France’s CNIL fined two FNAC companies €7 million after product-recommendation tracking continued in their mobile app despite users refusing consent. The decision shows why the purposes and technical behaviour of your recommendation tools matter.

The SECURE Data Act represents an important proposal in the ongoing effort to establish comprehensive federal privacy legislation in the United States. If enacted, the legislation would replace current state privacy laws. Get ready for potential changes.

Here is the final Joomla-ready HTML code, including the separate CookieScript links for GDPR and UK GDPR. All other wording, formatting, links, tables and Joomla module positions are preserved. ```

A/B testing and personalisation tools generally require prior consent in the EU/EEA and UK when they store or access information on a visitor’s device for a non-exempt purpose. Not every experiment or personalisation feature needs cookie-consent opt-in.

Software may already shape who gets a loan, a refund or a place on an interview shortlist. Explaining that process in a Privacy Policy takes more than saying “we use AI”.

The ICO published its final Guidance on the use of storage and access technologies on 29 April 2026, explaining when your website needs consent for cookies and tracking technologies such as tracking pixels, local storage and device fingerprinting. The basic rule hasn’t moved. Under the Privacy and Electronic Communications Regulations (PECR), storing or accessing information on a visitor’s device requires prior consent unless a statutory exception applies.

If you use email tracking pixels in France, CNIL’s 2026 recommendation generally requires consent for campaign analytics, personalisation and profiling. Limited deliverability and authentication-security tracking can be exempt when strictly necessary for a service the recipient expressly requested. 

Chile’s personal data Protection Law 21.719 will take effect on December 1, 2026. Read about website privacy compliance, consent, and tracking requirements to get ready for it.

What is Canada's Bill C-36? Read this blog to learn who must comply with it, the bill's current status, and how to prepare for Bill C-36.

Louisiana’s Data Privacy Act (LDPA) takes effect on January 1, 2027. If the person or entity operating your website does business in Louisiana and meets at least one statutory threshold, you may need to change how your website handles cookies, tracking technologies, targeted advertising, sales of personal data and visitor privacy choices.

California’s Opt Me Out Act adds a new browser-side requirement to California’s existing CCPA opt-out framework. From January 1, 2027, a CCPA-covered business that develops or maintains a browser must provide consumer-configurable functionality that can send an opt-out preference signal to businesses the consumer interacts with through that browser.

The EU Digital Omnibus Cookie Reform: Read about the proposal of the European Commission Digital Omnibus, what Could Change for Cookie Banners, and how to prepare for EU Digital Omnibus Cookie Consent changes.

In 2026, IAB Europe introduced TCF Policy v5.0.b, that present requirements and guidance on multi-device consent, sets rules on how to present Features in CMP interfaces, updates Special Feature 2, and adds a new standardTexts field to the Global Vendor List (GVL).

Vermont has enacted the Vermont Data Privacy and Online Surveillance Act, introducing new privacy requirements for businesses that collect or process data from Vermont residents. The law takes effect on January 1, 2028 and covers areas such as cookies and online tracking, targeted advertising, data sales, sensitive and consumer health data, consent, and consumer opt-out rights.

Oklahoma’s new privacy law, enacted through Senate Bill 546, takes effect on January 1, 2027. Covered businesses should prepare their websites for new rules around targeted advertising, personal-data sales, profiling, sensitive-data consent, privacy notices and consumer opt-outs before the effective date.

What is a Universal opt-out Mechanism, and is it the same as GPC? Read the blog to learn about Universal opt-out Mechanism requirements, Global Privacy Control requirements, and GPC requirements by state.

This guide explains what the Alabama personal data Protection Act (APDPA) is, who must comply with it, consumers’ rights, consent requirements, and how to comply with the APDPA.

The number of tracking pixel lawsuits and session replay lawsuits under CIPA is increasing. Read about the CIPA lawsuit tracker to learn why CIPA lawsuits are increasing and how to reduce your CIPA compliance risk.

Some tracking pixels create far more risk than others. In fact, most risks come from third-party tools that collect personally identifiable or sensitive activities from web pages that have not been subject to a thorough review process.

Health privacy risk does not always start with medical records. For many health-related websites, it can begin when a visitor opens a page, uses a symptom tool, books an appointment, or interacts with a chat widget.

What does consent mean in VR and AR environments, and how to obtain one? How does CCPA/GDPR apply to VR and AR platforms? Read this blog to learn how to give consent in immersive spaces without screens or banners.

