Data Protection Monitor · Cross-Jurisdiction Domain Hub
AdTech & commercial privacy
Jurisdiction Readings (167 markets)
6 Confirmed
76 Probable
85 Uncertain
| Jurisdiction | Region | Status | Regulatory Summary | Actions |
|---|---|---|---|---|
| African bloc (AFR) | Africa | Red | No continental-level cookie/tracker consent regime, dark-pattern prohibition, opt-out-signal standard, clean-room rule, cross-context advertising rule, or direct-marketing consent standard was found… | Profile →Brief |
| Alabama, USA (US-AL) | Americas | Amber | Commercial/adtech-specific privacy rules in Alabama are emergent and largely tied to the not-yet-effective PDPA and several 2026 bills of uncertain enactment status: House Bill 283 (dark patterns /… | Profile →Brief |
| Alaska, USA (US-AK) | Americas | Red | Alaska has no cookie/tracker consent statute, no dark-patterns prohibition, no opt-out-signal mandate (e.g., GPC recognition), no clean-room regulation, and no CPRA-style 'sale'/'share' restriction… | Profile →Brief |
| Alberta, Canada (CA-AB) | Americas | Red | No Alberta-specific statutory regime for cookies/trackers, dark patterns, opt-out signals, clean rooms, cross-context advertising, or direct marketing was identified in the sources reviewed this run… | Profile →Brief |
| Algeria (DZ) | Africa | Red | No evidence was located of an Algeria-specific cookie/tracker consent regime, dark-pattern prohibition, opt-out-signal recognition, clean-room framework, cross-context-advertising rule, or… | Profile →Brief |
| Antigua and Barbuda (AG) | Caribbean | Red | No source located on cookie/tracker rules, dark-pattern prohibitions, opt-out signals, clean-room rules, cross-context advertising, or direct-marketing consent/suppression rules for Antigua and… | Profile →Brief |
| Argentina (AR) | Americas | Red | Direct marketing is the only well-substantiated sub-module: the Do-Not-Call Registry (Ley 26.951) plus AAIP enforcement (fines against FCA Automobiles Argentina and Telefónica Móviles Argentina for… | Profile →Brief |
| Arizona, USA (US-AZ) | Americas | Amber | Arizona has no cookie-consent or 'sale'/'share' opt-out statute comparable to CPRA. The principal lever against commercial ad-tech data practices is the Arizona Consumer Fraud Act, used by the AG to… | Profile →Brief |
| Arkansas, USA (US-AR) | Americas | Red | Arkansas has no general cookie/tracker consent law, dark-pattern prohibition, opt-out-signal mandate, or clean-room regulation. The main commercial-privacy overlays are minors-specific: HB1717 bans… | Profile →Brief |
| Asia-Pacific bloc (APAC) | Asia-Pacific | Red | No bloc-level cookie/tracker consent regime, dark-pattern prohibition, opt-out signal standard, clean-room rule, cross-context advertising rule, or direct-marketing rule exists under either the… | Profile →Brief |
| Australia (AU) | Asia-Pacific | Amber | Australia lacks a dedicated ePrivacy/cookie-consent statute or CPRA-style 'sale'/'share' construct; commercial privacy protection instead flows from general APP obligations (notably APP 7… | Profile →Brief |
| Austria (AT) | Europe | Amber | Austria's cookie/tracker and direct-marketing consent regime derives from the ePrivacy Directive as implemented via TKG 2021, layered with GDPR consent standards; US-style constructs (Global Privacy… | Profile →Brief |
| Bangladesh (BD) | Asia-Pacific | Red | No cookie/tracker consent regime, dark-pattern prohibition, opt-out-signal recognition, clean-room rule, cross-context-advertising provision, or direct-marketing consent/suppression rule could be… | Profile →Brief |
| Belgium (BE) | Europe | Green | The Belgian DPA is one of the most active EU regulators in adtech enforcement, having fined IAB Europe over its Transparency and Consent Framework, sanctioned dark-pattern-style loyalty programmes… | Profile →Brief |
| Belize (BZ) | Americas | Red | No sourced cookie/tracker consent regime, dark-pattern prohibition, opt-out-signal recognition, clean-room rule, or direct-marketing consent/suppression provision specific to Belize was located. | Profile →Brief |
| Brazil (BR) | Americas | Amber | Commercial/adtech-specific DP rules in Brazil remain comparatively underdeveloped relative to cookie/consent regimes seen in the EU or certain US states. The clearest enforcement data point is ANPD's… | Profile →Brief |
| British Columbia, Canada (CA-BC) | Americas | Red | PIPA applies general consent and purpose-limitation principles to cookie/tracker use, direct marketing, and cross-context data use, but BC has no dedicated cookie-consent statute, no codified… | Profile →Brief |
| Bulgaria (BG) | Europe | Amber | Cookie/tracker consent in Bulgaria relies on the Electronic Communications Act implementing the EU ePrivacy Directive alongside GDPR consent standards. No Bulgaria-specific rules on dark patterns… | Profile →Brief |
| Cambodia (KH) | Asia-Pacific | Red | No Cambodia-specific cookie/tracker consent regime, dark-pattern prohibition, opt-out-signal recognition, clean-room rules, cross-context advertising rules, or direct-marketing consent/suppression… | Profile →Brief |
| Cameroon (CM) | Africa | Red | No confirmed cookie/tracker consent regime, dark-pattern prohibitions, opt-out signal recognition, clean-room rules, cross-context advertising rules, or direct-marketing suppression regime specific… | Profile →Brief |
