary to do the stated task **Purpose specification:** Data may only be collected and used for specific, explicitly stated activities **Openness:** Provide clear information given to data subjects about how their information is used **Accuracy:** Data must be accurate and kept up to date; consumers have the right to correct inaccurate personal information **Lawful processing:** Personal information must be processed in accordance with the law **Privacy Policy:** A clear, comprehensive privacy policy is required for businesses to be in compliance **Accountability:** Businesses are completely responsible for ensuring compliance ### Who needs to comply with POPIA? POPIA requires compliance if an organization is domiciled in South Africa, or if the business – regardless of geography – processes the personal information of South Africans or in South Africa. ### Consumer rights under the POPIA POPIA grants consumers the following rights, among others: **Right to access** Request access to their personal data **Right to correct** Rectify inaccuracies in their data **Right to delete** Request the deletion of their personal data, with certain exceptions **Right to opt-out** Opt out of the processing of their personal data for targeted advertising, the sale of their data, or for profiling **Right to revoke** Withdraw consent at any time **Right to object** Object to processing of their data, especially for direct marketing or automated decision-making **Right to file complaint and legal recourse** Lodge complaints with the Information Regulator and initiative civil proceedings ### Why cookies as part of POPIA compliance POPIA requires websites to obtain user consent before using cookies. While POPIA doesn't explicitly mention cookies, it does define personal information broadly, meaning that cookies can be used to personally identify individuals. As such, websites need to provide clear information about their cookie usage and obtain explicit consent, often through a cookie banner or notice, before deploying cookies. ### Penalties for POPIA non-compliance Penalties for POPIA violations can be quite severe. Fines are one penalty, ranging from 1 to 10 million ZAR (about 50,000 – 550,000 USD), but imprisonment is another. Offenders can go to prison for up to ten years for serious offenses, such as obstructing the Information Regulator or for making false statements under oath. ### How to comply with the POPIA Businesses can also take additional steps to ensure compliance and a consent-first mindset: **Conduct data audits:** Review current data practices to ensure alignment with POPIA requirements **Update privacy policies:** Review and revise privacy notices to make data practices, consumer rights, and how to exercise those rights clear to consumers **Implement consent management:** Control cookie consent and oversight with a comprehensive consent management platform like CookieHub **Employee training:** Ensure that employees understand the importance of data privacy and POPIA compliance through dedicated education programs #### Frequently Asked Questions **What is the scope of South Africa’s Protection of Personal Information Act (POPIA)?** POPIA governs the processing of personal information by public and private bodies in South Africa. It aims to protect individuals’ privacy by regulating how personal data is collected, stored, used, and shared, ensuring responsible handling of personal information. **What is personal data under POPIA?** Personal data refers to any information that can identify a living individual, either directly or indirectly. This includes details like names, contact information, identity numbers, and any other information linked to a person. **What is sensitive data according to POPIA?** Sensitive data under POPIA includes personal information that reveals a person's racial or ethnic origin, religious beliefs, political opinions, health information, sexual orientation, or biometric data. This type of information requires extra protection due to its sensitive nature. **Who is the regulatory authority for South Africa’s POPIA?** The Information Regulator of South Africa is the official authority responsible for enforcing POPIA. They oversee compliance, investigate complaints, and provide guidance on data protection matters. **Who is exempt from POPIA rules?** Certain organizations and information types are exempt, such as the processing of personal information by the judiciary for judicial purposes or by certain law enforcement agencies when acting under specific laws. However, most public and private entities must comply with POPIA. **Where can I get more information about the South African Protection of Personal Information Act?** More details can be found on the official [Information Regulator website](https://inforegulator.org.za/) or by consulting legal authorities specializing in South African data protection laws. --- # Law 25 Quebec Cookie Banner & Consent Requirements URL: https://www.cookiehub.com/quebec-law-25 Last updated: September 24, 2026 ## Law 25 Quebec cookie banner and consent requirements Since 22 September 2023, Quebec’s Law 25 has required that the functions of a technology that can identify, locate or profile a visitor be switched off by default until the visitor chooses to activate them. This covers many cookies and other tracking technologies used for analytics, advertising, personalisation and profiling. Pre-ticked boxes and “by continuing to browse, you agree” banners do not count. This page explains what a Law 25 compliant cookie banner has to do, who the Law applies to, what penalties can apply for non-compliance, and how CookieHub handles Quebec visitors. ### What Law 25 says about cookies Law 25, formerly Bill 64, modernised Quebec’s Act respecting the protection of personal information in the private sector. Its provisions came into force in stages between September 2022 and September 2024, and they are enforced by the Commission d’accès à l’information du Québec (CAI). The provision that matters most for cookies is section 8.1, in force since 22 September 2023. When an organisation collects personal information using a technology with functions that can **identify, locate or profile** a person, it must inform that person. According to the CAI’s guidance, those functions must also be **deactivated by default**. The person has to take an action to activate them. Quebec does not use exactly the same test as Europe, where technologies are generally divided into “strictly necessary” and non-essential ones. Under Law 25, what matters above all is what the technology does. Cookies and similar technologies that can identify, locate or profile a visitor must not have those functions activated by default. In practice, many analytics, advertising, personalisation and behavioural tracking tools must therefore stay inactive until the visitor makes a choice. By contrast, a cookie used only to keep a shopping cart or a login session, with no identification, location or profiling function within the meaning of section 8.1, is not subject to this activation requirement. ### What a Law 25 compliant cookie banner must do A banner configured only for Canada’s general privacy requirements may not be enough in Quebec. A Law 25 compliant banner should, in particular: **Keep identification, location and profiling functions off until the visitor activates them:** The technologies concerned must not activate before the visitor makes an affirmative choice. A banner that only informs the visitor, without controlling the tracking technologies, is not enough. **Explain the purposes clearly:** The visitor must understand why their information is collected and used. They should also be able to get more information easily about the technologies used, the third parties involved and the data practices. **Allow a choice for specific purposes:** Consent must be requested for specific, clearly defined purposes. Where different purposes require consent, visitors should be able to make the appropriate choices rather than being forced to accept all tracking. **Never assume consent:** No pre-ticked boxes, no consent by scrolling, and no “by continuing to use this site, you agree” wording. Taking no action is not