The new Kids Online Safety Act (KOSA) enhances protection for minors online and sets requirements for platforms and apps, introducing the Duty of Care principle. Read about the differences between age gating and age assurance.

What is the FTC's new “Click-to-Cancel” rule? How does the Federal Trade Commission regulate subscriptions and cookie banners? What counts as a dark pattern in cookie banners in 2026?

Does the United Arab Emirates have a data protection law? Read this guide to understand the UAE PDPL legal basis, consent requirements, and obligations of data controllers and processors to comply with the law.

What is Mexico Data Privacy Law LFPDPPP and how to comply with it? Read this comprehensive compliance guide for businesses to reach compliance in 2026.

What is the legal difference between Global Privacy Control (GPC) and Do Not Track? Do Websites still need to support Do Not Track? Let’s delve deeper into the signals for user privacy choices and learn which one you should use.

The full application date of the Act is August 2, 2026. What are the requirements of the EU AI Act, and how should websites get ready for it? Read the EU AI Act checklist for websites and get ready now.

Healthcare in 2026 is almost fully digital—EHRs, telehealth platforms, patient portals, mobile apps, and AI-assisted tools are now baked into everyday care, which means PHI security is officially core clinical infrastructure, not a legal side-quest.

What is the CAN-SPAM Act? Is it still in effect? Does it apply to B2B emails? Read more about the CAN-SPAM Act and its standards for sending commercial electronic mail in the U.S.

Privacy rules in the U.S. just keep multiplying, and 2026 adds a few more to the list. Kentucky, Rhode Island, and Indiana all have their own consumer-data laws kicking in on January 1, 2026, which might feel like a small thing at first, but it does change the picture for any business working across different states.

Does Nigeria have a data protection law? Read this guide to understand the NDPA legal basis, consent requirements, and ensure compliance with the law.

On July 24, 2025, Algeria officially enacted Law No. 25-11, supplementing its previous data privacy law. Read about key principles of Algeria’s data protection framework and practical steps to achieve compliance with Algeria’s Data Protection Law 18-07.

Texas’s New Child-Safety Bill (SB 2420) will come into effect on January 1, 2026. Read more about who SB 2420 applies to, what are the main requirements of SB 2420, and how to stay compliant with Texas’s new child-safety law.

What is Uruguay’s personal data Protection Law (PDPL) and what are the requirements for compliance. Read this comprehensive guide on the PDPL to find best practices for businesses operating in Uruguay to comply with the law.

The Minnesota Consumer Data Privacy Act (MCDPA) took effect on July 31, 2025, establishing new data privacy standards for Minnesota citizens. Let’s delve deeper into the MCDPA requirements for businesses, rights for individuals, enforcement of the MCDPA, and penalties for non-compliance.

What is Israel's Privacy Protection Law (PPL), and how to comply with it? Read this blog to find out key principles, obligations for businesses, and key differences between Israel’s PPL vs. Europe’s GDPR.

Do small businesses have to worry about compliance with US state-level data privacy laws? What state privacy laws are coming into effect in 2025 and 2026? Let’s read this guide for practical steps to stay compliant with US data privacy regulations.

Which countries are covered by GDPR? What are GDPR adequacy countries? Is GDPR only valid in Europe? Is the United Kingdom a GDPR country? Read this comprehensive guide to find answers to these questions.

What is Japan’s data privacy law APPI and what is its key principles? Who must comply with the APPI and how to comply with it?

Privacy rules in Latin America are shifting fast. Argentina, Colombia, and Mexico are each tightening how consent, cookies, and tracking are handled — sometimes borrowing straight from the GDPR playbook, sometimes adding their own twists.

How do Asia-Pacific data privacy laws differ from Europe’s GDPR? Read more about Consent frameworks in Japan (APPI), South Korea (PIPA), and Singapore (PDPA) to know better about Asia-Pacific nuances.

Canada’s plan to modernize privacy law fell apart in January 2025. Bill C-27, the package that carried the Consumer Privacy Protection Act (CPPA) and the Artificial Intelligence and Data Act (AIDA), died when Parliament was prorogued. That left PIPEDA still running the show—and businesses scrambling with provincial rules and no clear word on what Ottawa will do next.

Think of the DSA as the EU’s new playbook for online platforms: no more hidden ads, no vague rules, and no secret algorithms. It’s about giving users clarity and holding companies to account.

The EU Data Act will become applicable in September 2025. This legislative framework sets rules on data access, sharing, and use across various sectors. Read this blog to understand its implications and the expected changes in the data management.