| Canada — Kahnawake (CA-KAH) | Americas | Amber | Canada has no dedicated ePrivacy-style statutory cookie-consent regime; OPC guidance applies PIPEDA's general meaningful-consent principle to online tracking, profiling and in-game data collection.… | Profile →Brief |
| Canada — Tobique First Nation (CA-TFN) | Americas | Red | PIPEDA has no dedicated cookie-consent or ePrivacy-style tracker regime; the OPC instead applies its general meaningful-consent framework to online behavioural advertising, acknowledging that valid… | Profile →Brief |
| Chile (CL) | Americas | Red | No dedicated cookie/adtech-consent statute, dark-pattern prohibition, recognized opt-out signal (e.g., GPC/DAA equivalent), or clean-room/data-collaboration rule was identified for Chile in sources… | Profile →Brief |
| China (CN) | Asia-Pacific | Amber | China lacks a discrete ePrivacy-style cookie-consent statute; commercial-privacy governance instead runs through PIPL's ADM/marketing rule (Art 24) and the CAC's 2022 Provisions on Algorithmic… | Profile →Brief |
| Colombia (CO) | Americas | Amber | Direct-marketing consent enforcement is confirmed via SIC's largest-to-date fine against Comcel for collecting personal data without informed consent during a marketing campaign. No… | Profile →Brief |
| Colorado, USA (US-CO) | Americas | Green | Colorado requires recognition of a universal opt-out mechanism (UOOM) for targeted-advertising and sale opt-outs since July 1, 2024, and currently recognizes the Global Privacy Control (GPC) as the… | Profile →Brief |
| Comoros (KM) | Africa | Red | No cookie/tracker consent regime, dark-pattern prohibition, opt-out-signal framework, clean-room rule, or direct-marketing consent regime was located for the Union of the Comoros. | Profile →Brief |
| Comoros — Anjouan (KM-A) | Africa | Red | No ePrivacy-style cookie/tracker consent regime, dark-pattern prohibition, opt-out-signal framework, clean-room rule, or direct-marketing consent statute specific to Comoros could be identified. | Profile →Brief |
| Comoros — Mohéli (KM-M) | Africa | Red | No cookie/tracker consent statute, dark-pattern prohibition, opt-out-signal recognition, clean-room rule, or direct-marketing consent regime exists in Comorian law. | Profile →Brief |
| Connecticut, USA (US-CT) | Americas | Green | CTDPA requires an easily accessible opt-out link for targeted advertising/sale on websites and apps, and since January 1, 2025 requires controllers to honor universal opt-out preference signals… | Profile →Brief |
| Costa Rica (CR) | Americas | Red | No dedicated adtech-specific instrument (cookie-consent statute, dark-pattern prohibition, Global-Privacy-Control-equivalent opt-out signal regime, clean-room rules, or CPRA-style 'sale/share'… | Profile →Brief |
| Croatia (HR) | Europe | Amber | Cookie/tracker and direct-marketing rules derive from the ePrivacy Directive as transposed via the Electronic Communications Act, layered on GDPR consent standards, pending the still-stalled EU… | Profile →Brief |
| Curaçao (CW) | Caribbean | Red | No Curaçao-specific cookie/tracker consent regime, dark-pattern prohibition, opt-out-signal recognition, clean-room rules, cross-context-advertising rules, or direct-marketing consent/suppression… | Profile →Brief |
| Cyprus (CY) | Europe | Amber | Cookie and tracker consent follows the ePrivacy Directive as transposed via Law 112(I)/2004, enforced by the Commissioner alongside GDPR. The Commissioner conducted a cookie compliance audit and… | Profile →Brief |
| Czech Republic (CZ) | Europe | Amber | Cookie/tracker consent is governed by the amended Electronic Communications Act requiring opt-in consent. Direct marketing is governed by Act No. 480/2004 Coll. on Certain Information Society… | Profile →Brief |
| Delaware, USA (US-DE) | Americas | Amber | Consumers may opt out of the sale of personal data and processing for targeted advertising and profiling. Universal opt-out mechanisms (GPC-style signals) became mandatory for controllers to… | Profile →Brief |
| Denmark (DK) | Europe | Amber | Denmark's cookie/tracker regime relies on GDPR-standard opt-in consent as articulated in Datatilsynet's website-visitor-data guidelines, and direct marketing is governed by an opt-out-register… | Profile →Brief |
| District of Columbia, USA (US-DC) | Americas | Red | The District has no cookie-consent law, dark-pattern prohibition, opt-out-signal mandate, clean-room regulation, cross-context-advertising 'sale/share' regime, or direct-marketing consent statute.… | Profile →Brief |
| Dominican Republic (DO) | Americas | Red | No ePrivacy-style cookie/tracker consent statute, dark-pattern prohibition, recognized opt-out signal framework, clean-room regime, or cross-context-advertising rule was identified for the Dominican… | Profile →Brief |
| Ecuador (EC) | Americas | Amber | EUIs are public-sector controllers, not commercial adtech operators, so several sub-modules (dark patterns, clean rooms/DCR, direct marketing) have no dedicated EUDPR content; however, EUI… | Profile →Brief |
| Egypt (EG) | Africa | Amber | Electronic direct marketing is licensable activity under the Executive Regulations. No Egypt-specific cookie/tracker consent regime, dark-pattern prohibition, opt-out-signal (GPC/DAA) recognition… | Profile →Brief |