valid consent. **Allow consent to be withdrawn:** The visitor must be able to change their choice later. The site should offer an easily accessible way to reopen the consent settings. **Keep proof of consent:** The organisation must be able to show that valid consent was obtained. The Law does not prescribe a particular technical method, but a consent log that records the choice, the time and the context is a practical way to document it. **Offer the interface in French:** Separately from Law 25, Quebec’s language rules generally require commercial content aimed at Quebec consumers to be available in French. The consent interface should therefore also be offered in French. ### Who needs to comply with Law 25? Law 25 applies broadly to private sector enterprises carrying on activities in Quebec. A business based outside Quebec may also be covered where its activities have a sufficient connection with Quebec, in particular where it actively offers products or services to people in Quebec or collects their personal information. This can include: - enterprises carrying on business in Quebec, whatever their size; - businesses based elsewhere in Canada or abroad that actively serve Quebec customers or collect personal information from people in Quebec; - non-profits, professional practices and service providers, where they are subject to the Law. There is no general small business exemption and no revenue threshold once the Law applies. ### Individual rights under Law 25 Law 25 gives people in Quebec several rights over their personal information. A cookie banner does not cover all of these rights, but it is often the visitor’s first point of contact with a site’s personal information practices. The main rights include: **Right to be informed** To know what information is collected, why, and, depending on the circumstances, to whom it is disclosed. **Right of access** To request access to the personal information an organisation holds about them. **Right to rectification** To request the correction of information that is inaccurate, incomplete or equivocal. **Right to withdraw consent** To withdraw consent given earlier, subject to the applicable rules. **Right to cessation of dissemination or de-indexing** In certain circumstances, to request that an organisation stop disseminating personal information or de-index a hyperlink that gives access to it. **Right to data portability** Since September 2024, to request certain computerised personal information in a structured, commonly used technological format, subject to the exceptions set out in the Law. **Right to be informed of automated decisions** To be told when a decision is based exclusively on automated processing of personal information, and to obtain certain information about that processing. **Right to be notified of certain confidentiality incidents** Where an incident presents a risk of serious injury, the people concerned must be notified in accordance with the applicable rules. ### Is cookie consent required in the rest of Canada? Outside Quebec, Canadian privacy requirements vary with the province, the organisation and the nature of the processing. The federal PIPEDA and the private sector laws of Alberta and British Columbia can permit **implied consent** in appropriate circumstances, depending on factors such as the sensitivity of the information and the reasonable expectations of the individual. Quebec takes a more specific approach for the technologies covered by section 8.1: their identification, location and profiling functions must be **deactivated by default**. That difference can make a single banner for all of Canada less precise. A configuration based only on opt-out may not be enough in Quebec where a technology identifies, locates or profiles visitors. Conversely, a strict opt-in configuration applied across Canada may ask for explicit consent in situations where the applicable rules would allow a different approach. A consent management platform can therefore adapt the banner’s behaviour to the visitor’s region. ### Penalties for Law 25 non-compliance Law 25 considerably strengthened the enforcement powers of the Commission d’accès à l’information. Depending on the nature of the offence, the consequences can include: - **Administrative monetary penalties:** up to CAD 10 million or 2% of worldwide turnover for the preceding fiscal year, whichever is higher. - **Penal fines:** up to CAD 25 million or 4% of worldwide turnover for certain offences, with amounts that can be increased for a repeat offence. - **Private claims:** where an unlawful infringement of a right protected by the Law causes injury and results from an intentional or gross fault, punitive damages of at least CAD 1,000 can apply. The CAI’s decisions and orders can also be made public. ### How to make your website Law 25 compliant For cookies and other tracking technologies, the process comes down to a few steps: **Scan:** Find the cookies, trackers and technologies your site actually uses, including those added by third-party scripts, tag managers and embedded content. **Categorise:** Work out the purpose of each technology and identify the ones that can identify, locate or profile visitors. **Block until consent:** Make sure the functions concerned stay deactivated until the visitor activates them. **Ask for consent properly:** Show a clear banner, in French, that lets the visitor understand their choices and change them. **Document:** Keep proof of consents, keep the information about cookies and their purposes up to date, and publish an appropriate privacy policy. **Designate a person in charge:** The business must identify the person in charge of the protection of personal information, as the Law requires. ### How CookieHub handles Quebec visitors CookieHub is a consent management platform used on tens of thousands of websites. It lets you apply consent behaviour suited to visitors from Quebec and the rest of Canada. **Prior consent for Canada** CookieHub detects the visitor’s region and applies the consent behaviour configured for it. New domains use opt-in consent for all visitors by default, including visitors from Quebec, so the relevant technologies remain inactive until the visitor makes their choice. Region-specific settings can be added on top, for example with the Recommended opt-in group that includes Canada. **Choice by category, easy withdrawal** Visitors can accept or refuse different categories of cookies. Categories are not activated by default when prior consent is required, and visitors can reopen their preferences later. **French and English automatically** CookieHub supports many languages, including French and English, and can match the banner language to the visitor’s browser. The text can also be customised. **Proof and cookie monitoring** Visitors’ choices can be logged to provide proof of consent and of its withdrawal. The CookieHub scanner helps detect the cookies used on the site and keep the cookie declaration up to date as the site changes. ### Frequently asked questions about Law 25 and cookies **Do I need a cookie banner in Quebec?** If your site uses a technology with functions that can identify, locate or profile a visitor, you need to take the requirements of section 8.1 into account. This can include analytics tools, advertising pixels, heat maps, embedded content and other tracking technologies. If a cookie has no identification, location or profiling function within the meaning of section 8.1, the specific requirement to deactivate it by default does not necessarily apply to that technology. Other transparency or consent obligations may still apply where personal information is collected. **Does Law 25 apply to Google Analytics cookies?** Standard Google Analytics configurations that use identifiers and cookies can include functions that recognise a visitor from one visit or page to the next. Those functions must be assessed against section 8.1, and where they can identify, locate or profile a person, they must be deactivated by default until the visitor activates them. Measurement methods that do not rely on those functions must be assessed separately. **Is Law 25 the same as GDPR?