What is Vietnam’s personal data Protection Law (PDPL) and how to comply with it? Read this blog to find out key principles, obligations for businesses, security measures, and compliance steps under the PDPL.

The GDPR and China’s PIPL both aim to protect personal data, but they approach compliance in different ways. From consent standards to how cross-border transfers are handled, the contrasts matter—especially for global businesses.

New federal rules from the U.S. Department of Justice (DOJ) are changing how websites handle sensitive user data across borders. If your site relies on analytics, ad tech, or other third-party tools, this matters more than you might think.

Read about China's Personal Information Protection Law, the obligations it imposes on businesses, and the rights of Chinese citizens in protecting their Personal Information.

California Invasion of Privacy Act (CIPA) wasn’t on most companies’ radar — until recently. Now, it’s at the center of a wave of lawsuits catching digital teams off guard.

The Nebraska Data Privacy Act took effect on January 1, 2025. Read this blog to learn who it applies to and how to comply with the law.

In 2025, the California Privacy Rights Act (CPRA) is increasing the pressure on businesses to be more mindful of user data—especially regarding cookies and trackers. It's no longer enough to have a banner; if your site collects more data than it needs or holds onto it for too long, you're taking a risk.

What is the German Accessibility Improvement Act (BFSG), who has to comply with the BFSG, and how to comply with it? Read to find out.

What is India's Digital personal data Protection Act (DPDPA) and how to comply with it? What are the diffferences between DPDPA and the EU's GDPR? Learn what this law means for businesses and Indian individuals.

What is the Argentina‘s personal data Protection Law (PDPL)? Who does Argentina’s PDPL apply to, and how to comply with the law? Read this blog article to find out.

Learn about the New Zealand Privacy Act 2020 and its compliance requirements, 13 Privacy Principles, and how to protect Personal Information.

The Consent Management Ordinance should come into force on April 1, 2025. Its aim is to limit the use of cookie banners, but experts already expect it to fail. Read this article to learn why.

What is Singapore’s personal data Protection Act (PDPA), who does it apply to, and how to comply with the PDPA? Read this article to find out.

The Maryland Online Data Privacy Act comes into effect on October 1, 2025. Read this blog to learn how to comply with the MODPA and get ready for the law now!

The New Jersey Data Privacy Act comes into effect on January 16, 2025. Read this blog to learn if it applies to your business and how to comply with it.

Oregon Consumer Privacy Act, or Senate Bill 619, came into effect on July 1, 2024. Read what rights it provides for consumers and what duties it imposes upon businesses. 

The New Hampshire Data Privacy Law takes effect on January 1, 2025. Learn more about the law and how to prepare for it.

Read the top 10 data privacy trends and tendencies you need to understand in data privacy in 2025. Get ready now to navigate compliance and seize new strategic opportunities.

Montana Consumer Data Privacy Act became effective on October 1, 2024. Read this blog article to learn if it applies to your business and how to comply with it.

The Delaware personal data Privacy Act (DPDPA) is a data privacy law which was signed into law and comes into effect on January 1, 2025. Find out the details.

The EU proposed a new Financial Data Access framework, that is opening up data across financial services. Read more to prepare for it.

Iowa Consumer Data Protection Act will take effect on January 1, 2025. Get ready for it now.

Florida Digital Bill of Rights (FDBR) became effective on July 1, 2024. Read this blog article to learn if it applies to your business and how to comply with it.

The Artificial Intelligence Act (AI Act) is a new EU law regulating the usage of AI. The AI Act will go into effect on 1 August 2024. Read more to get ready for it!

The Texas Data Privacy and Security Act (TDPSA) was signed in 2023 and comes into effect on July 1, 2024. Read the blog to get ready for it.

Tennessee Information Protection Act (TIPA) was signed into law on May 11, 2023, and will take force on July 1, 2025. Read this blog to get ready for it!

From generative AI impact on everyday businesses and privacy-enhancing computation techniques to automotive industry privacy restart: what data privacy trends are going to be in 2024? Read this blog to find out.

The Digital Markets Act (DMA) is an important data privacy law regulating the operations of digital platforms in the EU. Read the blog to find out more details.

If ChatGPT can perform various tasks, including writing texts, can it write your website’s Privacy Policy too? Read this article to find out the ability of AI to write a Privacy Policy for a website and evaluate the quality of such a Privacy Policy.

In Germany, besides the GDPR, Cookie Consent is regulated by TTDSG and DSK guidelines. In this article, we will explore the Cookie Consent requirements and how to ensure compliance with German privacy laws.

