--- title: "AdTech & commercial privacy — Global Regulatory Comparison | Data Protection Monitor" canonical: https://dataprotection.gi/domains/adtech-and-commercial-privacy/ source_html: /domains/adtech-and-commercial-privacy/index.html description: "Cross-jurisdiction comparison of AdTech & commercial privacy across 167 markets in Data Protection Monitor." generated_at: 2026-10-25T04:46:50Z content_sha256: b2c100aac5afc5a8b6ccb2ae7e4932b871f21744f0398a4d228a92155127911e generator: "fe-fleet/md-twin@1.0" --- # AdTech & commercial privacy — Global Regulatory Comparison | Data Protection Monitor ## Jurisdiction Readings (167 markets) 6 Confirmed 76 Probable 85 Uncertain Jurisdiction Region Status Regulatory Summary Actions [African bloc](/jurisdictions/african-bloc/) (AFR) Africa Red No continental-level cookie/tracker consent regime, dark-pattern prohibition, opt-out-signal standard, clean-room rule, cross-context advertising rule, or direct-marketing consent standard was found… [Profile →](/jurisdictions/african-bloc/)[Brief](/reports/?t=entry&j=AFR) [Alabama, USA](/jurisdictions/alabama-usa/) (US-AL) Americas Amber Commercial/adtech-specific privacy rules in Alabama are emergent and largely tied to the not-yet-effective PDPA and several 2026 bills of uncertain enactment status: House Bill 283 (dark patterns /… [Profile →](/jurisdictions/alabama-usa/)[Brief](/reports/?t=entry&j=US-AL) [Alaska, USA](/jurisdictions/alaska-usa/) (US-AK) Americas Red Alaska has no cookie/tracker consent statute, no dark-patterns prohibition, no opt-out-signal mandate (e.g., GPC recognition), no clean-room regulation, and no CPRA-style 'sale'/'share' restriction… [Profile →](/jurisdictions/alaska-usa/)[Brief](/reports/?t=entry&j=US-AK) [Alberta, Canada](/jurisdictions/alberta-canada/) (CA-AB) Americas Red No Alberta-specific statutory regime for cookies/trackers, dark patterns, opt-out signals, clean rooms, cross-context advertising, or direct marketing was identified in the sources reviewed this run… [Profile →](/jurisdictions/alberta-canada/)[Brief](/reports/?t=entry&j=CA-AB) [Algeria](/jurisdictions/algeria/) (DZ) Africa Red No evidence was located of an Algeria-specific cookie/tracker consent regime, dark-pattern prohibition, opt-out-signal recognition, clean-room framework, cross-context-advertising rule, or… [Profile →](/jurisdictions/algeria/)[Brief](/reports/?t=entry&j=DZ) [Antigua and Barbuda](/jurisdictions/antigua-and-barbuda/) (AG) Caribbean Red No source located on cookie/tracker rules, dark-pattern prohibitions, opt-out signals, clean-room rules, cross-context advertising, or direct-marketing consent/suppression rules for Antigua and… [Profile →](/jurisdictions/antigua-and-barbuda/)[Brief](/reports/?t=entry&j=AG) [Argentina](/jurisdictions/argentina/) (AR) Americas Red Direct marketing is the only well-substantiated sub-module: the Do-Not-Call Registry (Ley 26.951) plus AAIP enforcement (fines against FCA Automobiles Argentina and Telefónica Móviles Argentina for… [Profile →](/jurisdictions/argentina/)[Brief](/reports/?t=entry&j=AR) [Arizona, USA](/jurisdictions/arizona-usa/) (US-AZ) Americas Amber Arizona has no cookie-consent or 'sale'/'share' opt-out statute comparable to CPRA. The principal lever against commercial ad-tech data practices is the Arizona Consumer Fraud Act, used by the AG to… [Profile →](/jurisdictions/arizona-usa/)[Brief](/reports/?t=entry&j=US-AZ) [Arkansas, USA](/jurisdictions/arkansas-usa/) (US-AR) Americas Red Arkansas has no general cookie/tracker consent law, dark-pattern prohibition, opt-out-signal mandate, or clean-room regulation. The main commercial-privacy overlays are minors-specific: HB1717 bans… [Profile →](/jurisdictions/arkansas-usa/)[Brief](/reports/?t=entry&j=US-AR) [Asia-Pacific bloc](/jurisdictions/asia-pacific-bloc/) (APAC) Asia-Pacific Red No bloc-level cookie/tracker consent regime, dark-pattern prohibition, opt-out signal standard, clean-room rule, cross-context advertising rule, or direct-marketing rule exists under either the… [Profile →](/jurisdictions/asia-pacific-bloc/)[Brief](/reports/?t=entry&j=APAC) [Australia](/jurisdictions/australia/) (AU) Asia-Pacific Amber Australia lacks a dedicated ePrivacy/cookie-consent statute or CPRA-style 'sale'/'share' construct; commercial privacy protection instead flows from general APP obligations (notably APP 7… [Profile →](/jurisdictions/australia/)[Brief](/reports/?t=entry&j=AU) [Austria](/jurisdictions/austria/) (AT) Europe Amber Austria's cookie/tracker and direct-marketing consent regime derives from the ePrivacy Directive as implemented via TKG 2021, layered with GDPR consent standards; US-style constructs (Global Privacy… [Profile →](/jurisdictions/austria/)[Brief](/reports/?t=entry&j=AT) [Bangladesh](/jurisdictions/bangladesh/) (BD) Asia-Pacific Red No cookie/tracker consent regime, dark-pattern prohibition, opt-out-signal recognition, clean-room rule, cross-context-advertising provision, or direct-marketing consent/suppression rule could be… [Profile →](/jurisdictions/bangladesh/)[Brief](/reports/?t=entry&j=BD) [Belgium](/jurisdictions/belgium/) (BE) Europe Green The Belgian DPA is one of the most active EU regulators in adtech enforcement, having fined IAB Europe over its Transparency and Consent Framework, sanctioned dark-pattern-style loyalty programmes… [Profile →](/jurisdictions/belgium/)[Brief](/reports/?t=entry&j=BE) [Belize](/jurisdictions/belize/) (BZ) Americas Red No sourced cookie/tracker consent regime, dark-pattern prohibition, opt-out-signal recognition, clean-room rule, or direct-marketing consent/suppression provision specific to Belize was located. [Profile →](/jurisdictions/belize/)[Brief](/reports/?t=entry&j=BZ) [Brazil](/jurisdictions/brazil/) (BR) Americas Amber Commercial/adtech-specific DP rules in Brazil remain comparatively underdeveloped relative to cookie/consent regimes seen in the EU or certain US states. The clearest enforcement data point is ANPD's… [Profile →](/jurisdictions/brazil/)[Brief](/reports/?t=entry&j=BR) [British Columbia, Canada](/jurisdictions/british-columbia-canada/) (CA-BC) Americas Red PIPA applies general consent and purpose-limitation principles to cookie/tracker use, direct marketing, and cross-context data use, but BC has no dedicated cookie-consent statute, no codified… [Profile →](/jurisdictions/british-columbia-canada/)[Brief](/reports/?t=entry&j=CA-BC) [Bulgaria](/jurisdictions/bulgaria/) (BG) Europe Amber Cookie/tracker consent in Bulgaria relies on the Electronic Communications Act implementing the EU ePrivacy Directive alongside GDPR consent standards. No Bulgaria-specific rules on dark patterns… [Profile →](/jurisdictions/bulgaria/)[Brief](/reports/?t=entry&j=BG) [Cambodia](/jurisdictions/cambodia/) (KH) Asia-Pacific Red No Cambodia-specific cookie/tracker consent regime, dark-pattern prohibition, opt-out-signal recognition, clean-room rules, cross-context advertising rules, or direct-marketing consent/suppression… [Profile →](/jurisdictions/cambodia/)[Brief](/reports/?t=entry&j=KH) [Cameroon](/jurisdictions/cameroon/) (CM) Africa Red No confirmed cookie/tracker consent regime, dark-pattern prohibitions, opt-out signal recognition, clean-room rules, cross-context advertising rules, or direct-marketing suppression regime specific… [Profile →](/jurisdictions/cameroon/)[Brief](/reports/?t=entry&j=CM) [Canada — Kahnawake](/jurisdictions/canada-kahnawake/) (CA-KAH) Americas Amber Canada has no dedicated ePrivacy-style statutory cookie-consent regime; OPC guidance applies PIPEDA's general meaningful-consent principle to online tracking, profiling and in-game data collection.