| Estonia (EE) | Europe | Amber | Cookie/tracker consent in Estonia follows the ePrivacy Directive's Art 5(3) prior-consent rule as elaborated by EDPB Guidelines 2/2023, applied directly as EU law; CPRA-style constructs (opt-out… | Profile →Brief |
| European Economic Area Expert reviewed (EEA) | Europe | Amber | Cookie/tracker consent is governed by the ePrivacy Directive read with GDPR consent standards; 2026 developments centre on the contested Digital Omnibus Article 88b automated-consent-signal mechanism… | Profile →Brief |
| Finland (FI) | Europe | Amber | Finland's cookie/tracker regime derives from the EU ePrivacy Directive as transposed nationally, operating alongside GDPR consent standards; the Ombudsman has refreshed direct-marketing FAQ guidance… | Profile →Brief |
| Florida, USA (US-FL) | Americas | Amber | FDBR provides an opt-out right for targeted advertising (broadly defined to include affiliated-website tracking) and references 'dark patterns' as a defined term, but excludes… | Profile →Brief |
| France (FR) | Europe | Amber | CNIL's cookie/tracker regime (2020 guidelines and recommendation, consolidated January 2026, plus 2026 multi-device recommendations) is the dominant adtech-privacy instrument, alongside enforcement… | Profile →Brief |
| Georgia, USA (US-GA) | Americas | Red | Georgia has no cookie/tracker-consent statute, no dark-patterns prohibition specific to privacy, no universal opt-out-signal recognition, and no clean-room or cross-context-advertising… | Profile →Brief |
| Germany (DE) | Europe | Amber | TTDSG §25 supplies Germany's core cookie/tracker consent rule, requiring consent for any storage of or access to information on end-user terminal equipment regardless of whether personal data… | Profile →Brief |
| Ghana (GH) | Africa | Red | The Data Protection Act contains a general prohibition on selling personal data and a right to object to direct marketing, but no cookie/tracker-specific consent regime, dark-pattern prohibition… | Profile →Brief |
| Gibraltar Expert reviewed (GI) | Europe | Amber | Direct-marketing consent requirements under the Communications (Personal Data and Privacy) Regulations 2006 are confirmed for SMS/MMS marketing. No Gibraltar-specific cookie-consent enforcement… | Profile →Brief |
| Greece (GR) | Europe | Amber | Law 3471/2006 and HDPA guidance govern cookies/trackers and direct marketing; the old opt-out mail-marketing register was repealed in favour of GDPR/ePrivacy-based consent rules. No Greece-specific… | Profile →Brief |
| Guernsey (GG) | Europe | Amber | No dedicated cookie/ePrivacy-equivalent statutory provision was located for Guernsey. ODPA has, however, been operationally active on dark-pattern enforcement via the Global Privacy Enforcement… | Profile →Brief |
| Guernsey — Alderney (GG-ALD) | Europe | Amber | The clearest Alderney-specific finding in this module is ODPA's September 2024 outreach to Alderney gambling-sector companies regarding the use of dark patterns, following the 2024 Global Privacy… | Profile →Brief |
| Hawaii, USA (US-HI) | Americas | Red | Hawaii has no in-force cookie/tracker consent law, dark-pattern prohibition, opt-out-signal recognition, clean-room regime, cross-context-advertising ('sale'/'share') definition, or direct-marketing… | Profile →Brief |
| Hong Kong (HK) | Asia-Pacific | Amber | Direct marketing is the best-developed strand of PDPO's commercial-privacy regime (Part VIA), with binding consent/opt-out duties and criminal penalties, plus PCPD guidance against 'bundled consent'… | Profile →Brief |
| Hungary (HU) | Europe | Red | Direct-marketing enforcement carve-outs to NMHH under Act CVIII of 2001 are confirmed. Cookie/tracker consent, dark-pattern prohibitions, opt-out signals, clean-room rules and cross-context… | Profile →Brief |
| Iceland (IS) | Europe | Red | General GDPR consent and objection standards apply to cookies, direct marketing, and commercial profiling in Iceland via Act No. 90/2018, but no Iceland-specific enforcement decisions on… | Profile →Brief |
| Idaho, USA (US-ID) | Americas | Red | Idaho has no cookie/tracker consent statute, no dark-pattern prohibition, no opt-out-signal recognition law, no clean-room regime, and no CPRA-style 'sale'/'share' framework for cross-context… | Profile →Brief |
| Illinois, USA (US-IL) | Americas | Red | Illinois has no cookie-consent law, dark-pattern prohibition, recognized opt-out signal, or clean-room rule. Senate Bill 340, still moving through the legislature as of mid-2026, would introduce… | Profile →Brief |
| India (IN) | Asia-Pacific | Amber | DPDPA does not contain a GDPR-ePrivacy-style dedicated cookie/tracker consent regime. The clearest adtech-relevant provision is the children's-data ban on tracking, behavioral monitoring and targeted… | Profile →Brief |
| Indiana, USA (US-IN) | Americas | Amber | Controllers must disclose and provide opt-outs for targeted advertising and sale of personal data, but the Act does not require recognition of universal opt-out signals (e.g., Global Privacy… | Profile →Brief |
| Iowa, USA (US-IA) | Americas | Amber | The ICDPA regulates commercial/adtech data use narrowly: it mandates disclosure of targeted-advertising activity and opt-out mechanics and grants an opt-out-of-sale right, but does not require… | Profile →Brief |