The majority of gaming publishers still do not comply with the privacy laws. However, the situation is rapidly changing due to users concerned about their data privacy and new requirements of publishing platforms.

Article 25 of the GDPR requires the Privacy by Design approach to data protection. Read the article to find out what Privacy by Design means, why it is important for the GDPR, and how to implement it.

In South Korea, the Personal Information Protection Act (PIPA) came into effect in 2011 and underwent an amendment on September 15, 2023. Read more about what are the key principles and what are business obligations.

On 10 July 2023, the European Commission adopted its decision on the revised EU – US Data Privacy Framework, which entered into force immediately. Read about its impact on companies.

On September 22, 2022, the first phase of Quebec’s Privacy Law 25 came into effect. Additional requirements will come into effect in 2023 and then in 2024. Find out more.

In September 2023, a new data privacy law in Switzerland will take effect. Switzerland’s Federal Act on Data Protection (FADP) will go into force, replacing the outdated 1992 Act.

If your business is registered in Australia or you have customers in Australia, you must comply with Australia's Privacy Act of 1988. Read the article about it.

What is data privacy management? Read this article to learn more about why to implement a data privacy management system and how to do it correctly.

Does your iOS app need a Privacy Policy? What are Apple's Privacy Policy requirements for iOS apps? How to create a Privacy Policy for your iOS App? Read this blog to find out the answers.

This proliferation of apps has raised privacy concerns about users’ personal data. Governments around the world have implemented privacy laws. In this article, we will cover the privacy laws and legal requirements for apps.

The United States doesn’t have a single comprehensive federal law that covers the privacy of all types of data. Different US states have privacy laws in different legislative stages. Find out more.

The “Do Not Sell My Personal Information” page is one of CCPA’s principal requirements. Read the guide on when to use it, where to place it, and how to use it correctly.

Utah Consumer Privacy Act was passed and will go into effect on December 31, 2023. It is considered the most business-friendly data privacy act in the US.

Connecticut’s new data privacy law will go into effect on July 1, 2023.  Read more about it and the privacy law requirements.

Saudi Arabia's personal data Protection Law will go into effect on March 17, 2023. Learn more about it and how to prepare for your website's cookie compliance.

The GDPR in the EU, the CCPA in the US, and other privacy laws regulate how website owners must obtain and store Cookie Consent from website users. Read more about cookie control and how to manage cookies.

legitimate interest s a legal basis for processing personal data under the GDPR. However, it could be a confusing concept, and website owners are often unsure how to implement it correctly.

New Data Privacy Regulations are evolving, companies are investing heavily in privacy technologies, and users are becoming more aware of their rights regarding personal data... Find out the top data privacy trends in 2023.

The UK Data Protection Act 2018 is the UK’s implementation of the EU General Data Protection Regulation. Read this DPA 2018 checklist to comply with the law.

After Brexit, the Data Protection Act 2018 is the UK’s implementation of the GDPR. Find out more about the DPA 2018 and how it’s different from the EU GDPR.

On 27 September 2022, Michigan Senators introduced Senate Bill 1182, which would create the Michigan personal data Privacy Act. Read more about it.

On July 20, 2022, Google introduced new requirements for Google Play Store apps concerning Privacy Policy and disclosure. Find out more.

On July 14, 2022, the Danish DPA imposed a ban on the use of Google Workspace in Helsingør municipality in Denmark. This is the first time when such a decision regarding the Google Workspace for Education compliance with the GDPR was issued.

The Digital Services Act (DSA) will take effect starting 1 January 2024, and will try to limit the spread of illegal content online. It is expected that the DSA will set new rules for a more safe online environment, especially Big Tech.

Denmark’s DPA Datatilsynet announced that Google Analytics is not compliant with the EU General Data Protection Regulation due to the data transfer between the EU and the USA. Read more about it.

The Privacy and Electronic Communications Regulations (PECR) is a law in the United Kingdom, which sits alongside the Data Protection Act and the UK GDPR and provides people privacy rights in relation to electronic communications.

Colorado is the third US state to pass consumers’ privacy legislation. The Colorado Privacy Act was signed into law on July 8th, 2021, and will go into effect on July 1, 2023. Read more details to prepare for compliance.

The California Consumer Privacy Act (CCPA) went into effect on January 1, 2020. The California Privacy Rights Act (CPRA), which amends the CCPA and includes additional privacy protections for consumers, will take effect on January 1, 2023, and applies to information collected on or after January 1, 2022.