** No. Law 25 and the GDPR are two different legal regimes. For many tracking technologies, though, the practical result can be similar: certain identification and profiling mechanisms must not be activated automatically, and valid consent must be clear, free and given for specific purposes. A banner that genuinely meets European requirements is therefore often a good starting point for Quebec, but it does not automatically cover every Law 25 obligation. Law 25 has its own rules on, among other things, the person in charge of the protection of personal information, privacy impact assessments and certain communications of personal information outside Quebec. **Does Law 25 apply to a business outside Quebec?** It can. A business located elsewhere can be subject to the Law where it carries on business in Quebec or where its activities have a sufficient connection with Quebec. A business that actively markets its services to people in Quebec or collects their personal information should therefore examine seriously whether it is covered, rather than assume that being based outside the province is enough to exclude it. **What counts as personal information under Law 25?** Personal information is any information that concerns a natural person and allows that person to be identified, directly or indirectly. Depending on how it is used and its context, this can include IP addresses, device identifiers, identifiers associated with cookies and certain behavioural data. **What is sensitive personal information under Law 25?** Personal information is sensitive when, because of its nature or the context of its use or disclosure, it entails a high level of reasonable expectation of privacy. This can include certain medical, biometric, genetic or financial data, as well as other particularly intimate information. Consent to the use of sensitive personal information must be given expressly. **Who enforces Law 25?** The **Commission d’accès à l’information du Québec (CAI)**. It can investigate organisations’ practices, issue orders and impose administrative penalties in the situations provided for by the Law. **Who is exempt from Law 25?** Quebec public bodies are governed mainly by a different legislative regime from the one that applies to private sector enterprises. Certain activities or categories of information can also be subject to exclusions or specific rules. There is, however, no general exemption for small businesses simply because of their size. **Where can I read the official guidance?** The Commission d’accès à l’information publishes the text of the Law, guidelines on consent and information on cookies and other tracking technologies. These resources are available on the CAI’s website. --- # Rhode Island RIDTPPA Cookie Consent and Compliance URL: https://www.cookiehub.com/ridtppa-rhode-island Last updated: June 18, 2026 ## Rhode Island RIDTPPA Cookie Consent and Compliance With the introduction of the Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA), businesses must ensure they obtain informed, prior consent from users before processing personal data, including through cookies and tracking technologies. Is your consent management ready for action? ### What your business needs to know about RIDTPPA Rhode Island RIDTPPA is a comprehensive data privacy law enacted in Rhode Island to give consumers greater control over their personal data. It mandates transparency in data collection, processing, and sharing, while placing strict obligations on businesses that handle Rhode Island residents' data. ### What does RIDTPPA Rhode Island compliance require? Businesses must implement clear privacy notices, obtain consent where required, enable consumer rights such as data access and deletion, and ensure vendors and service providers are also compliant. RIDTPPA applies to businesses that meet specific revenue or data-processing thresholds. To be compliant, business should: **Conduct an audit:** Perform a full audit of data collection and sharing practices and identify personal data collected and its purposes **Update privacy policy:** Review and update privacy and cookie policies. **Implement consent management:** Implement cookie consent banners and opt-out flows to automate consent capture and preference management **Ensure consumer rights:** Establish mechanisms to respond to consumer rights requests within 45 days **Perform Data Protection Assessments:** Safeguard privacy with regard to targeted advertising, data sales, profiling, or processing sensitive data. Utilizing tools like consent management platforms (CMPs) can simplify this process and help maintain ongoing compliance. ### Who needs to comply with RIDTPPA Rhode Island? RIDTPPA applies to businesses operating in Rhode Island or targeting Rhode Island residents, and that meet one or more of the following criteria: - Control or process data of at least 35,000 consumers annually - Derive 25% or more of gross revenue from the sale of personal data. ### Consumer rights under RIDTPPA Rhode Island Consumers are granted the following rights under RIDTPPA: **Right to access** Consumers can access and confirm processing of personal data **Right to correct** Consumers can request to correct inaccuracies **Right to delete** Consumers can request that their personal data be deleted **Right to data portability** Consumers have a right to port/download/transmit their information in a usable format **Right to opt-out** Consumers can opt out of the sale of personal data, targeted advertising, and profiling that produces legal/significant effect **Right to know and confirm** Consumers can find out what third parties have received their data and confirm whether an entity is processing it ### Why cookies as part of RIDTPPA Rhode Island compliance Cookies that collect personal or sensitive data are covered under RIDTPPA. Businesses must disclose the purpose of each category of cookies and obtain user consent before enabling non-essential tracking. This includes analytics, advertising, and third-party cookies. Cookie banners must clearly disclose what data is being collected and allow users to opt out of non-essential cookies. ### Penalties for RIDTPPA Rhode Island non-compliance Non-compliance with RIDTPPA can result in enforcement actions by the Rhode Island Attorney General, including civil penalties. Each violation may carry a fine, and continued failure to comply may increase liability. ### How to comply with RIDTPPA Rhode Island Compliance with RIDTPPA Rhode Island can in part by complied with by adhering to a number of data privacy best practices, including: **Audit:** Conduct a data audit to identify all cookies and trackers on their websites **Categorize:** Categorize cookies (e.g., necessary, preference, analytics, marketing) **Implement consent management:** Ensure consent banners are implemented correctly with granular choices, enable users to withdraw consent at any time, and maintain consent logs **Check third-party contracts:** Review third-party data-sharing practices #### Frequently Asked Questions **What is the scope of RIDTPPA Rhode Island?** RIDTPPA applies to businesses operating in Rhode Island or targeting residents of the state, especially those that collect or process the personal data of more than 35,000 consumers or earn significant revenue from data sales. **What is personal data under RIDTPPA Rhode Island?** Personal data includes any information that is linked or reasonably linkable to an identified or identifiable individual, such as names, email addresses, IP addresses, and online identifiers. **What is sensitive data according to RIDTPPA Rhode Island?** Sensitive data includes information such as racial or ethnic origin, religious beliefs, sexual orientation, health data, genetic or biometric data, and precise geolocation. **Who is the regulatory authority for RIDTPPA Rhode Island?** The Rhode Island Attorney General is responsible for enforcing RIDTPPA and handling consumer complaints. **Who is exempt from RIDTPPA Rhode Island rules?** Certain entities are exempt, including government agencies, financial institutions subject to the Gramm-Leach-Bliley Act, and data covered by HIPAA or other federal privacy laws. **Where can I get more information about RIDTPPA Rhode Island?