Cookie policy and consent, country by country

Where a cookie banner is legally required, what counts as non-essential, what a refusal has to be able to do, and which countries expect consent first.

Updated 2026-09-18 · Written from the same rules terms.gg uses to generate documents

Where consent is required before the cookie is set

In the 31 countries covered by the GDPR and the UK GDPR, read with the ePrivacy rules, anything non-essential needs consent before it runs, not after the page has loaded. Those are: Austria, Belgium, Bulgaria, Croatia, Cyprus, Czechia, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Liechtenstein, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden, the United Kingdom.

Elsewhere the duty is usually disclosure rather than prior consent: say what you collect and why, and offer an opt-out where the law gives one. A banner is still wise if any of your visitors are European, because the rule follows the user, not the company.

What counts as essential

Narrower than most people assume. A session cookie that keeps someone logged in is essential. An analytics cookie that tells you how many people visited is not, however harmless it feels, and neither is anything an advertising SDK writes.

What the policy has to list

• Each cookie or similar identifier, by name.
• What it is for, in a sentence a visitor would understand.
• How long it lives.
• Who sets it, if it is not you.
• How to refuse it, and how to change that decision later.

What a banner has to do where consent applies

• Block non-essential scripts until someone has said yes.
• Give refusing the same prominence as accepting. A greyed-out "manage" link beside a bright "accept all" is the pattern regulators have been fining.
• Let someone change their mind later, from somewhere findable.
• Record what was consented to and when, because the burden of proof is yours.

Who enforces it where you are

The rules are shared; the regulator is not. Each country page names the authority that would hear a complaint about you, and what else that country expects.

Keeping it true after launch

A legal page stops being true the moment the product moves past it, usually by adding a payment provider, an analytics SDK or a sign-in. No store re-checks your pages against your build, so the drift is yours to notice.

• Re-read it whenever you add a dependency that sees user data.
• Re-check what loads on the page after any change: the cookie notice and the policy have to agree.
• Keep the URL stable. Changing where a policy lives breaks every listing that points at it.