| Ireland (IE) | Europe | Amber | Cookie and tracker consent is governed by S.I. No. 336/2011, with the DPC actively enforcing direct-marketing rules (2024 SMS-marketing prosecutions) and behavioural-advertising legal-basis… | Profile →Brief |
| Isle of Man (IM) | Europe | Red | The Isle of Man Information Commissioner's remit over the 'Unsolicited Communications Regulations' indicates an operative direct-marketing/ePrivacy-equivalent regime, but detailed cookie-consent… | Profile →Brief |
| Italy (IT) | Europe | Amber | Italy's cookie/tracker regime rests on the Garante's 2021 Linee Guida (Art.122 Codice + Arts.4(11),7,12,13,25 GDPR): default no non-technical cookies on first access, prohibition of cookie walls… | Profile →Brief |
| Ivory Coast (CI) | Africa | Red | No CI-specific evidence was found on cookie/tracker consent regimes, dark-pattern prohibitions, opt-out signal recognition, clean-room rules, cross-context advertising, or direct-marketing… | Profile →Brief |
| Japan (JP) | Asia-Pacific | Amber | Cookie-derived browsing/behavioural data is regulated indirectly through APPI's 'individual related information' provision rule: a provider must confirm the recipient has obtained consent where the… | Profile →Brief |
| Jersey (JE) | Europe | Red | No Jersey-specific cookie/ePrivacy transposition, direct-marketing consent rule, dark-pattern prohibition, opt-out-signal regime, clean-room rule, or cross-context-advertising rule was located. The… | Profile →Brief |
| Kansas, USA (US-KS) | Americas | Red | Kansas has no cookie/tracker consent regime, no dark-pattern prohibition, no state-mandated recognition of opt-out signals (e.g., GPC), no clean-room/data-collaboration rules, and no… | Profile →Brief |
| Kazakhstan (KZ) | Asia-Pacific | Red | No confirmed cookie/tracker consent regime, dark-pattern prohibition, opt-out-signal recognition, clean-room framework, cross-context-advertising rule, or direct-marketing consent/suppression regime… | Profile →Brief |
| Kentucky, USA (US-KY) | Americas | Amber | The KCDPA's primary adtech-relevant lever is the opt-out right for targeted advertising and sale of personal data, paired with privacy-notice disclosure duties. Dark-patterns prohibition and… | Profile →Brief |
| Kenya (KE) | Africa | Amber | The General Regulations 2021 create a direct-marketing consent/opt-out regime: commercial use of data (including direct marketing) requires either that the data subject was informed at collection… | Profile →Brief |
| Laos (LA) | Asia-Pacific | Red | No cookie/tracker consent regime, dark-pattern prohibition, recognised opt-out signal (GPC/DAA-equivalent), clean-room rule, cross-context-advertising rule, or direct-marketing consent/suppression… | Profile →Brief |
| Latin America bloc (LATAM) | Americas | Red | General cookie/tracker consent regimes, dark-pattern prohibitions, opt-out signals, clean-room rules, cross-context advertising and direct-marketing suppression were not evidenced at bloc level. The… | Profile →Brief |
| Latvia (LV) | Europe | Amber | DVI has actively enforced cookie-consent standards, conducting a 2021-2022 preventive audit of 29 websites belonging to 26 large e-merchants that found none obtained appropriate consent, with three… | Profile →Brief |
| Liechtenstein (LI) | Europe | Amber | Cookie/tracker consent follows the ePrivacy/GDPR baseline as applied by the DSS, which has issued updated cookie guidance. Dark-pattern prohibitions, opt-out signals (e.g., GPC), clean-room… | Profile →Brief |
| Lithuania (LT) | Europe | Amber | Cookie consent and direct-marketing rules follow GDPR/ePrivacy transposition. VDAI's Vinted enforcement establishes a precedent against non-transparent 'shadow blocking' practices analogous to dark… | Profile →Brief |
| Louisiana, USA (US-LA) | Americas | Amber | The LDPA (effective 2027-01-01) includes universal opt-out mechanism support and opt-out rights for targeted advertising and sale of personal data: <cite index="21-4,21-5">The bill, approved 94-0 by… | Profile →Brief |
| Luxembourg (LU) | Europe | Amber | CNPD's dedicated cookie guidelines address both consent architecture and dark patterns in banners; the Amazon decision independently evidences enforcement against cross-context/targeted-advertising… | Profile →Brief |
| Maine, USA (US-ME) | Americas | Red | Maine has no general cookie/tracker consent law, dark-pattern prohibition, opt-out-signal recognition mandate, clean-room regulation, or cross-context-advertising ('sale'/'share') regime. The only… | Profile →Brief |
| Malaysia (MY) | Asia-Pacific | Red | No Malaysia-specific cookie/tracker consent regime, dark-pattern prohibition, opt-out-signal (GPC/DAA) recognition, clean-room rule, cross-context-advertising rule, or direct-marketing/Do-Not-Call… | Profile →Brief |
| Malta (MT) | Europe | Amber | Cookie/tracker consent is governed by the ePrivacy transposition (S.L. 586.01) with published IDPC cookie-consent guidance; the IDPC and UK ICO cooperate on cross-border unsolicited-marketing… | Profile →Brief |
| Marshall Islands (MH) | Asia-Pacific | Red | No cookie/tracker consent rule, dark-pattern prohibition, opt-out-signal recognition, clean-room rule, or direct-marketing consent/suppression regime exists in RMI law. Searched for an RMI… | Profile →Brief |
