CookieGate
Start free trial

Eleven regulations. One answer per visitor.

Each regulation is modelled in the engine: its consent model, banner rules, request types and response window.

When laws overlap, the strictest wins.

A visitor can fall under several laws at once: the GDPR and ePrivacy in Munich, PIPEDA and Quebec’s Law 25 in Montréal. Every applicable rule set is merged and the strictest value is kept for each dimension.

Overlap desk
Visitor from

Montréal

Rule sets applied PIPEDA and Quebec’s Law 25 (sub-region CA-QC)

dimension PIPEDA Law 25 kept
consent model hybrid opt-in opt-in
consent before tracking no yes yes
reject button recommended required required
close button dismiss reject reject
granular purposes recommended required required

Kept: the stricter value on every row. A Montréal visitor is held to opt-in with consent before tracking and a required Reject.

Munich

Rule sets applied GDPR and ePrivacy

dimension GDPR ePrivacy kept
consent model opt-in opt-in opt-in
consent before tracking yes yes yes
reject button required required required
close button reject reject reject
granular purposes required required required

The two rule sets agree on every row, so the merge keeps the shared value. A Munich visitor is under both at once.

Values as the engine stores them for each rule set.

Walk to the counters

Eleven counters, in the order of the board.

Every value on a sheet is read from the engine. The sentences are ours.

GDPR
General Data Protection Regulation

European Union

Freely given, specific, informed consent before any non-essential cookie. Rejecting must be as easy as accepting.

Applied together with the ePrivacy Directive for visitors in the EU and EEA.

Counter · GDPR gdpr
Consent model
opt-in, consent before tracking
Reject button
required
Response window
30 days, computed when a request arrives
Request types, signal, languages
Request types
  • Access
  • Correction
  • Erasure
  • Portability
  • Restriction
  • Objection
  • Withdraw consent
  • Automated decisions
Global Privacy Control
Denied by default; the visitor still confirms pre_set_deny
Languages
none mandated
Authority
National DPA

ePrivacy
ePrivacy Directive

European Union

The cookie-specific layer of EU law: consent before storage or access on a visitor’s device, with narrow strictly-necessary exemptions.

The cookie layer of EU law, applied automatically alongside the GDPR.

Counter · EPRIVACY eprivacy
Consent model
opt-in, consent before tracking
Reject button
required
Response window
30 days
Request types, signal, languages
Request types
  • Access
  • Correction
  • Erasure
  • Portability
  • Restriction
  • Objection
  • Withdraw consent
  • Automated decisions
Global Privacy Control
Denied by default; the visitor still confirms pre_set_deny
Languages
none mandated

UK GDPR
UK General Data Protection Regulation and the Privacy and Electronic Communications Regulations

United Kingdom

Post-Brexit mirror of the GDPR plus PECR’s cookie rules, enforced by the ICO.

UK visitors are resolved separately from the EU.

Counter · UK GDPR uk_gdpr
Consent model
opt-in, consent before tracking
Reject button
required
Response window
30 days
Request types, signal, languages
Request types
  • Access
  • Correction
  • Erasure
  • Portability
  • Restriction
  • Objection
  • Withdraw consent
  • Automated decisions
Global Privacy Control
Denied by default; the visitor still confirms pre_set_deny
Languages
en
Authority
ICO

CCPA/CPRA
California Consumer Privacy Act, as amended by the CPRA

California, United States

Notice at collection and a real "Do Not Sell or Share" path. The Global Privacy Control signal must be honoured.

Counter · CCPA/CPRA ccpa
Consent model
opt-out
Reject button
not required
Response window
45 days
Request types, signal, languages
Do Not Sell or Share link
shown
Request types
  • Access
  • Correction
  • Erasure
  • Opt out of sale
  • Opt out of sharing
  • Limit sensitive data
Global Privacy Control
Opted out automatically auto_opt_out
Languages
en
Authority
California Attorney General / CPPA

LGPD
Lei Geral de Proteção de Dados

Brazil

Consent for non-essential processing with a short statutory response window for data-subject requests.

Counter · LGPD lgpd
Consent model
opt-in, consent before tracking
Reject button
required
Response window
15 days
Request types, signal, languages
Request types
  • Access
  • Correction
  • Erasure
  • Portability
  • Withdraw consent
  • Automated decisions
  • Objection
Global Privacy Control
Recorded on the receipt, not applied none
Languages
pt-BR
Authority
ANPD

DPDPA
Digital Personal Data Protection Act, 2023

India

Free, specific, informed, unconditional and unambiguous consent by a clear affirmative action, with notice available in English or any language in the Eighth Schedule.