** You can learn more about RIDTPPA by visiting the Rhode Island Attorney General’s official website or reviewing the full legislative text of the act. --- # Nevada SB 220 Cookie Consent and Compliance URL: https://www.cookiehub.com/sb-220-nevada Last updated: June 16, 2026 ## Nevada SB 220 Cookie Consent and Compliance Designed to improve internet privacy for Nevada consumers, SB 220 governs Nevada’s online privacy laws. Is your website and consent management solution up to par? ### What your business needs to know about SB 220 Nevada Nevada Senate Bill 220, signed May 29, 2019 and effective from October 1, 2019, amends Nevada’s online privacy laws. It grants consumers the right to opt out of the sale of their covered information and requires businesses (“operators”) to set up a designated request channel and respond within specified timelines. ### What does SB 220 Nevada compliance require? To comply with SB 220, consider the following: **Conduct an audit:** Perform a full audit of data collection and sharing practices and identify personal data collected and its purposes **Update privacy policy:** Review and update privacy and cookie policies with SB-220-specific disclosures. **Implement consent management:** Implement cookie consent banners and opt-out mechanisms ### Who needs to comply with SB 220 Nevada? The need to comply with SB 220 applies to any operator of a commercial website or online service that: - Collects covered information from Nevada residents, and - Has nexus to Nevada via transactions or presence—even if based outside the state. SB 220 applies regardless of company size or revenue. **Exemptions include**: - HIPAA-covered healthcare entities - GLBA-regulated financial institutions - Vehicle manufacturers/repairers - Service providers processing data for others - Businesses in Nevada with under 20,000 annual visitors and non-web-revenue primary source. ### Consumer rights under SB 220 Nevada Consumers in Nevada have one key right according to SB 220: **The right to opt out** Consumers can reject the sale** **of their covered information, whether already collected or collected in the future. Unlike most other privacy regulations, consumers **DO NOT** have a right to access, correct, delete or transport their data. ### Why cookies as part of SB 220 Nevada compliance Cookies that capture covered information—like email or phone—are considered part of the data SB 220 governs. If that information is sold, your cookie banner must include a “Do Not Sell My Personal Info” link and route users to the optout process Nevada SB 220 doesn’t mandate opt-in cookie consent like GDPR—but it does require businesses to clearly identify when they are selling personal information collected through cookies and to provide a “Do Not Sell” mechanism (such as a web form, toll free number, or email address). Your cookie consent banner should include this optout link if you collect or sell covered information. ### Penalties for SB 220 Nevada non-compliance The Nevada Attorney General enforces SB 220 and can impose fines up to 5,000 USD per violation. Consumers are not able to sue directly, as the regulation does not allow for any private right of action. ### How to comply with SB 220 Nevada Organizations that want to comply with SB 220 Nevada and align with data privacy best practices should: **Audit:** Conduct a data audit to identify all cookies and trackers on their websites **Categorize:** Categorize cookies (e.g., necessary, preference, analytics, marketing) **Implement consent management:** Ensure consent banners are implemented correctly with granular choices, enable users to withdraw consent at any time, and maintain consent logs **Check third-party contracts:** Review third-party data-sharing practices #### Frequently Asked Questions **What is the scope of Nevada SB 220?** Nevada SB 220 applies to operators of commercial websites/online services that collect covered information from Nevada residents, regardless of the operator’s location—provided there’s sufficient nexus. **What is personal data under Nevada SB 220?** Covered information includes first/last name, physical address (with street and city), email, phone, SSN, identifiers/contact info, and any other identifying info collected alongside identifiers. **What is sensitive data according to Nevada SB 220?** SB 220 doesn’t explicitly define “sensitive data.” All “covered information” types listed above fall within its scope. **Who is the regulatory authority for Nevada SB 220?** Enforcement authority lies exclusively with the Nevada Attorney General. **Who is exempt from Nevada SB 220 rules?** Exempt are HIPAA regulated healthcare, GLBA regulated financial institutions, certain auto manufacturers/repair services, service providers for others, and small Nevada based sites under 20k annual visitors whose primary revenue isn’t web based. **Where can I get more information about Nevada SB 220?** The full bill text (May 30 2019), Nevada Revised Statutes NRS 603A, and guidance from the Nevada Attorney General’s website are primary sources. --- # New Jersey NJDPA Cookie Consent and Compliance URL: https://www.cookiehub.com/senate-bill-332-new-jersey Last updated: June 18, 2026 ## New Jersey NJDPA Cookie Consent and Compliance As New Jersey joins the growing list of US states passing comprehensive privacy legislation, businesses operating in or targeting consumers in New Jersey must pay close attention to Senate Bill 332 (SB332). One key area of compliance involves cookie consent and data tracking practices. Are you ready for consent management requirements? ### What your business needs to know about New Jersey Senate Bill 332/NJDPA Senate Bill 332 took effect January 15, 2025 and established the New Jersey Data Privacy Act. It sets comprehensive requirements for businesses collecting personal data from residents of New Jersey. The law grants consumers rights over their data and requires businesses to be more transparent and responsible in how they collect, use, and share that data. Businesses must ensure that their websites obtain clear, informed consent before collecting personal data through cookies, especially when dealing with sensitive information or targeted advertising**.** ### What does New Jersey Senate Bill 332/NJDPA compliance require? To comply with SB332, businesses should: **Conduct an audit:** Perform a full audit of data collection and sharing practices. **Update privacy policy:** Update privacy and cookie policies with New Jersey-specific disclosures. **Implement consent management:** Implement cookie consent banners and opt-out flows to automate consent capture and preference management **Data subject handling:** Establish processes for handling data subject requests. **Data security:** Ensure data security measures are in place. **Review and disclose data and cookie practices:** Disclose data handling practices, including collection, storage and sharing of cookie types, purposes, etc. **Train staff:** Educate employees to ensure internal procedures align with the new rules. ### Who needs to comply with New Jersey Senate Bill 332/NJDPA? NJDPA applies to businesses that process the personal data of at least 100,000 consumers or derive 25% or more of their revenue from selling data of 25,000 or more consumers. The regulation applies to any entity conducting business in New Jersey or targeting New Jersey consumers. It applies to both for-profit and certain non-profit organizations, depending on their data practices. ### Consumer rights under New Jersey Senate Bill 332 New Jersey consumers are granted the following rights: **Right to access** Consumers can access and confirm processing of personal data **Right to correct** Consumers can request to correct inaccuracies **Right to delete** Consumers can request that their personal data be deleted **Right to data portability** Consumers have a right to port/download/transmit their information in a usable format **Right to opt-out** Consumers can opt out of the sale of personal data, targeted advertising, and profiling that produces legal/significant effect ### Why cookies as part of New Jersey Senate Bill 332 compliance Cookies that collect personal or sensitive data, including for behavioral advertising, fall under SB332. Businesses must: - Inform users about cookie use in their privacy notice. - Offer users the right to opt out of data processing for targeted advertising. - Obtain affirmative consent before processing sensitive data through cookies. ### Penalties for New Jersey Senate Bill 332 non-compliance Businesses that fail to comply with SB332 face: - Enforcement by the New Jersey Division of Consumer Affairs. - A 30-day cure period to fix violations. - Civil penalties of up to 10,000 USD per violation, or 20,000 USD for subsequent violations, similar to other consumer protection laws. ### How to comply with New Jersey Senate Bill 332 Best practices to contribute to compliance with New Jersey Senate Bill 332 include: **Audit:** Conduct a data audit to identify all cookies and trackers on their websites **Categorize:** Categorize cookies (e.g., necessary, preference, analytics, marketing) **Implement consent management:** Ensure consent banners are implemented correctly with granular choices, enable users to withdraw consent at any time, and maintain consent logs **Check third-party contracts:** Review third-party data-sharing practices #### Frequently Asked Questions **What is the scope of New Jersey Senate Bill 332?