Cookie banner
Regional rules
How the cookie banner adapts to where your company is established and where each visitor is: consent in Europe and Québec, opt-out notices or no banner elsewhere.
Privacy rules depend on two places: where your company is established, and where the visitor is. The banner applies the stricter of the two, for each visit.
#The rules
| Your company | Visitors in Europe | Visitors in Québec | Visitors in the United States | Visitors elsewhere |
|---|---|---|---|---|
| Established in Europe | Ask for consent | Ask for consent | Ask for consent | Ask for consent |
| Established elsewhere | Ask for consent | Ask for consent | Ask for consent, or an opt-out notice | Ask for consent, an opt-out notice, or no banner |
Europe means the EU, the EEA, the United Kingdom and Switzerland. A company established there must ask every visitor, wherever they are, because the GDPR and the ePrivacy rules follow the company. Any company must ask visitors in Europe. Visitors in Québec are always asked too: Québec's Law 25 wants technologies that identify, locate or profile a person turned off by default. The rest of Canada follows your rules for visitors elsewhere. Visits whose country cannot be determined are always asked for consent.
Where your company is established comes from the country in your company profile. Choose the modes in Cookies → Banner → Regions, and use Preview as a visitor from to see each version.
#The three modes
- Ask for consent. Nothing non-essential loads before the visitor chooses. The default everywhere.
- Opt-out notice. The tools load at once. A notice says so and offers OK, Do not sell or share my info (Marketing off) and Customise.
- No banner. The tools load at once and nothing is shown. Your cookie settings link still lets visitors choose.
Global Privacy Control applies in every mode: Marketing stays off for visitors who send it.
#The "Do Not Sell or Share" link
US state laws ask for a link with this wording. Add it to your footer with the snippet in Cookies → Install. The banner shows it to visitors in the United States only:
<a href="#" data-pb-open data-pb-region="us" hidden>Do Not Sell or Share My Personal Information</a>
#How the region is found
The visitor's country is read by the hosting network when the banner script is requested, and the regional version of the script is served from the cache. No IP address is stored, and no extra request is made. The consent log records the region (Europe, Québec, United States or Elsewhere) with each choice.
#FAQ
#Can I skip the banner for visitors outside Europe?
Only if your company is established outside Europe, and only for visitors outside Europe and the United States. Some countries outside Europe also expect consent, for example Brazil or South Korea (Québec is always asked), so check the rules where your visitors are.
#What happens with a VPN?
The banner uses the country the connection comes from. When that country is unknown, the visitor is asked for consent, the strictest choice.
Privacyboard is a guidance tool, not legal advice. This page describes what the product does today. Found something unclear or out of date? Write to antoine@unmake.io.