Almost all websites use cookies to store information in website users' browsers. As cookies collect such personal data and people are concerned about their privacy, the use of cookies on a website is strictly regulated in the EU and other countries. Read more to know about cookie law compliance.

The EU – US Privacy Shield Framework was a legal framework for regulating personal data transfer between the Eu and the US to comply with data protection requirements. However, the European Court of Justice announced that the EU – US Privacy Shield became invalid on 16 July 2020.

The Virginia Consumer Data Protection Act (VCDPA) was signed on March 2, 2021, making Virginia the second state after California to officially instrument comprehensive consumer privacy legislation. The VCDPA will go into effect on January 1, 2023.

Google services, such as AdSense, Firebase, and Analytics, could be integrated into your website for analytical, advertising, or marketing purposes, but you must comply with Google EU consent policy if you want to use these services. In this article, we will look at how to comply with privacy laws.

2022 brings changes to the cookie guidelines in Italy. Approved in July 2021, the new cookie guidelines have been introduced on January 9, 2022. Published by the Italian Supervisory Authority, the new set of rules will make a big impact on cookies in Italy.

With data protection rules constantly changing and being updated, it’s important to keep a finger on the pulse. Here are the most notable updates and news stories on data protection from around the world.

The UK’s Information Commissioner’s Office (ICO) upholds data and information rights for the public within the United Kingdom. The ICO’s role is to both promote openness within the public bodies and to uphold data privacy for individuals.

Nevada’s privacy law, Senate Bill 220, went into effect in October of 2019 and protects the internet privacy rights of the citizens of the state. Any organization that processes data related to the state’s citizens needs to follow the guidelines set forth by the legislation.

The French Data Protection Authority (the CNIL) published an updated version of their cookie guidelines in the fall of 2020. The document covered recommendations for obtaining user consent to store or read non-essential cookies and similar technologies on their devices.

In 2019, the Data Protection Commission (DPC) of Ireland collected information from a swath of popular websites to document their use and deployment of cookies and tracking tools. Their goal was to determine whether or not the organizations were in compliance with existing cookie and tracking tool guidelines.

First passed in 2019, Thailand’s personal data Protection Act (PDPA) will finally come into full effect on June 1st, 2022. The PDPA is structured entirely around the idea of end-user consent, which means that websites must obtain express and explicit consent from their users before cookies or tracking tools can be activated. 

The South African population recently gained rights over their Personal Information. Enforcement of South Africa’s Protection of Personal Information Act (POPIA) began on July 1, 2021, and the law was modeled closely after the European Union’s GDPR. It’s been a long-time coming, as variations of this law have been in the works for almost 20 years.

CookieScript is a registered Consent Management Platform at IAB. We offer full integration with the latest version of IAB Transparency and Consent Framework (TCF) 2.3. 

The Turkish personal data Protection Law No. 6698, also known as the KVKK, came into effect in April 2016, shortly before the European Union’s GDPR. Both laws were tailored to their region’s court systems and maintain similar objectives.

First enacted in 2001, the Personal Information Protection and Electronic Documents Act (PIPEDA) served as an important first step in safeguarding the privacy rights of Canadians. Two decades on, this cornerstone legislation is now seen as having ”more bark than bite.” That may all change in 2021.

Now that Britain has exited the European Union, website owners are wondering how Brexit will affect the way they handle cookie consents from website visitors in the EU and UK.

Following a series of delays, Brazil's LGPD is now in effect. President Jair Bolsonaro issued a provisional measure that would have postponed the effective date of the LGPD until May 3, 2021. In an unexpected move, the Senate rejected the president’s provisional measure. 

While Europe's replacement for 2002's “Cookie Directive” has yet to pass through the European Parliament, it’s only a matter of time before the ePR (eprivacy Regulation) becomes law. So, what does this legislation and Cookie Consent mean for your business? 

Starting January 1st, 2020, businesses transacting with California residents need to ensure their data collection practices comply with the California Consumer Privacy Act (CCPA). CookieScript has put together this helpful guide that will answer everything you need to know about the CCPA, CCPA meaning, and how it will impact your business.

In Europe, years of preparation and speculation came to a head, when the General Data Protection Regulation (GDPR) became law in May of 2018. It’s now been on the books for a few years. GDPR replaced outdated data protection regulation that was nearly 20 years old. 

On the 3rd of June 2014, Italian Data Protection Authority (DPA) has published official instructions for websites on how users should be informed about cookie usage. In this article, you will find a summary of those instructions and a checklist to make sure your website is compliant with Italian cookie law.