Cookie consent and tracking controls by region

Definition

The rules depend on where the relevant users are, the technology's purpose and any applicable exception. Consent and opt-out settings should match the tools the site actually uses. In the EU the rule comes from Article 5(3) of the ePrivacy Directive as implemented nationally, alongside the GDPR standard for consent. In the UK it is the Privacy and Electronic Communications Regulations, as amended by the Data (Use and Access) Act 2025. In the US the question is framed through state privacy statutes and their opt-out rights.

Does it apply to you

• You use cookies or similar storage or access technologies for a purpose outside the legal exceptions. That usually includes advertising pixels, session recording and many embeds, and in the EU most analytics.
• Your visitors are in a region with such a rule, which for most business websites means at least one.

Why it matters

A visible banner does not establish how tags behave. Testing should check the actual requests made before and after a choice.

Requirements

• In the EU, storing or reading information on a visitor's device needs consent, given after clear and comprehensive information. The ePrivacy Directive allows two exceptions: storage or access for the sole purpose of transmitting a communication, and storage or access strictly necessary for a service the visitor explicitly requested.
• In the UK, wider exceptions have applied since February 5, 2026. Consent is not needed for storage or access that is strictly necessary for a service the user requested, which includes security, fraud prevention, authentication and remembering a user's choices. It is also not needed to adapt a site's appearance or functions to the user's preferences, or to locate a user who asks for emergency help.
• The UK statistical exception covers analytics used only to measure how a site is used so it can be improved. The visitor must get clear and comprehensive information about that purpose and a simple, free way to object. The information can be shared only with someone helping make those improvements. Advertising still needs consent.
• Where consent is required, the technology must wait for it. Pre-ticked boxes, implied consent from continued browsing, and a banner that loads the tags anyway do not meet the standard.
• Refusing must be as easy as accepting. A prominent accept button beside a link to a settings page is the pattern regulators have criticized.
• Withdrawal must be available later, and as easy as giving consent.
• In opt-out states, honoring a universal opt-out preference signal such as the Global Privacy Control.

Steadwatch's role

• Optional tracking and advertising tags wait for consent in regions where prior consent applies. Before publication, a test loads the site from an EU location and checks that those tags make no requests before a choice.
• Region determines the treatment: prior consent where required, opt-out with Global Privacy Control respected where that is the standard.
• A shared vendor declaration supplies information for the cookie table, consent categories and permitted resource origins. It also supports privacy-notice updates. Changes are reviewed against the site's actual behavior and the information the business provides.

Records you receive

• A consent log by region showing what was presented and what was chosen.
• A dated pre-consent test result, stating which tags and regions it covered.
• A cookie table based on the vendor declaration and reviewed against what the site sets.

Your responsibilities

• Deciding whether you want the tracking at all. The cheapest way to comply is to stop collecting what you never use, and that is a business decision.