** SB332 applies to entities that operate in New Jersey or target New Jersey residents and meet certain data processing or revenue thresholds. **What is personal data under New Jersey Senate Bill 332?** Personal data includes any information that is linked or reasonably linkable to an identified or identifiable individual, excluding de-identified data and publicly available information. **What is sensitive data according to New Jersey Senate Bill 332?** Sensitive data includes racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, citizenship or immigration status, precise geolocation, biometric/genetic data, and data concerning a known child. **Who is the regulatory authority for New Jersey Senate Bill 332?** The New Jersey Division of Consumer Affairs, within the Department of Law and Public Safety, is responsible for enforcing SB332. **Who is exempt from New Jersey Senate Bill 332 rules?** Exemptions include entities subject to federal privacy laws like HIPAA or GLBA, nonprofit organizations in certain contexts, and employment-related data processing. **Where can I get more information about New Jersey Senate Bill 332?** You can find the full text of the bill and ongoing updates on the New Jersey Legislature website. --- # Texas TDPSA Cookie Consent and Compliance URL: https://www.cookiehub.com/tdpsa Last updated: June 18, 2026 ## Texas TDPSA Cookie Consent and Compliance Under Texas’s TDPSA, businesses collecting cookie-based personal or sensitive data—especially for profiling, targeted ads, or data sales—must obtain explicit optin consent before setting such cookies. Are you prepared for cookie consent and compliance in Texas? ### What your business needs to know about TDPSA Texas The Texas Data Privacy and Security Act (TDPSA), in effect from July 1, 2024 (with some optout requirements effective Jan 1, 2025), grants new consumer data rights and places obligations on businesses handling Texas residents' personal data. ### What does TDPSA Texas compliance require? To ensure compliance with TDPSA: **Conduct an audit:** Perform a full audit of data collection and sharing practices and identify personal data collected and its purposes **Update privacy policy:** Review and update privacy and cookie policies with TDPSA-specific disclosures. **Implement consent management:** Implement cookie consent banners and universal opt-out mechanisms (e.g., via Global Privacy Control) **Maintain records:** Keep records of consents and DPIAs **Maintain data security:** Keep data secure and report data breaches affecting >250 residents within 30 days ### Who needs to comply with the TDPSA Texas? TDPSA applies to any entity that conducts business in Texas or offers products/services consumed by Texas residents, processes or sells personal data and is not a small business** **(per SBA definition: <500 employees)**\ ** Exemptions include: state agencies, nonprofits, HIPAA regulated entities, financial institutions under GLBA, utilities and higher-ed institutions. ### Consumer rights under TDPSA Texas Texas residents have the: **Right to access** Consumers can access and confirm processing of personal data **Right to correct** Consumers can request to correct inaccuracies **Right to delete** Consumers can request that their personal data be deleted **Right to data portability** Consumers have a right to port/download/transmit their information in a usable format **Right to opt-out** Consumers can opt out of the sale of personal data, targeted advertising, and profiling that produces legal/significant effect **Right to know and confirm** Consumers can find out what third parties have received their data and confirm whether an entity is processing it Controllers must respond to consumer requests within 45 days (extendable once by another 45 days) and at least twice per year for free. ### Why cookies as part of TDPSA Texas compliance Under the TDPSA, cookies that enable tracking, profiling or sale require optin. Sensitive data, such as precise geolocation, biometric, racial or health information, needs explicit consent before cookies are set. A privacy policy must be in place that discloses cookie use, data categories, purposes, sharing, and consumer rights. ### Penalties for TDPSA Texas non-compliance The Texas Attorney General enforces the law. After giving written notice, an entity has a 30day cure period, after which uncured violations may result in civil penalties up to 7,500 USD per violation. There is no private right of action for consumers. ### How to comply with TDPSA Texas TDPSA Texas compliance demands that businesses align with data privacy best practice, such as: **Audit:** Conduct a data audit to identify all cookies and trackers on their websites **Categorize:** Categorize cookies (e.g., necessary, preference, analytics, marketing) **Implement consent management:** Ensure consent banners are implemented correctly with granular choices, enable users to withdraw consent at any time, and maintain consent logs **Check third-party contracts:** Review third-party data-sharing practices #### Frequently Asked Questions **What is the scope of TDPSA Texas?** The Texas TDPSA applies to controllers or processors doing business in Texas (or whose services are consumed by Texans), processing or selling personal data, and not small businesses; excludes nonprofits, state bodies, GLBA/HIPAA entities, utility providers, employment- or B2B-context data. **What is personal data under TDPSA Texas?** Any information linked or reasonably linkable to an identified or identifiable individual—e.g., name, IP, cookie IDs, pseudonymous data. **What is sensitive data according to TDPSA Texas?** Data revealing race, religion, health, sexuality, citizenship, biometric/genetic information, child data (<13), or precise geolocation (<1,750 ft). **Who is the regulatory authority for TDPSA Texas?** The Texas Attorney General’s Office has sole enforcement authority. **Who is exempt from TDPSA Texas rules?** Exempt entities include state agencies, nonprofits, institutions under HIPAA/GLBA, utilities, higher-ed, small businesses (<500 employees) unless they sell sensitive data. **Where can I get more information about TDPSA Texas?