Regions and privacy signals
By default every visitor sees the banner. This page explains how you limit it to chosen countries, what visitors elsewhere get, and how Cookiemark treats the privacy signal some browsers send.
Who gets the banner
On the site's Regions tab you choose between two settings.
- Every visitor. Everyone is asked first, wherever they are. This is the default and the safest choice.
- Only visitors from the countries below. Visitors from the countries that are asked first get the banner. Visitors from the countries with an opt-out notice get that notice. Visitors from everywhere else get nothing, and the categories you offer are allowed for them straight away.
The list of countries that are asked first starts with the 32 countries of the European Economic Area, the United Kingdom and Switzerland. You can add or remove countries with their two-letter codes, separated by commas. When a country is on both lists, it is asked first.
Privacy laws as presets
Above the country lists you pick the privacy laws that apply to your visitors. Each law fills in its countries, and you can change the lists afterwards. A law you switch off takes away its countries, unless another law you picked still needs them.
| Law | Where | What visitors get |
|---|---|---|
| GDPR | European Economic Area | The banner, asked first |
| UK GDPR | United Kingdom | The banner, asked first |
| nFADP | Switzerland | The banner, asked first |
| LGPD | Brazil | The banner, asked first |
| Law 25 | Canada | The banner, asked first |
| POPIA | South Africa | The banner, asked first |
| CCPA and CPRA | United States | The opt-out notice |
Region rules work per country. A law of one state or province therefore covers the whole country: the CCPA is a Californian law, and Law 25 is a law of Quebec, but the presets apply them to all of the United States and all of Canada. That asks more people than the law needs, never fewer.
The opt-out notice
Most US state privacy laws do not ask for consent before cookies. They give visitors the right to opt out of the sale or sharing of their personal information, which in practice means advertising cookies. For countries on the opt-out list, Cookiemark works like this:
- Every category you offer is allowed straight away, and Google Consent Mode is granted.
- A notice shows with three buttons: one for the preferences, one labelled Do Not Sell or Share My Personal Information, and one to close the notice.
- The opt-out button switches marketing off and keeps the other categories. It is logged as "Opted out of sale or sharing". Closing the notice is logged as "Closed the notice".
- A browser that sends Global Privacy Control is opted out at once, and the visitor sees a short message that the request was honoured. California asks for that message.
The laws also ask for a link to the opt-out on every page. Add a link to your footer that opens the preferences, as described in the JavaScript API, for example <a href="#cookiemark-preferences">Do Not Sell or Share My Personal Information</a>. You can change the texts of the notice on the Texts tab.
Before you limit the banner, check which laws apply to your visitors. Many countries outside Europe have consent rules of their own. When in doubt, ask everyone.
How the country is found
On the first page of a visit, the script asks Cookiemark which of your lists the visitor's country is on. We read the country from the connection and store nothing about it. The answer is kept in the browser tab's session storage, so the question is asked once per visit, not once per page.
When we cannot tell the country, or the question fails, the visitor gets the banner. Cookiemark always errs on the side of asking.
Visitors outside your countries
- They see no banner, and the scripts of every category you offer run straight away.
- Google Consent Mode applies the denied defaults only in your countries, and Cookiemark grants the signals for this visitor.
- Nothing goes into the consent log, because the visitor made no choice.
- The button to reopen the preferences does not show.
window.Cookiemarkstill answers your code, and the Cookiebot API reports the choice asimplied.
Testing region settings
To see what a visitor elsewhere gets, use a VPN with an address in another country. Open the site in a new private window, because a tab remembers its answer for the rest of the visit.
Global Privacy Control and Do Not Track
Some browsers send a signal that says "do not track me". Global Privacy Control is the current one, and Do Not Track is its older relative. The setting Respect Global Privacy Control on the Regions tab is on for every new site.
For a visitor whose browser sends either signal and who has no stored choice, this happens:
- Cookiemark refuses every optional category on their behalf, and shows no banner.
- The refusal is stored in the consent cookie, and logged with the choice "Privacy signal".
- The button to reopen the preferences shows, so the visitor can still allow cookies if they want to.
A visitor who later allows something keeps that choice, because the signal only counts when there is no stored choice. The signal applies wherever the visitor is. In a country with the opt-out notice it switches off marketing only, as described under The opt-out notice.
California and several other US states expect websites to honour Global Privacy Control. Leave the setting on unless your own legal advice says otherwise.
How long a choice lasts
Under Ask again after you choose how long a choice is remembered: 6, 12 or 13 months. After that the banner shows again. Six months is the default, because the Dutch and French regulators recommend it.
To ask everyone again before that time, use Ask everyone again under Settings and publish. Do that when you add a new kind of tracking. Old choices stay in the log.