… [Profile →](/jurisdictions/canada-kahnawake/)[Brief](/reports/?t=entry&j=CA-KAH) [Canada — Tobique First Nation](/jurisdictions/canada-tobique-first-nation/) (CA-TFN) Americas Red PIPEDA has no dedicated cookie-consent or ePrivacy-style tracker regime; the OPC instead applies its general meaningful-consent framework to online behavioural advertising, acknowledging that valid… [Profile →](/jurisdictions/canada-tobique-first-nation/)[Brief](/reports/?t=entry&j=CA-TFN) [Chile](/jurisdictions/chile/) (CL) Americas Red No dedicated cookie/adtech-consent statute, dark-pattern prohibition, recognized opt-out signal (e.g., GPC/DAA equivalent), or clean-room/data-collaboration rule was identified for Chile in sources… [Profile →](/jurisdictions/chile/)[Brief](/reports/?t=entry&j=CL) [China](/jurisdictions/china/) (CN) Asia-Pacific Amber China lacks a discrete ePrivacy-style cookie-consent statute; commercial-privacy governance instead runs through PIPL's ADM/marketing rule (Art 24) and the CAC's 2022 Provisions on Algorithmic… [Profile →](/jurisdictions/china/)[Brief](/reports/?t=entry&j=CN) [Colombia](/jurisdictions/colombia/) (CO) Americas Amber Direct-marketing consent enforcement is confirmed via SIC's largest-to-date fine against Comcel for collecting personal data without informed consent during a marketing campaign. No… [Profile →](/jurisdictions/colombia/)[Brief](/reports/?t=entry&j=CO) [Colorado, USA](/jurisdictions/colorado-usa/) (US-CO) Americas Green Colorado requires recognition of a universal opt-out mechanism (UOOM) for targeted-advertising and sale opt-outs since July 1, 2024, and currently recognizes the Global Privacy Control (GPC) as the… [Profile →](/jurisdictions/colorado-usa/)[Brief](/reports/?t=entry&j=US-CO) [Comoros](/jurisdictions/comoros/) (KM) Africa Red No cookie/tracker consent regime, dark-pattern prohibition, opt-out-signal framework, clean-room rule, or direct-marketing consent regime was located for the Union of the Comoros. [Profile →](/jurisdictions/comoros/)[Brief](/reports/?t=entry&j=KM) [Comoros — Anjouan](/jurisdictions/comoros-anjouan/) (KM-A) Africa Red No ePrivacy-style cookie/tracker consent regime, dark-pattern prohibition, opt-out-signal framework, clean-room rule, or direct-marketing consent statute specific to Comoros could be identified. [Profile →](/jurisdictions/comoros-anjouan/)[Brief](/reports/?t=entry&j=KM-A) [Comoros — Mohéli](/jurisdictions/comoros-moheli-mwali/) (KM-M) Africa Red No cookie/tracker consent statute, dark-pattern prohibition, opt-out-signal recognition, clean-room rule, or direct-marketing consent regime exists in Comorian law. [Profile →](/jurisdictions/comoros-moheli-mwali/)[Brief](/reports/?t=entry&j=KM-M) [Connecticut, USA](/jurisdictions/connecticut-usa/) (US-CT) Americas Green CTDPA requires an easily accessible opt-out link for targeted advertising/sale on websites and apps, and since January 1, 2025 requires controllers to honor universal opt-out preference signals… [Profile →](/jurisdictions/connecticut-usa/)[Brief](/reports/?t=entry&j=US-CT) [Costa Rica](/jurisdictions/costa-rica/) (CR) Americas Red No dedicated adtech-specific instrument (cookie-consent statute, dark-pattern prohibition, Global-Privacy-Control-equivalent opt-out signal regime, clean-room rules, or CPRA-style 'sale/share'… [Profile →](/jurisdictions/costa-rica/)[Brief](/reports/?t=entry&j=CR) [Croatia](/jurisdictions/croatia/) (HR) Europe Amber Cookie/tracker and direct-marketing rules derive from the ePrivacy Directive as transposed via the Electronic Communications Act, layered on GDPR consent standards, pending the still-stalled EU… [Profile →](/jurisdictions/croatia/)[Brief](/reports/?t=entry&j=HR) [Curaçao](/jurisdictions/curacao/) (CW) Caribbean Red No Curaçao-specific cookie/tracker consent regime, dark-pattern prohibition, opt-out-signal recognition, clean-room rules, cross-context-advertising rules, or direct-marketing consent/suppression… [Profile →](/jurisdictions/curacao/)[Brief](/reports/?t=entry&j=CW) [Cyprus](/jurisdictions/cyprus/) (CY) Europe Amber Cookie and tracker consent follows the ePrivacy Directive as transposed via Law 112(I)/2004, enforced by the Commissioner alongside GDPR. The Commissioner conducted a cookie compliance audit and… [Profile →](/jurisdictions/cyprus/)[Brief](/reports/?t=entry&j=CY) [Czech Republic](/jurisdictions/czech-republic/) (CZ) Europe Amber Cookie/tracker consent is governed by the amended Electronic Communications Act requiring opt-in consent. Direct marketing is governed by Act No. 480/2004 Coll. on Certain Information Society… [Profile →](/jurisdictions/czech-republic/)[Brief](/reports/?t=entry&j=CZ) [Delaware, USA](/jurisdictions/delaware-usa/) (US-DE) Americas Amber Consumers may opt out of the sale of personal data and processing for targeted advertising and profiling. Universal opt-out mechanisms (GPC-style signals) became mandatory for controllers to… [Profile →](/jurisdictions/delaware-usa/)[Brief](/reports/?t=entry&j=US-DE) [Denmark](/jurisdictions/denmark/) (DK) Europe Amber Denmark's cookie/tracker regime relies on GDPR-standard opt-in consent as articulated in Datatilsynet's website-visitor-data guidelines, and direct marketing is governed by an opt-out-register… [Profile →](/jurisdictions/denmark/)[Brief](/reports/?t=entry&j=DK) [District of Columbia, USA](/jurisdictions/district-of-columbia-usa/) (US-DC) Americas Red The District has no cookie-consent law, dark-pattern prohibition, opt-out-signal mandate, clean-room regulation, cross-context-advertising 'sale/share' regime, or direct-marketing consent statute.… [Profile →](/jurisdictions/district-of-columbia-usa/)[Brief](/reports/?t=entry&j=US-DC) [Dominican Republic](/jurisdictions/dominican-republic/) (DO) Americas Red No ePrivacy-style cookie/tracker consent statute, dark-pattern prohibition, recognized opt-out signal framework, clean-room regime, or cross-context-advertising rule was identified for the Dominican… [Profile →](/jurisdictions/dominican-republic/)[Brief](/reports/?t=entry&j=DO) [Ecuador](/jurisdictions/ecuador/) (EC) Americas Amber EUIs are public-sector controllers, not commercial adtech operators, so several sub-modules (dark patterns, clean rooms/DCR, direct marketing) have no dedicated EUDPR content; however, EUI… [Profile →](/jurisdictions/ecuador/)[Brief](/reports/?t=entry&j=EC) [Egypt](/jurisdictions/egypt/) (EG) Africa Amber Electronic direct marketing is licensable activity under the Executive Regulations. No Egypt-specific cookie/tracker consent regime, dark-pattern prohibition, opt-out-signal (GPC/DAA) recognition… [Profile →](/jurisdictions/egypt/)[Brief](/reports/?t=entry&j=EG) [Estonia](/jurisdictions/estonia/) (EE) Europe Amber Cookie/tracker consent in Estonia follows the ePrivacy Directive's Art 5(3) prior-consent rule as elaborated by EDPB Guidelines 2/2023, applied directly as EU law; CPRA-style constructs (opt-out… [Profile →](/jurisdictions/estonia/)[Brief](/reports/?t=entry&j=EE) [European Economic