** See the Texas AG Office website overview and the full text of the Act for more information. --- # Tennessee TIPA Cookie Consent and Compliance URL: https://www.cookiehub.com/tipa-tennessee Last updated: June 18, 2026 ## Tennessee TIPA Cookie Consent and Compliance Under TIPA, implied (optout) cookie consent suffices for general personal data—but explicit optin consent is required for sensitive personal data and data from known children. Is your consent management compliant? ### What your business needs to know about TIPA Tennessee The Tennessee Information Protection Act (TIPA), effective July 1, 2025, is a state data privacy law designed to protect Tennessee residents. It applies standards similar to other state laws and enforces privacy practices through compliance requirements, consumer rights, and penalties. ### What does TIPA Tennessee compliance require? To verify readiness for TIPA compliance, businesses need to: **Conduct an audit:** Perform a full audit of data collection and sharing practices and identify personal data collected and its purposes **Update privacy policy:** Review and update privacy and cookie policies with TIPA-specific disclosures. **Implement consent management:** Implement cookie consent banners and opt-out flows to automate consent capture and preference management **Ensure consumer rights:** Establish mechanisms to respond to consumer rights requests within 45 days **Perform Data Protection Assessments:** Safeguard privacy with regard to targeted advertising, data sales, profiling, or processing sensitive data. ### Who needs to comply with TIPA Tennessee? Compliance with TIPA is required for any forprofit business that: - Do business in Tennessee or targets Tennessee residents; - Have ≥$25 million in annual revenue; - And either processes data of ≥175,000 Tennesseans, or ≥25,000 while earning ≥50% of revenue from selling that data Exemptions include: - Non-profits, state agencies, higher education institutions, HIPAA-covered entities, state licensed insurance companies, and GLBA-regulated financial institutions and data. ### Consumer rights under TIPA Tennessee Tennessee consumers are granted the: **Right to access** Consumers can access and confirm processing of personal data **Right to correct** Consumers can request to correct inaccuracies **Right to delete** Consumers can request that their personal data be deleted **Right to data portability** Consumers have a right to port/download/transmit their information in a usable format **Right to opt-out** Consumers can opt out of the sale of personal data, targeted advertising, and profiling that produces legal/significant effect **Right to know and confirm** Consumers can find out what third parties have received their data and confirm whether an entity is processing it Controllers must respond to rights requests within 45 days (extendable another 45). ### Why cookies as part of TIPA Tennessee compliance Cookies that collect personal data (e.g., IP address, identifiers) require: 1. **Clear disclosure** 1. **Implied optout** for general data 1. **Explicit optin** for sensitive data or children’s data Strictly necessary cookies remain exempt. Controls must also provide clear cookie notices and optout mechanisms to meet transparency and compliance obligations. ### Penalties for TIPA Tennessee non-compliance Enforcement lies with the Tennessee Attorney General. Violations carry: - A 60-day cure period before formal penalties - After curing, must submit a written statement of resolution - Noncured violations risk up to 7,500 USD per consumer per violation, with potential triple damages for willful breaches - Courts may also award injunctive relief and investigative costs - No private right of action under TIPA. ### How to comply with TIPA Tennessee TIPA compliance has specific actions associated, but you can also check that your approach to data privacy aligns with general best practices: **Audit:** Conduct a data audit to identify all cookies and trackers on their websites **Categorize:** Categorize cookies (e.g., necessary, preference, analytics, marketing) **Implement consent management:** Ensure consent banners are implemented correctly with granular choices, enable users to withdraw consent at any time, and maintain consent logs **Check third-party contracts:** Review third-party data-sharing practices #### Frequently Asked Questions **What is the scope of TIPA Tennessee?** It applies to for profit companies doing business in Tennessee targeting its residents, with ≥$25 million revenue and meeting consumer-data thresholds (≥175k total or ≥25k with ≥50% revenue from data sales). **What is personal data under TIPA Tennessee?** Any data linked or reasonably linkable to an identified or identifiable person—name, IP, browsing history, geolocation, email, health app data—but not deidentified or publicly available data. **What is sensitive data according to TIPA Tennessee?** Includes racial/ethnic origin, religion, health, sexual orientation, citizenship, genetic/biometric data, precise geolocation, and data from known children. **Who is the regulatory authority for TIPA Tennessee?** The Tennessee Attorney General enforces TIPA, including issuing 60day cure notices, penalties, and legal actions. **Who is exempt from TIPA Tennessee rules?** Nonprofits, governmental/higheredu entities, HIPAA-covered persons, state-licensed insurers, and GLBA-regulated businesses/data are exempt. **Where can I get more information about TIPA Tennessee?** Official Tennessee code (Title 47 Chapter 18 Part 32) can provide the full background for TIPA Tennessee. --- # Utah UCPA Cookie Consent Management and Compliance URL: https://www.cookiehub.com/ucpa Last updated: June 18, 2026 ## Utah UCPA Cookie Consent and Compliance Businesses operating in or targeting Utah residents must obtain clear, affirmative cookie consent (“optin”) for tracking that qualifies as processing personal data under the Utah Consumer Privacy Act (UCPA), especially when engaging in targeted advertising or selling data. Is your consent management up to par in Utah? ### What your business needs to know about UCPA Utah The Utah Consumer Privacy Act (UCPA), effective December 31, 2023, is a state law that empowers Utah residents with data rights and places obligations on large companies handling their personal data. It regulates personal data collection, sale, targeted advertising, consent mechanisms, and data security. ### What does UCPA Utah compliance require? Evaluate if your organization meets the UCPA's thresholds, and if yes, your compliance checklist should include: **Conduct an audit:** Perform a full audit of data collection and sharing practices. **Update privacy policy:** Update privacy and cookie policies with Utah-specific disclosures. **Implement consent management:** Implement cookie consent banners and opt-out flows to automate consent capture and preference management **Data subject handling:** Establish processes for handling data subject requests. **Data security:** Ensure data security measures are in place. ### Who needs to comply with UCPA Utah? Compliance is required for controllers/processors that: 1. Operate in Utah or market to Utah residents; 1. Generate ≥ $25 million annual revenue; and either \ a) Control/process data of ≥ 100,000 Utah consumers annually; or \ b) Derive > 50% of revenue through data sale/control for ≥ 25,000 Utah consumers Exemptions include institutions of higher education, nonprofits, government entities and contractors, HIPAA-covered entities, GLBA-regulated financial institutions, tribes, air carriers, and data governed under federal laws like FCRA, COPPA, DPPA, FERPA, and Farm Credit Act. ### Consumer rights under UCPA Utah Utah residents enjoy: **Right to access** Confirm whether personal data is processed and request copies **Right to delete** Remove personal data consumers provided **Right to portability** Receive data in a usable, transferable format **Right to optout** Prevent sale of their data and use for targeted advertising **Nondiscrimination** Prohibit penalizing consumers for exercising rights Requests must be acknowledged within 45 days, with one possible 45day extension. Businesses cannot charge for first-time requests unless they are manifestly unfounded or repetitive. There is no private cause of action or right to correction or appeal under UCPA. ### Why cookies as part of UCPA Utah compliance Cookies that process personal data fall under UCPA’s scope. If you use cookies for targeted advertising or data sales, you must: - Disclose cookie use clearly in privacy notices - Offer optout mechanisms before or at first use - Maintain records of consent and optout actions A good cookie consent mechanism and ongoing monitoring are critical—since UCPA compliance requires visibility into all trackers and data flows on sites/apps. A compliant cookie banner should (1) identify cookie categories, (2) explain purposes, (3) offer optout/optin choices, and (4) record consent records—helping meet UCPA transparency and optout obligations. ### Penalties for UCPA Utah non-compliance The Utah Attorney General enforces UCPA via the Division of Consumer Protection. Non-compliance triggers: - Notice of violation + 30day cure window - If not remedied, fines up to 7,500 USD per violation plus actual damages to consumers. ### How to comply with UCPA Utah To check your compliance with data privacy laws and the UCPA Utah, organizations should: **Audit:** Conduct a data audit to identify all cookies and trackers on their websites **Categorize:** Categorize cookies (e.g., necessary, preference, analytics, marketing) **Implement consent management:** Ensure consent banners are implemented correctly with granular choices, enable users to withdraw consent at any time, and maintain consent logs **Check third-party contracts:** Review third-party data-sharing practices #### Frequently Asked Questions **What is the scope of UCPA Utah?