| Maryland, USA (US-MD) | Americas | Amber | MODPA's commercial-privacy provisions center on an under-18 targeted-advertising ban, an optional (not mandatory) universal opt-out mechanism, and an 'unambiguous affirmative action' consent standard… | Profile →Brief |
| Massachusetts, USA (US-MA) | Americas | Red | Massachusetts has no cookie-consent law, Global Privacy Control recognition statute, clean-room regulation, or CPRA-style 'sale'/'share' framework. The only MA-specific adtech-adjacent rule is the… | Profile →Brief |
| Mexico (MX) | Americas | Red | Mexico's private-sector data protection law does not specifically address internet cookies or trackers, and no dedicated dark-pattern prohibition, opt-out-signal recognition (e.g., Global Privacy… | Profile →Brief |
| Michigan, USA (US-MI) | Americas | Amber | Michigan has no state-level cookie-consent, opt-out-signal, clean-room, or cross-context-advertising ('sale'/'share') statute. FTC Section 5 enforcement against location-data brokers and adtech… | Profile →Brief |
| Minnesota, USA (US-MN) | Americas | Amber | The MCDPA mandates honoring browser-based universal opt-out mechanisms (GPC-style signals) for targeted advertising and data-sale opt-out, and grants a direct consumer opt-out right for… | Profile →Brief |
| Mississippi, USA (US-MS) | Americas | Red | Mississippi has no state-specific cookie/tracker consent law, dark-pattern prohibition, opt-out-signal (e.g., GPC) recognition requirement, clean-room regulation, or 'sale'/'share'… | Profile →Brief |
| Missouri, USA (US-MO) | Americas | Red | Missouri has no cookie/tracker consent law, no dark-patterns prohibition, no Global-Privacy-Control-style opt-out-signal recognition duty, no clean-room/data-collaboration rules, and no CPRA-style… | Profile →Brief |
| Montana, USA (US-MT) | Americas | Amber | Montana recognises universal opt-out mechanisms (UOOM), with UOOM-related requirements in effect since January 1, 2025, alongside a direct consumer right to opt out of sale of personal data and use… | Profile →Brief |
| Morocco (MA) | Africa | Red | No sourced evidence was found of a Moroccan cookie/tracker consent regime, dark-pattern prohibition, opt-out-signal recognition (e.g. GPC), clean-room/data-collaboration rules… | Profile →Brief |
| Mozambique (MZ) | Africa | Red | No cookie/tracker consent regime, dark-pattern prohibition, opt-out-signal recognition, clean-room rules, cross-context-advertising regime, or direct-marketing consent/suppression framework has been… | Profile →Brief |
| Myanmar (MM) | Asia-Pacific | Red | No cookie/tracker consent regime, dark-pattern prohibition, opt-out-signal recognition, clean-room rule, cross-context-advertising regime, or direct-marketing consent/suppression framework was… | Profile →Brief |
| Nebraska, USA (US-NE) | Americas | Amber | Nebraska requires businesses to honor universal opt-out mechanisms (UOOM) for sale and targeted-advertising opt-outs, a requirement already in effect since January 1, 2025. No separate cookie-consent… | Profile →Brief |
| Nepal (NP) | Asia-Pacific | Red | No cookie/tracker consent regime, dark-pattern prohibition, recognised opt-out signal, clean-room rules, cross-context-advertising regime, or direct-marketing consent/suppression framework was… | Profile →Brief |
| Netherlands (NL) | Europe | Amber | The Telecommunicatiewet's cookie-consent rule requires prior, informed consent before storing or accessing information on a user's terminal equipment, applying technology-neutrally to all tracking… | Profile →Brief |
| Nevada, USA (US-NV) | Americas | Amber | Nevada's only adtech-relevant provision is SB 220's narrow opt-out-of-sale right, which uses a materially narrower definition of 'sale' than the CCPA/CPRA and requires a single 'designated request… | Profile →Brief |
| New Brunswick, Canada (CA-NB) | Americas | Red | Evidence in this pass is limited to OPC guidance on deceptive design patterns ('dark patterns'). No NB/federal cookie-consent statute, opt-out-signal recognition regime (e.g., GPC), clean-room rules… | Profile →Brief |
| New Hampshire, USA (US-NH) | Americas | Green | The NHDPA gives consumers a right to opt out of targeted advertising and sale of personal data, and requires controllers to provide an opt-out submission process; consumers may designate a third… | Profile →Brief |
| New Jersey, USA (US-NJ) | Americas | Green | The NJDPL's principal adtech mechanism is a consumer opt-out right covering targeted advertising, sale of personal data, and — unusually among state laws — significant-effect profiling, reinforced by… | Profile →Brief |
| New Mexico, USA (US-NM) | Americas | Red | New Mexico has no cookie/tracker consent law, dark-pattern prohibition, opt-out-signal mandate, clean-room regulation, cross-context-advertising 'sale'/'share' framework, or general direct-marketing… | Profile →Brief |
| New Zealand (NZ) | Asia-Pacific | Red | No NZ-specific cookie/tracker consent regime, dark-pattern prohibition, recognised opt-out signal (e.g. GPC), clean-room framework, or CPRA-style 'sale/share' concept was identified; the general… | Profile →Brief |
| Nigeria (NG) | Africa | Red | The NDPA does not contain a dedicated ePrivacy-style cookie/tracker consent regime, dark-pattern prohibition, opt-out signal recognition, clean-room framework, or direct-marketing suppression rule… | Profile →Brief |