Area](/jurisdictions/european-economic-area-bloc/) Expert reviewed (EEA) Europe Amber Cookie/tracker consent is governed by the ePrivacy Directive read with GDPR consent standards; 2026 developments centre on the contested Digital Omnibus Article 88b automated-consent-signal mechanism… [Profile →](/jurisdictions/european-economic-area-bloc/)[Brief](/reports/?t=entry&j=EEA) [Finland](/jurisdictions/finland/) (FI) Europe Amber Finland's cookie/tracker regime derives from the EU ePrivacy Directive as transposed nationally, operating alongside GDPR consent standards; the Ombudsman has refreshed direct-marketing FAQ guidance… [Profile →](/jurisdictions/finland/)[Brief](/reports/?t=entry&j=FI) [Florida, USA](/jurisdictions/florida-usa/) (US-FL) Americas Amber FDBR provides an opt-out right for targeted advertising (broadly defined to include affiliated-website tracking) and references 'dark patterns' as a defined term, but excludes… [Profile →](/jurisdictions/florida-usa/)[Brief](/reports/?t=entry&j=US-FL) [France](/jurisdictions/france/) (FR) Europe Amber CNIL's cookie/tracker regime (2020 guidelines and recommendation, consolidated January 2026, plus 2026 multi-device recommendations) is the dominant adtech-privacy instrument, alongside enforcement… [Profile →](/jurisdictions/france/)[Brief](/reports/?t=entry&j=FR) [Georgia, USA](/jurisdictions/georgia-usa/) (US-GA) Americas Red Georgia has no cookie/tracker-consent statute, no dark-patterns prohibition specific to privacy, no universal opt-out-signal recognition, and no clean-room or cross-context-advertising… [Profile →](/jurisdictions/georgia-usa/)[Brief](/reports/?t=entry&j=US-GA) [Germany](/jurisdictions/germany/) (DE) Europe Amber TTDSG §25 supplies Germany's core cookie/tracker consent rule, requiring consent for any storage of or access to information on end-user terminal equipment regardless of whether personal data… [Profile →](/jurisdictions/germany/)[Brief](/reports/?t=entry&j=DE) [Ghana](/jurisdictions/ghana/) (GH) Africa Red The Data Protection Act contains a general prohibition on selling personal data and a right to object to direct marketing, but no cookie/tracker-specific consent regime, dark-pattern prohibition… [Profile →](/jurisdictions/ghana/)[Brief](/reports/?t=entry&j=GH) [Gibraltar](/jurisdictions/gibraltar/) Expert reviewed (GI) Europe Amber Direct-marketing consent requirements under the Communications (Personal Data and Privacy) Regulations 2006 are confirmed for SMS/MMS marketing. No Gibraltar-specific cookie-consent enforcement… [Profile →](/jurisdictions/gibraltar/)[Brief](/reports/?t=entry&j=GI) [Greece](/jurisdictions/greece/) (GR) Europe Amber Law 3471/2006 and HDPA guidance govern cookies/trackers and direct marketing; the old opt-out mail-marketing register was repealed in favour of GDPR/ePrivacy-based consent rules. No Greece-specific… [Profile →](/jurisdictions/greece/)[Brief](/reports/?t=entry&j=GR) [Guernsey](/jurisdictions/guernsey/) (GG) Europe Amber No dedicated cookie/ePrivacy-equivalent statutory provision was located for Guernsey. ODPA has, however, been operationally active on dark-pattern enforcement via the Global Privacy Enforcement… [Profile →](/jurisdictions/guernsey/)[Brief](/reports/?t=entry&j=GG) [Guernsey — Alderney](/jurisdictions/guernsey-alderney/) (GG-ALD) Europe Amber The clearest Alderney-specific finding in this module is ODPA's September 2024 outreach to Alderney gambling-sector companies regarding the use of dark patterns, following the 2024 Global Privacy… [Profile →](/jurisdictions/guernsey-alderney/)[Brief](/reports/?t=entry&j=GG-ALD) [Hawaii, USA](/jurisdictions/hawaii-usa/) (US-HI) Americas Red Hawaii has