Banners are available in all 22 scheduled Indian languages.

Counter · DPDPA dpdpa
Consent model
opt-in, consent before tracking
Reject button
required
Response window
30 days
Request types, signal, languages
Request types
  • Access
  • Correction
  • Erasure
  • Nomination
  • Grievance
Global Privacy Control
Recorded on the receipt, not applied none
Languages
enhi
Authority
Data Protection Board of India

POPIA
Protection of Personal Information Act

South Africa

Lawful-processing conditions with objection rights: stricter than pure notice, softer than EU opt-in.

Counter · POPIA popia
Consent model
hybrid, consent before tracking
Reject button
recommended
Response window
30 days
Request types, signal, languages
Request types
  • Access
  • Correction
  • Erasure
  • Objection
  • Grievance
Global Privacy Control
Recorded on the receipt, not applied none
Languages
en
Authority
Information Regulator

PIPEDA
Personal Information Protection and Electronic Documents Act

Canada

Federal consent principles, with Quebec’s Law 25 imposing stricter, French-first requirements provincially.

Quebec’s Law 25 tightens this to opt-in for visitors in Quebec.

Counter · PIPEDA pipeda
Consent model
hybrid, no consent before tracking Quebec: opt-in, consent before tracking
Reject button
recommended Quebec: required
Response window
30 days
Request types, signal, languages
Request types
  • Access
  • Correction
  • Grievance
Global Privacy Control
Treated as an opt-out outside Quebec opt_out
Languages
enfr Quebec: fr-CA
Authority
Office of the Privacy Commissioner

PDPA
Personal Data Protection Act

Thailand

GDPR-style consent with Thai-language notice expectations.

Counter · PDPA pdpa
Consent model
opt-in, consent before tracking
Reject button
required
Response window
30 days
Request types, signal, languages
Request types
  • Access
  • Correction
  • Erasure
  • Portability
  • Restriction
  • Objection
  • Grievance
Global Privacy Control
Recorded on the receipt, not applied none
Languages
th
Authority
PDPC Thailand

APPI
Act on the Protection of Personal Information

Japan

Notice for first-party use and explicit consent before Personally Referable Information is shared with third parties; implied consent is allowed where the Act permits it.

Counter · APPI appi
Consent model
opt-in, consent before tracking implied consent allowed
Reject button
recommended
Response window
30 days
Request types, signal, languages
Request types
  • Access
  • Correction
  • Erasure
  • Opt out of sharing
Global Privacy Control
Recorded on the receipt, not applied none
Languages
ja
Authority
PPC Japan

PIPL
Personal Information Protection Law

China

Separate consent for distinct processing purposes and a short response window for subject requests.

Counter · PIPL pipl
Consent model
opt-in, consent before tracking
Reject button
required
Response window
15 days
Request types, signal, languages
Request types
  • Access
  • Correction
  • Erasure
  • Portability
  • Restriction
  • Objection
  • Withdraw consent
  • Automated decisions
  • Grievance
Global Privacy Control
Recorded on the receipt, not applied none
Languages
zh
Authority
Cyberspace Administration of China

Response window: the window CookieGate applies to a request from the moment it arrives. Statutory periods differ by law and are not stated here.

Global Privacy Control, handled per regulation.

Global Privacy Control, a browser signal, is recorded on every receipt and applied per law: an automatic opt-out under the CCPA, a pre-set denial under the GDPR, ePrivacy and the UK GDPR, and an opt-out under PIPEDA.

Signals desk
regulation engine action what happens
CCPA/CPRA auto_opt_out Opt-out applied automatically; recorded.
GDPR, ePrivacy, UK GDPR pre_set_deny Consent pre-set to deny; the visitor still confirms; recorded.
PIPEDA opt_out Opt-out applied; recorded.
Every other counter LGPD, DPDPA, POPIA, PDPA, APPI, PIPL none Recorded as gpc_signal; no opt-out applied.

The receipt a San Jose visitor’s signal prints

ccpa<<<<<gpc_opt_out<<<<2026-10-03T13:17:40Z
gpc<true<<hash<fcd26e52a63e30477dae28<<<<<<<

Illustrative. Field values as the product prints them.

How enforcement works

Put the right counter in front of every visitor.

One tag resolves the law on the server for every visit and holds non-essential tags until the visitor decides. Every paid plan starts with a 15-day trial.

Start free trial How enforcement works

15 days. Card required. Nothing is charged before day 15.

Starter ₹2,499 a month. Professional ₹7,499 a month. Enterprise by conversation.

We respond within one business day. Talk to sales