Rules by country

Privacy laws differ by region. In Europe a website must ask before setting cookies that are not necessary (opt-in). Several US state laws instead give visitors the right to object to the sale or sharing of their personal data (opt-out). On the Pro and Business plans the banner can follow these differences.

What visitors see

Visitor’s region	Rule	What happens
EU, EEA (Iceland, Liechtenstein, Norway), United Kingdom, Switzerland	Opt-in, always	The usual banner. Nothing except necessary cookies runs until the visitor chooses. This cannot be changed.
United States	Your choice; opt-out by default	See below.
Rest of the world	Your choice; opt-in by default	See below.
Unknown	Opt-in	When the country cannot be determined, the strictest rule applies.

For the United States and for the rest of the world you can choose:

• Ask before cookies (opt-in). The same banner as in Europe.
• Cookies on, with “Do not sell or share” (opt-out). Cookies and blocked scripts run from the first page. A notice says so and offers three buttons:
  • Do Not Sell or Share My Personal Information: marketing is turned off, preferences and statistics stay on. The choice is logged.
  • Settings: the switches per category, as in Europe.
  • OK: keeps everything on. The choice is logged.
• No banner, cookies on. Nothing is shown and everything runs. Visitors can still open the settings if your site calls CookieDoo.open(), for example from a “Cookie settings” link.

A choice the visitor has already made always wins over these defaults.

Global Privacy Control

Global Privacy Control (GPC) is a signal some browsers and extensions send to say “do not sell or share my data”. Outside opt-in regions, CookieDoo treats it as an opt-out: marketing stays off without asking. The notice tells the visitor that the signal was honoured and does not show the opt-out button. In opt-in regions nothing runs before consent anyway.

How the country is found

CookieDoo is served through Cloudflare, which reports the visitor’s country from the IP address. The banner asks for it once per browser session, and only if the banner has rules by country. No IP address is stored for this. Countries can be wrong for visitors using a VPN; in that case they get the rules of the country the VPN shows.

Signals for ad tags (GPP)

Ad tags in the US (Google, header bidding, ad networks) read a visitor’s choices through the IAB’s Global Privacy Platform (GPP). For US visitors, CookieDoo provides the __gpp API and a GPP string with the US National section (usnat):

• “sale”, “sharing” and “targeted advertising” are reported as opted out when marketing is off (Do Not Sell, Deny, GPC, or opt-in before a choice), and as not opted out when marketing is on;
• the GPC signal is included as its own field;
• when the visitor changes their choice, tags listening to the API are told at once.

Visitors outside the US get “not applicable”. Banners without rules by country do not use GPP.

MSPA. If your company has signed the IAB’s Multi-State Privacy Agreement, turn on We have signed the IAB MSPA under By country; transactions are then marked as MSPA-covered. Otherwise leave it off.

Set it up

1. In Edit banner, open By country and turn on Different rules outside Europe.
2. Choose the rule for United States and for Rest of the world.
3. Use Visitor’s region above the preview (Europe / US / Other) to see each version.
4. Publish.

On Free and Lite the section shows an upgrade link, and every visitor gets the opt-in banner.

Caution

Which rule fits your business depends on the laws that apply to you and your visitors. If in doubt, keep opt-in everywhere: it is valid in every region.