** The UCPA applies to large for-profit controllers or processors doing business in Utah or serving Utah residents that meet both: ≥ $25 million annual revenue and either control data of ≥ 100,000 consumers or derive > 50% revenue from data sales serving ≥ 25,000 consumers. **What is personal data under UCPA Utah?** Any information linked or reasonably linkable to an identified or identifiable individual. Deidentified, aggregate, or publicly available data are excluded. **What is sensitive data according to UCPA Utah?** Data revealing racial/ethnic origin, religion, sexual orientation, citizenship/immigration status, medical/mental health info, genetic or biometric identifiers. Processing requires notice and option to optout but not prior consent. **Who is the regulatory authority for UCPA Utah?** The Utah Attorney General enforces the law; the Utah Division of Consumer Protection investigates complaints and assists enforcement. **Who is exempt from UCPA Utah rules?** Exemptions include institutions of higher education, nonprofits, government entities & contractors, tribes, air carriers, HIPAA-covered entities, GLBA-regulated financial institutions, plus data under federal laws (e.g. FCRA, DPPA, FERPA, Farm Credit). **Where can I get more information about UCPA Utah?** Utah’s Division of Consumer Protection website and the full Utah Consumer Privacy Act (Utah Code § 1361101) can offer guidance about UCPA compliance. --- # UK Data Act (DUAA) & UK GDPR: Cookie Consent URL: https://www.cookiehub.com/uk-gdpr-duaa Last updated: September 24, 2026 ## UK GDPR Cookie Consent and Compliance The UK’s Data (Use and Access) Act 2025 (DUAA) updates the UK’s data protection policies, amending the existing UK GDPR and PECR (Privacy and Electronic Communications Regulations). The idea behind DUAA is to make data processing easier for innovation and growth. Are you ready for DUAA? ### What your business needs to know about DUAA/UK GDPR The UK General Data Protection Regulation (UK GDPR) is the United Kingdom’s version of the EU’s GDPR. Following Brexit, the EU GDPR was retained in UK law, with slight amendments, by the European Union (Withdrawal) Act 2018, and it is supplemented by the Data Protection Act 2018. While the core principles remain almost identical to the EU’s GDPR, there are important distinctions that UK businesses—and any organisation handling the data of UK residents—must be aware of. In 2025, the Data (Use and Access) Act (DUAA) amended the UK GDPR, the Data Protection Act 2018 and PECR. ### What does DUAA/UK GDPR compliance require? Like the EU GDPR, the DUAA sets out strict requirements for how businesses must collect, process, and safeguard personal data. To be compliant, organisations must: **Process personal information fairly and lawfully:** Data collection and use must be lawful, fair, and transparent. **Collect data for specific purposes:** Personal data can only be gathered for clearly defined, legitimate purposes. **Appoint a Data Protection Officer (DPO) where required:** Where required, a DPO must be designated to advise on and monitor compliance. **Limit collection and storage:** Follow the principle of data minimisation—only collect what is necessary and store it only as long as needed. **Maintain accuracy:** Ensure personal data is accurate and kept up to date. **Protect data security:** Apply appropriate technical and organisational measures to safeguard integrity, confidentiality, and availability. ### Who needs to comply with DUAA/UK GDPR? DUAA/UK GDPR applies to: - Any organisation based in the UK that processes personal data. - Any non-UK organisation that offers goods or services to, or monitors the behavior of, UK residents. This means even if your business is outside the UK, you may still need to comply if you handle UK citizens’ data. ### Consumer rights under the DUAA/UK GDPR DUAA/UK GDPR grants individuals a robust set of data privacy rights: **The right of access** Individuals can request a copy of their personal data. **The right to rectification** Data subjects can correct inaccurate or incomplete data. **The right to erasure (“right to be forgotten”)** Individuals can request deletion of their personal data. **The right to restrict processing** People can limit how their data is used. **The right to data portability** Data must be provided in a usable, transferable format. **The right to object** Individuals can refuse use of their data for profiling, marketing, or other purposes. **Rights relating to automated decision-making and profiling** People are protected from decisions made solely by automated means without human involvement. ### Why cookies matter under DUAA/UK GDPR Cookies remain a critical compliance issue. Under DUAA/UK GDPR and the UK’s Privacy and Electronic Communications Regulations (PECR), websites must obtain valid consent before placing most types of cookies. Compliance requires: - **Informed consent**: Users must opt in to non-essential cookies. - **Transparency**: Clearly disclose categories, purposes, and retention periods of data collected via cookies. - **Easy withdrawal**: Make it simple for users to withdraw consent at any time. For most UK websites, this means implementing a cookie consent banner that gives users genuine and clear choice. ### Penalties for DUAA/UK GDPR non-compliance The Information Commissioner’s Office (ICO) enforces UK GDPR. Fines can reach up to GBP 17.5 million or 4% of global annual turnover, whichever is higher. The DUAA also raised the maximum fines under PECR, the rules that cover cookies, from GBP 500,000 to the same UK GDPR levels, so cookie consent failures now carry the same maximum penalties as other data protection breaches. Beyond financial penalties, non-compliance risks: - Loss of consumer trust - Contractual risks if partners demand proof of compliance - Legal action from individuals ### How to comply with DUAA/UK GDPR Businesses should take proactive steps to reduce compliance risk: **Review data practices:** Audit how data is collected, processed, and shared, ensuring compliance with DUAA. **Implement consent management:** Use a consent management platform (CMP) such as CookieHub to streamline cookie and consent compliance. **Check partner contracts:** Update third-party contracts to ensure they reflect UK GDPR obligations. **Update privacy policies:** Clearly explain how personal data is used, stored, and shared. **Train employees:** Educate staff on DUAA obligations and their role in compliance. #### Frequently Asked Questions **What is the scope of the Data (Use and Access) Act (DUAA)?** The DUAA establishes rules for how organisations in the UK may access, share, and use personal data in line with the UK GDPR. It applies to businesses and public bodies operating in the UK, as well as foreign entities that process UK residents’ data in connection with goods, services, or monitoring activities. The DUAA complements the UK GDPR by setting clearer standards for data access, particularly in regulated or high-risk sectors. It also amends the UK GDPR, the Data Protection Act 2018 and PECR, including higher PECR fines and new exemptions from cookie consent for some low-risk purposes. **What is personal data under the DUAA and UK GDPR?