# Cross-Jurisdiction Cookie Compliance Standards

## EU — ePrivacy Directive 2002/58/EC
- Article 5(3): Opt-in consent for non-essential cookies
- Strictly necessary exemption available
- CJEU Planet49 (C-673/17): Active consent, no pre-ticked boxes

## UK — PECR (SI 2003/2426)
- Regulation 6: Mirrors EU ePrivacy Article 5(3)
- UK GDPR (retained EU GDPR) for consent definition
- ICO enforcement authority
- Post-Brexit: separate but substantially aligned with EU

## France — CNIL Guidelines
- Deliberation 2020-091: Equal prominence accept/reject
- 13-month cookie maximum, 6-month reconsent
- Audience measurement exemption (strict conditions)

## Germany — TTDSG
- Section 25: Consent for storing/accessing terminal equipment
- Transposition of ePrivacy Article 5(3) into German law
- BGH Planet49 decision (May 2020): implemented CJEU ruling

## California — CCPA/CPRA
- Cal. Civ. Code §1798.100 et seq.: Opt-out model
- "Do Not Sell or Share My Personal Information" link required
- GPC signal legally binding (§1798.135(e); 11 CCR §7025)
- Under-16 users: opt-in required

## Colorado — CPA
- C.R.S. §6-1-1301 et seq.: Opt-out for targeted advertising and sale
- Universal opt-out mechanism required (4 CCR 904-3 Rule 5.11)
- Effective July 1, 2024

## Connecticut — CTDPA
- P.A. 22-15: Opt-out for targeted advertising, sale, profiling
- Must honor opt-out preference signals (GPC)
- Effective July 1, 2023

## Brazil — LGPD
- Lei 13.709/2018: Legal basis required for processing
- Article 7: Ten legal bases including consent and legitimate interest
- ANPD (National Data Protection Authority) guidance evolving
- No specific cookie regulation (unlike ePrivacy)