| North Carolina, USA (US-NC) | Americas | Red | North Carolina has no cookie/tracker consent law, dark-pattern prohibition, opt-out-signal recognition mandate, clean-room regulation, cross-context-advertising 'sale/share' regime, or… | Profile →Brief |
| North Dakota, USA (US-ND) | Americas | Red | North Dakota has no cookie/tracker consent statute, no dark-pattern prohibition, no recognition of opt-out signals (GPC/DAA), no clean-room regulation, and no CPRA-style 'sale'/'share'… | Profile →Brief |
| Norway (NO) | Europe | Green | Datatilsynet is a highly active regulator of adtech practices: it has fined multiple websites over unlawful tracking-pixel data sharing, imposed a temporary ban on Meta's behavioural advertising… | Profile →Brief |
| Ohio, USA (US-OH) | Americas | Red | Ohio has no cookie/tracker consent statute, dark-pattern prohibition, opt-out-signal mandate, clean-room regulation, cross-context-advertising 'sale/share' framework, or direct-marketing consent… | Profile →Brief |
| Oklahoma, USA (US-OK) | Americas | Amber | No Oklahoma cookie-consent law, dark-patterns prohibition, or clean-room regulation currently exists. SB 546 will introduce an opt-out right for targeted advertising and sale of personal data from 1… | Profile →Brief |
| Ontario, Canada (CA-ON) | Americas | Amber | Direct marketing/commercial electronic messaging is governed federally by CASL (jointly enforced by CRTC, OPC and Competition Bureau) requiring express or implied consent, sender identification and… | Profile →Brief |
| Oregon, USA (US-OR) | Americas | Amber | OCPA requires recognition of universal opt-out mechanisms (e.g., Global Privacy Control) from January 1, 2026, prohibits dark-pattern consent practices implicitly, and gives consumers opt-out rights… | Profile →Brief |
| Pakistan (PK) | Asia-Pacific | Red | No cookie/tracker consent law, dark-pattern prohibition, opt-out-signal recognition (e.g., GPC), clean-room/data-collaboration rule, cross-context-advertising restriction, or direct-marketing… | Profile →Brief |
| Palau (PW) | Asia-Pacific | Red | No cookie/tracker consent regime, dark-pattern prohibition, opt-out-signal recognition, clean-room rule, or direct-marketing consent rule could be located for Palau. | Profile →Brief |
| Panama (PA) | Americas | Red | No cookie/tracker-consent regime, dark-pattern prohibition, opt-out-signal framework, clean-room rules, cross-context-advertising rules, or direct-marketing-specific suppression regime distinct from… | Profile →Brief |
| Pennsylvania, USA (US-PA) | Americas | Red | Pennsylvania has no cookie/tracker consent law, dark-pattern prohibition, recognized opt-out signal regime, clean-room framework, or cross-context-advertising 'sale/share' concept of the CPRA type.… | Profile →Brief |
| Peru (PE) | Americas | Amber | Direct-marketing/commercial-prospecting processing requires the data subject's direct, first-contact consent under the 2024 Reglamento, with fines from 5-50 UIT for marketing without consent and… | Profile →Brief |
| Philippines (PH) | Asia-Pacific | Amber | NPC Advisory No. 2026-01 (issued April 13, 2026) is the most direct recent evidence in this module, addressing lawful scraping of publicly available personal data for commercial/adtech-adjacent uses.… | Profile →Brief |
| Poland (PL) | Europe | Amber | Cookie and tracker consent in Poland follows the ePrivacy Directive framework as transposed into Polish Telecommunications Law, supplemented by UODO cookie guidance. UOKiK (the competition/consumer… | Profile →Brief |
| Portugal (PT) | Europe | Red | No Portugal-specific cookie/tracker statute, dark-pattern prohibition, opt-out-signal recognition, clean-room rule, or cross-context-advertising rule distinct from general GDPR/ePrivacy was… | Profile →Brief |
| Qatar (QA) | Middle East | Red | Mainland Law 13/2016 prohibits sending direct electronic marketing messages without prior consent. No cookie/tracker-specific consent regime, dark-pattern prohibition, recognized opt-out signal… | Profile →Brief |
| Quebec, Canada (CA-QC) | Americas | Amber | Privacy-by-default rules require deactivation of identification/location/profiling functions absent opt-in, and marketing/'prospection' uses require identity disclosure and consent-withdrawal rights.… | Profile →Brief |
| Rhode Island, USA (US-RI) | Americas | Amber | RIDTPPA grants an opt-out right for targeted advertising and profiling but, notably, does NOT recognize universal opt-out mechanisms (e.g., Global Privacy Control) unlike Colorado, Connecticut, Texas… | Profile →Brief |
| Romania (RO) | Europe | Amber | Cookie/tracker consent in Romania follows the ePrivacy Directive as transposed by Law No. 506/2004, enforced by ANSPDCP with the same GDPR-aligned active-consent standard applied in the Microstockr… | Profile →Brief |
| Russia (RU) | Europe | Amber | Direct marketing is the best-evidenced adtech sub-area: Article 18 of the Law on Advertising, enforced by the Federal Antimonopoly Service (FAS Russia, a distinct authority from Roskomnadzor)… | Profile →Brief |
| Rwanda (RW) | Africa | Red | Beyond the general right-to-object provision covering direct marketing and related profiling (Article 24), no dedicated cookie/tracker consent regime, dark-pattern prohibition, recognized opt-out… | Profile →Brief |