** Personal data refers to any information that can identify a living individual, directly or indirectly. This includes details such as name, date of birth, address, identification numbers, online identifiers (like cookies or IP addresses), or any factors relating to a person’s physical, cultural, or social identity. **What is sensitive data according to the DUAA and UK GDPR?** Sensitive data (legally referred to as special category data) includes information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used for identification, health information, and details about sex life or sexual orientation. Processing this type of data under the DUAA and UK GDPR requires stronger safeguards and usually explicit consent. **Who is the regulatory authority for the DUAA and UK GDPR?** The Information Commissioner’s Office (ICO) is the UK’s independent data protection regulator. It oversees compliance with the UK GDPR, the Data Protection Act 2018, and related laws such as the DUAA. The ICO has powers to investigate, issue guidance, and levy fines for non-compliance. **Who is exempt from the DUAA rules?** The DUAA generally does not apply to individuals using personal data for strictly personal or household purposes. Certain exemptions may also apply to data processed for journalism, academic research, or national security. Additionally, specific statutory provisions may allow limited use of personal data without DUAA obligations in exceptional cases. **Where can I get more information about the DUAA and UK GDPR?** Guidance and official updates are available on the Information Commissioner’s Office (ICO) website (ico.org.uk). Depending on your sector, regulators such as the FCA (for finance) may provide additional resources. For in-depth advice, consulting a legal or compliance professional with expertise in UK data protection law is recommended. --- # Virginia VCDPA Cookie Consent and Compliance URL: https://www.cookiehub.com/vcdpa Last updated: June 18, 2026 ## Virginia VCDPA Cookie Consent and Compliance The Virginia Consumer Data Protection Act (VCDPA) is one of many state-level pieces of legislation designed to offer consumers greater control over their personal data, starting with consent. Are you compliant? ### What your business needs to know about VCDPA The Virginia Consumer Data Protection Act (VCDPA) is a major piece of legislation that came into effect on January 1, 2023. It establishes a comprehensive legal framework aimed at heightening consumer privacy rights and providing residents of Virginia with greater control over their personal data. With the ubiquitous nature of modern data collection practices, VCDPA not only grants consumers greater rights but imposes strict obligations on businesses that handle this data. ### What does VCDPA compliance require? Businesses are also held to a number of obligations related to processing personal data: **Data protection assessments:** Conduct risk assessments for activities that may pose heightened risks to consumer privacy **Privacy policy updates:** Provide clear and accessible privacy policies that inform consumers about their data collection and processing methods **Consumer request handling:** Establish processes to handle consumer requests regarding their rights under the VCDPA, including access, correction, deletion, and data portability **Data minimization:** Limit the collection and processing of personal data to what is necessary for the intended purpose **Transparency:** Be transparent about their data processing activities, including the categories of personal data collected and the purposes for which it is used ### Who needs to comply with VCDPA? VCDPA pertains to any business that processes the personal data of Virginia residents and meets at least one of the following criteria: - Processes the personal data of at least 100,000 consumers in a calendar year - Processes the personal data of at least 25,000 consumers and derives over 50% of its gross revenue from the sale of personal data There are some exemptions to VCDPA, including: - Any government body, authority, board, commission, district, or agency of Virginia or its political subdivisions - Financial institutions or data governed by Title V of the federal Gramm-Leach-Bliley Act - Covered entities or business associate subject to the privacy, security, and breach notification regulations under HIPAA - Nonprofit organizations - Higher education institutions ### Consumer rights under the VCDPA The VCDPA grants Virginia residents a number of rights concerning their data, including allowing consumers to: **Right to access** Request access to their personal data held by businesses **Right to correct** Correct inaccuracies in their data **Right to delete** Request the deletion of their personal data, with certain exceptions **Right to opt-out** Opt out of the processing of their personal data for targeted advertising, the sale of their data, or for profiling ### Why cookies as part of VCDPA compliance Among the many things cookies do, most of all, they are used to track and collect information about consumers’ online behavior and preferences. Under VCDPA regulations, businesses that use cookies must inform consumers about their data collection practices, including what information is being collected and how it will be used. ### Penalties for VCDPA non-compliance As with most data privacy non-compliance violations, penalties can be severe in both monetary and reputational terms. The Attorney General of Virginia is responsible for enforcing VCDPA and has the authority to impose hefty fines. If a business is found to be in violation of VCDPA, the Attorney General can issue a notice of violation, allowing the business 30 days to address the problem. If a violation is not addressed within this time, businesses can face fines of up to 7,500 USD per individual violation. ### How to comply with the VCDPA Businesses can also take additional steps to ensure compliance and a consent-first mindset: **Conduct data audits:** Review current data practices to identify areas that need adjustment to align with VCDPA **Update privacy policies:** Revise privacy notices to clearly outline data practices, consumer rights, and how to exercise those rights **Implement consent management:** Get effective management and control of cookie use with a comprehensive consent management platform like CookieHub **Educate employees:** Offer staff education programs on the importance of data privacy and VCDPA compliance #### Frequently Asked Questions **What is the scope of the Virginia Consumer Data Protection Act (VCDPA)?** The VCDPA applies to businesses that control or process personal data of Virginia residents, meet certain thresholds (such as revenue or amount of data processed), and conduct business in Virginia or target Virginia consumers. It governs how personal data is collected, used, and shared to protect consumer privacy. **What is personal data under VCDPA?** Personal data is any information that is linked or reasonably linkable to an identified or identifiable natural person. This includes data such as names, addresses, email addresses, IP addresses, and other information that can identify an individual. **What is sensitive data according to the VCDPA?** Sensitive data under the VCDPA includes specific categories of personal data that require additional protections, such as social security numbers, drivers’ license or state ID numbers, financial account numbers, precise geolocation data, racial or ethnic origin data, information about religious beliefs, genetic or biometric data, or health data. **Who is the regulatory authority for Virginia’s VCDPA?** The Virginia Attorney General is the primary regulatory authority responsible for enforcing the VCDPA and overseeing compliance with its provisions. **Who is exempt from VCDPA rules?** Certain entities are exempt from the VCDPA, including nonprofits, higher education institutions, consumer reporting agencies regulated under the Fair Credit Reporting Act (FCRA), and entities already subject to other comprehensive federal privacy laws, such as HIPAA. **Where can I get more information about the Virginia Consumer Data Protection Act?** For more details, visit the official Virginia Attorney General’s website or consult the full text of the VCDPA available through Virginia state government resources.