Jurisdictions

Eleven laws,
one straight answer.

Each regulation is modelled in the engine — its consent model, banner rules, request types and deadlines. Your visitors are matched to the right one server-side, from their location, on every request.

Resolution

When laws overlap,
the strictest wins.

A visitor can sit under several regimes at once — an EU citizen has GDPR and ePrivacy; a Montréal visitor has PIPEDA and Law 25. Cookie Gate merges every applicable rule set and keeps the strictest value for each dimension. Your own enforcement preferences can only tighten the result further.

GDPR

Opt-in

General Data Protection Regulation

European Union · DPR deadline: 30 days

Freely given, specific, informed consent before any non-essential cookie. Rejecting must be as easy as accepting.

  • Prior blocking of all non-essential scripts, iframes and pixels
  • Equal-weight Accept and Reject; granular purposes in preferences

ePrivacy

Opt-in

ePrivacy Directive

European Union · DPR deadline: with GDPR

The cookie-specific layer of EU law: consent before storage or access on a user’s device, with narrow strictly-necessary exemptions.

  • Applied automatically alongside GDPR for EU visitors
  • Strictly-necessary cookies exempt and clearly disclosed

UK GDPR + PECR

Opt-in

UK GDPR & Privacy Regulations

United Kingdom · DPR deadline: 30 days

Post-Brexit mirror of GDPR plus PECR’s cookie rules, enforced by the ICO.

  • UK visitors resolved separately from the EU
  • Same prior-consent enforcement and evidence chain

CCPA / CPRA

Opt-out

California Consumer Privacy Act

California, US · DPR deadline: 45 days

Notice at collection and a real "Do Not Sell or Share" path. The Global Privacy Control signal must be honoured.

  • Opt-out banner mode with GPC auto-honoured as an opt-out
  • Opt-out of sale/sharing request types in the DPR desk

LGPD

Opt-in

Lei Geral de Proteção de Dados

Brazil · DPR deadline: 15 days

Consent for non-essential processing with a short statutory response window for data-subject requests.

  • Opt-in enforcement with Portuguese banner translations
  • 15-day deadlines computed automatically on DPR arrival

DPDPA

Opt-in

Digital Personal Data Protection Act

India · DPR deadline: 30 days

Verifiable, informed consent with plain-language notice. Strong expectations around notice in Indian languages.

  • Opt-in enforcement; grievance and nomination request types
  • Indic-language banner translations via IndicTrans2

POPIA

Hybrid

Protection of Personal Information Act

South Africa · DPR deadline: 30 days

Lawful-processing conditions with objection rights — stricter than pure notice, softer than EU opt-in.

  • Hybrid banner mode modelled per the Act
  • Objection and access requests with 30-day deadlines

PIPEDA + Law 25

Hybrid

PIPEDA & Quebec Law 25

Canada · DPR deadline: 30 days

Federal consent principles, with Quebec’s Law 25 imposing stricter, French-first requirements provincially.

  • Sub-regional override: Quebec visitors get Law 25 treatment
  • GPC honoured as an opt-out signal

PDPA

Opt-in

Personal Data Protection Act

Thailand · DPR deadline: 30 days

GDPR-style consent with Thai-language notice expectations.

  • Opt-in enforcement with Thai translations
  • Standard access/erasure request types

APPI

Notice

Act on the Protection of Personal Information

Japan · DPR deadline: 30 days

Notice-based regime with special handling for Personally Referable Information (PRI) shared with third parties.

  • Notice banner mode with PRI-aware categories
  • Japanese translations; opt-out paths where required

PIPL

Opt-in

Personal Information Protection Law

China · DPR deadline: 15 days

Separate consent for distinct processing purposes and a short response window for subject requests.

  • Opt-in enforcement with per-purpose granularity
  • 15-day deadlines computed automatically

Signals

Global Privacy Control, taken seriously.

When a browser sends the GPC signal, Cookie Gate reacts per regulation: an automatic opt-out under CCPA, pre-set denial under GDPR (the visitor still confirms), and an opt-out under PIPEDA. The signal is recorded in the consent receipt either way.

Start free trial How enforcement works