| Saudi Arabia (SA) | Middle East | Amber | The PDPL Implementing Regulation regulates direct marketing consent (Arts. 28-29), and marketing/promotional messaging without prior consent is among the most commonly cited SDAIA enforcement… | Profile →Brief |
| Senegal (SN) | Africa | Red | The CDP has issued a dedicated deliberation on the conditions for direct marketing (Deliberation No. 2014-20/CDP). No cookie-consent-specific regime, dark-pattern prohibition, recognised opt-out… | Profile →Brief |
| Serbia (RS) | Europe | Red | As of the Commissioner's 2016-2017 model-law consultation period, direct marketing, biometrics, video surveillance and internet data-security processing were identified by the Commissioner (citing… | Profile →Brief |
| Seychelles (SC) | Africa | Red | No cookie/tracker-specific provision, dark-pattern prohibition, opt-out-signal regime, clean-room rule, or direct-marketing consent/suppression rule specific to Seychelles was identified. Searched… | Profile →Brief |
| Singapore (SG) | Asia-Pacific | Amber | Direct marketing is governed by the PDPA's own DNC regime rather than a distinct ePrivacy statute. <cite index="82-3">The Do Not Call (DNC) Registry helps individuals exercise the right to opt out of… | Profile →Brief |
| Slovakia (SK) | Europe | Red | Cookie/tracker consent in Slovakia follows the EU ePrivacy Directive's consent requirement as implemented nationally, overlaid by GDPR consent standards where personal data are involved. No… | Profile →Brief |
| Slovenia (SI) | Europe | Amber | No Slovenia-specific adtech enforcement action (cookies/dark patterns/cross-context advertising) was identified in this research pass. Cookie and tracker consent is presumed governed by the national… | Profile →Brief |
| South Africa (ZA) | Africa | Amber | Only direct-marketing consent/suppression rules were substantively confirmed, via POPIA's Section 69-adjacent direct-marketing restrictions and the DMASA industry POPIA Code of Conduct.… | Profile →Brief |
| South Carolina, USA (US-SC) | Americas | Amber | H.3431 prohibits dark patterns and targeted advertising directed at minors, with a private right of action for dark-pattern violations arising via the state's general consumer-protection statute. No… | Profile →Brief |
| South Dakota, USA (US-SD) | Americas | Red | South Dakota has not enacted state-level cookie/tracker consent, dark-pattern, opt-out-signal (e.g., GPC), clean-room, cross-context-advertising, or direct-marketing-specific privacy statutes.… | Profile →Brief |
| South Korea (KR) | Asia-Pacific | Red | Under the Network Act, senders of commercial advertising messages must obtain clear, specific consent to 'advertising information' (vague terms such as 'benefit notifications' are disallowed) and… | Profile →Brief |
| Spain (ES) | Europe | Amber | AEPD's Guía sobre el uso de las cookies (last major update aligning with EDPB Guidelines 03/2022 on deceptive patterns) governs cookie/tracker consent, mandating equal prominence for accept/reject… | Profile →Brief |
| Sri Lanka (LK) | Asia-Pacific | Amber | The PDPA's Part IV restricts the use of personal data for unsolicited direct-marketing messages; no cookie/tracker-specific consent regime, dark-pattern prohibition, recognised opt-out signal, or… | Profile →Brief |
| Sweden (SE) | Europe | Red | Cookie/tracker consent is governed by LEK Ch.9 §28 (ePrivacy transposition) alongside GDPR. IMY has run structured audits of adtech tools (Google Analytics, Meta Pixel) resulting in multiple large… | Profile →Brief |
| Switzerland (CH) | Europe | Amber | The FDPIC has issued cookie guidelines and has taken direct enforcement interest in dark-pattern-style consent practices, including an enforcement notice to a major Swiss e-commerce retailer (Digitec… | Profile →Brief |
| Taiwan (TW) | Asia-Pacific | Red | The PDPA contains a marketing-related restriction (allowing regulators to act against non-compliance with marketing restrictions), but no dedicated cookie/tracker consent regime, dark-pattern… | Profile →Brief |
| Tanzania (TZ) | Africa | Red | No qualifying source was located covering cookie/tracker consent rules, dark-pattern prohibitions, opt-out signal recognition, clean-room/data-collaboration rules, cross-context advertising, or… | Profile →Brief |
| Tennessee, USA (US-TN) | Americas | Amber | TIPA's principal adtech-relevant mechanism is the consumer opt-out right over targeted advertising and sale of personal data. No Tennessee-specific cookie-consent statute, dark-pattern prohibition… | Profile →Brief |
| Texas, USA (US-TX) | Americas | Amber | TDPSA requires recognition of universal opt-out mechanisms (effective Jan 1, 2025), includes dark-patterns provisions affecting the validity of consent, and grants opt-out rights for targeted… | Profile →Brief |
| Thailand (TH) | Asia-Pacific | Amber | Direct marketing is multi-regulator: <cite index="52-4,52-6,52-9">direct-marketing activity in Thailand is governed by the Direct Sale and Direct Marketing Act B.E. 2545, the Consumer Protection Act… | Profile →Brief |
| Trinidad and Tobago (TT) | Caribbean | Red | Section 42(a) and (b) of the DPA 2011 — the only Part IV-adjacent provisions proclaimed, on 23 August 2021 — is commonly associated with direct-marketing control in comparable Caribbean DPAs, but its… | Profile →Brief |
