Guides & Documentation
Everything you need to implement cookie consent on your website
Showing 212 guides in Compliance
Do You Need a DPO for Cookie Compliance?
Not every website needs a data protection officer. But if tracking is central to how your business runs, GDPR may force you to appoint one, and behavioral advertising is an example regulators name directly. Here's how to read Article 37 against your cookie setup.
Cookie Consent for Crypto Exchanges and Web3 Sites
MiCA gives EU crypto platforms a hard authorization deadline and ties their data handling to GDPR. For a global exchange, that means running cookie consent properly across every jurisdiction it serves. Here's how.
CPRA Enforcement 2025-2026: What the CPPA Is Doing
California now enforces the CCPA/CPRA through two agencies, and the fines are getting bigger. Here is what the CPPA and the Attorney General have actually pursued in 2025 and 2026, and what it means for your site.
Why Copying a Competitor's Cookie Banner Backfires
Cloning a competitor's cookie banner feels like a shortcut. It maps consent to their cookies, not yours, can copy a non-compliant pattern, and leaves you with no records of your own. Here's the risk breakdown.
A Cookie Plugin Alone Won't Make You Compliant
Installing a well-known consent plugin and watching the banner appear feels like the job is done. It isn't. noyb filed 226 complaints against companies running one of the biggest CMPs. The tool isn't compliance, the configuration is.
Cookie Consent Myths That Cost Companies Millions
"Implied consent is fine." "We're US-only, so GDPR doesn't apply." "A banner makes us compliant." Ten cookie consent myths that regulators have already fined, and what the law actually says.
Consent Mode v2 for EEA vs Non-EEA Traffic: Regional Gating
Google only requires consent signals for EEA, UK and Swiss traffic. Here's how the region parameter scopes strict consent defaults to those visitors while preserving measurement everywhere else.
Consent Management Is an Ongoing Process, Not a One-Time Setup
Installing a banner is day one, not the finish line. Here's the operating model for consent as a continuous discipline: what changes, how often to check it, and who owns it.
The European Accessibility Act and Your Cookie Banner
Since 28 June 2025 the European Accessibility Act makes accessibility a legal requirement for e-commerce, banking, and many other services. Your cookie banner is part of that surface. Here's the standard, and a ten-minute test.
Connecticut CTDPA Cookie Compliance in 2026
Connecticut's data privacy law just got a major overhaul that took effect July 1, 2026: a far lower coverage threshold, expanded sensitive data, and a blanket ban on targeted ads to teens. The GPC mandate has been live since January 2025.
Colorado Privacy Act: Cookie Rules for 2026
Colorado was the first state to make honoring the Global Privacy Control mandatory. Since July 1, 2024, controllers have had to treat a GPC signal as an opt-out, the cure period is gone, and penalties reach $20,000 per violation.
The Court Rulings That Shaped Cookie Consent in the EU
Most of what makes a cookie banner legal in Europe was decided by the Court of Justice, not written in a statute. These five CJEU judgments, from Planet49 to IAB Europe, are the case law your banner has to satisfy.
Partitioned Cookies (CHIPS): Do You Still Need Consent?
CHIPS lets a third-party cookie work inside one site without being readable across sites. It's a genuine anti-tracking win. It is not a consent exemption, and treating it like one is a mistake.
China's PIPL: Cookie Consent and Transfers in 2026
China's PIPL has no legitimate-interests basis, so tracking almost always runs on consent, and it adds a concept most laws don't: separate consent for third-party sharing, targeted ads, and sending data abroad. Here's how it works after the 2024 transfer reforms.
Browser Fingerprinting and Why Browsers Block It
Fingerprinting identifies visitors without a cookie, which is exactly why it survives cookie clearing and why Safari, Firefox, and Brave all fight it. Here's how it works and what it means for consent.
Brave Browser, Shields, and Your Consent Banner
Brave blocks trackers, cross-site cookies, and fingerprinting out of the box, and randomizes the signals sites use to identify visitors. Here's how Shields work and what they mean for tracking and consent.
B2B Visitor Deanonymization and Consent: What's Legal
Person-level visitor ID tools like RB2B are US-only for a reason: naming an anonymous EU visitor without consent is too risky to operate at scale. Here's the line between company-level and person-level identification, why 'GDPR doesn't apply to B2B' is wrong, and how to deploy these tools cleanly.
Cookie Consent for Automotive Sites and Car Dealerships
Auto dealers are financial institutions under federal law, and connected-car data just cost General Motors a five-year FTC ban. Here's what that means for cookie consent on dealership and automotive websites in 2026.
Australia's Privacy Act Reform: Cookies in 2026
Australia has no cookie-banner law, and it isn't getting one. But the 2024 Privacy Act reforms added a statutory privacy tort, a children's code, and penalties up to AUD $50 million. Here's what actually applies to cookies, and what's still coming.
Astro Cookie Consent: Islands and Script Blocking
Astro ships zero JavaScript by default, but the moment you drop in a Google Analytics snippet or a Meta Pixel it fires on render, before any consent. Here's how Astro processes scripts, how to block trackers until a visitor opts in, and how to wire up Consent Mode v2.
Angular Cookie Consent: The 2026 Developer Guide
Angular bootstraps one JavaScript bundle and never reloads the page on a route change, so a tracker in index.html or the angular.json scripts array runs before your app decides anything. Here's where the consent loader belongs, how to block scripts, and how to expose consent through a service.
AI Chatbot Consent: LLM Widgets and Third-Party Data
An AI chat widget does two things a plain chat widget doesn't: it writes storage the moment it loads, and it ships whatever a visitor types to an LLM provider that often sits in another country. Both carry consent consequences.
Agency Liability: Controller or Processor for Consent?
When a client's cookie banner is non-compliant, agencies assume it's the client's problem. Fashion ID says otherwise. Here's how controller vs processor status decides your liability, when you become a joint controller, and the contract structure that actually protects you.
Age Assurance for Cookie Consent: When Self-Declaration Isn't Enough
If children might use your site, a checkbox saying 'I am over 16' won't satisfy COPPA, GDPR Article 8, or UK regulators. Here's how age assurance methods actually stack up, and what they mean for the cookies you set.