| Tunisia (TN) | Africa | Red | No cookie/tracker consent regime, dark-pattern prohibition, opt-out-signal recognition, clean-room rules, cross-context-advertising rules, or direct-marketing suppression regime specific to Tunisia… | Profile →Brief |
| Turkey (TR) | Europe | Red | KVKK has issued cookie-related guidance and Turkey separately regulates commercial electronic messaging, but this run only retrieved title-level references (draft cookie guidelines, Commercial… | Profile →Brief |
| Uganda (UG) | Africa | Red | No dedicated cookie/tracker consent regime, dark-pattern prohibition, recognised opt-out signal (e.g., GPC/DAA equivalent), clean-room/data-collaboration rule, cross-context-advertising concept, or… | Profile →Brief |
| Ukraine (UA) | Europe | Red | No confirmed cookie-consent, dark-pattern, opt-out-signal, data-clean-room, cross-context-advertising, or direct-marketing-specific statutory provisions were identified for Ukraine in this research… | Profile →Brief |
| United Arab Emirates (AE) | Middle East | Red | No AE-specific cookie/tracker consent regime, dark-pattern prohibition, Global-Privacy-Control-style opt-out recognition, clean-room rule, or direct-marketing-specific consent/suppression regime was… | Profile →Brief |
| United Kingdom Expert reviewed (UK) | Europe | Amber | PECR governs cookie consent, with DUAA-inserted exceptions; the ICO has historically found legitimate-interest justifications for real-time-bidding (RTB) adtech insufficient. The Children's code… | Profile →Brief |
| United States (US) | Americas | Amber | Cookie/tracker, dark-pattern, and opt-out-signal obligations are driven almost entirely by state comprehensive privacy law (principally CCPA) rather than a federal ePrivacy analogue. California's… | Profile →Brief |
| United States — California (US-CA) | Americas | Amber | California is the most developed U.S. state jurisdiction for adtech-adjacent privacy rules: the CCPA/CPRA's 'sale' and 'share' definitions specifically capture cross-context behavioral advertising… | Profile →Brief |
| United States — New York (US-NY) | Americas | Red | New York has no CPRA-style 'sale'/'share' framework, no state cookie-consent statute, and no codified dark-pattern prohibition or Global Privacy Control recognition requirement. Adtech-adjacent… | Profile →Brief |
| Uruguay (UY) | Americas | Red | No dedicated cookie/tracker consent regime, dark-pattern prohibition, opt-out signal recognition, clean-room rule, cross-context-advertising rule, or direct-marketing-specific suppression regime was… | Profile →Brief |
| Utah, USA (US-UT) | Americas | Amber | The UCPA's adtech/commercial-privacy toolkit is limited to a notice-and-opt-out right for sale and targeted advertising, using a narrow monetary-only definition of 'sale.' The Act does not mandate… | Profile →Brief |
| Vanuatu (VU) | Asia-Pacific | Red | No cookie/tracker consent regime, dark-pattern prohibition, opt-out-signal recognition, clean-room rule, or direct-marketing consent rule specific to Vanuatu could be sourced. Searches run: 'Vanuatu… | Profile →Brief |
| Venezuela (VE) | Americas | Red | No cookie/tracker consent regime, dark-pattern prohibition, recognised opt-out signal, clean-room rule, cross-context-advertising rule, or direct-marketing consent/suppression regime was located in… | Profile →Brief |
| Vermont, USA (US-VT) | Americas | Amber | S.71 introduces opt-out-signal recognition and cross-context-advertising opt-outs effective 2028; no dedicated Vermont cookie-consent, dark-pattern, clean-room, or direct-marketing statute was… | Profile →Brief |
| Vietnam (VN) | Asia-Pacific | Red | The PDPL restricts personal-data processing for marketing/advertising purposes and prohibits unauthorised buying/selling of personal information. No dedicated cookie/ePrivacy-style consent regime… | Profile →Brief |
| Virginia, USA (US-VA) | Americas | Amber | The VCDPA regulates commercial data use primarily through opt-out rights covering targeted advertising, the narrowly-defined monetary 'sale' of personal data, and significant-effect profiling, rather… | Profile →Brief |
| Washington State, USA (US-WA) | Americas | Amber | Washington has no dedicated cookie-consent, dark-pattern, opt-out-signal, or clean-room statute. MHMDA's broad 'sell' definition indirectly reaches health-data monetization via third-party… | Profile →Brief |
| West Virginia, USA (US-WV) | Americas | Red | West Virginia has no cookie/tracker consent statute, no recognition of universal opt-out signals (e.g., Global Privacy Control), no dark-pattern prohibition, and no CPRA-style 'sale'/'share' opt-out… | Profile →Brief |
| Wisconsin, USA (US-WI) | Americas | Red | Wisconsin has no state-specific cookie/tracker, dark-pattern, opt-out-signal, clean-room, cross-context-advertising, or 'sale'/'share' regime. Online tracking and marketing practices affecting… | Profile →Brief |
| Wyoming, USA (US-WY) | Americas | Red | Wyoming has no state-level cookie/tracker consent regime, dark-pattern prohibition, opt-out-signal recognition mandate, clean-room regulation, or 'sale'/'share' cross-context-advertising restriction.… | Profile →Brief |
| Zambia (ZM) | Africa | Red | No T1/T2 or credible T3 material on cookie/tracker consent rules, dark-pattern prohibitions, opt-out signals, clean-room/DCR rules, cross-context advertising, or direct-marketing consent/suppression… | Profile →Brief |