no in-force cookie/tracker consent law, dark-pattern prohibition, opt-out-signal recognition, clean-room regime, cross-context-advertising ('sale'/'share') definition, or direct-marketing… [Profile →](/jurisdictions/hawaii-usa/)[Brief](/reports/?t=entry&j=US-HI) [Hong Kong](/jurisdictions/hong-kong/) (HK) Asia-Pacific Amber Direct marketing is the best-developed strand of PDPO's commercial-privacy regime (Part VIA), with binding consent/opt-out duties and criminal penalties, plus PCPD guidance against 'bundled consent'… [Profile →](/jurisdictions/hong-kong/)[Brief](/reports/?t=entry&j=HK) [Hungary](/jurisdictions/hungary/) (HU) Europe Red Direct-marketing enforcement carve-outs to NMHH under Act CVIII of 2001 are confirmed. Cookie/tracker consent, dark-pattern prohibitions, opt-out signals, clean-room rules and cross-context… [Profile →](/jurisdictions/hungary/)[Brief](/reports/?t=entry&j=HU) [Iceland](/jurisdictions/iceland/) (IS) Europe Red General GDPR consent and objection standards apply to cookies, direct marketing, and commercial profiling in Iceland via Act No. 90/2018, but no Iceland-specific enforcement decisions on… [Profile →](/jurisdictions/iceland/)[Brief](/reports/?t=entry&j=IS) [Idaho, USA](/jurisdictions/idaho-usa/) (US-ID) Americas Red Idaho has no cookie/tracker consent statute, no dark-pattern prohibition, no opt-out-signal recognition law, no clean-room regime, and no CPRA-style 'sale'/'share' framework for cross-context… [Profile →](/jurisdictions/idaho-usa/)[Brief](/reports/?t=entry&j=US-ID) [Illinois, USA](/jurisdictions/illinois-usa/) (US-IL) Americas Red Illinois has no cookie-consent law, dark-pattern prohibition, recognized opt-out signal, or clean-room rule. Senate Bill 340, still moving through the legislature as of mid-2026, would introduce… [Profile →](/jurisdictions/illinois-usa/)[Brief](/reports/?t=entry&j=US-IL) [India](/jurisdictions/india/) (IN) Asia-Pacific Amber DPDPA does not contain a GDPR-ePrivacy-style dedicated cookie/tracker consent regime. The clearest adtech-relevant provision is the children's-data ban on tracking, behavioral monitoring and targeted… [Profile →](/jurisdictions/india/)[Brief](/reports/?t=entry&j=IN) [Indiana, USA](/jurisdictions/indiana-usa/) (US-IN) Americas Amber Controllers must disclose and provide opt-outs for targeted advertising and sale of personal data, but the Act does not require recognition of universal opt-out signals (e.g., Global Privacy… [Profile →](/jurisdictions/indiana-usa/)[Brief](/reports/?t=entry&j=US-IN) [Iowa, USA](/jurisdictions/iowa-usa/) (US-IA) Americas Amber The ICDPA regulates commercial/adtech data use narrowly: it mandates disclosure of targeted-advertising activity and opt-out mechanics and grants an opt-out-of-sale right, but does not require… [Profile →](/jurisdictions/iowa-usa/)[Brief](/reports/?t=entry&j=US-IA) [Ireland](/jurisdictions/ireland/) (IE) Europe Amber Cookie and tracker consent is governed by S.I. No. 336/2011, with the DPC actively enforcing direct-marketing rules (2024 SMS-marketing prosecutions) and behavioural-advertising legal-basis… [Profile →](/jurisdictions/ireland/)[Brief](/reports/?t=entry&j=IE) [Isle of Man](/jurisdictions/isle-of-man/) (IM) Europe Red The Isle of Man Information Commissioner's remit over the 'Unsolicited Communications Regulations' indicates an operative direct-marketing/ePrivacy-equivalent regime, but detailed cookie-consent… [Profile →](/jurisdictions/isle-of-man/)[Brief](/reports/?t=entry&j=IM) [Italy](/jurisdictions/italy/) (IT) Europe Amber Italy's cookie/tracker regime rests on the Garante's 2021 Linee Guida (Art.122 Codice + Arts.4(11),7,12,13,25 GDPR): default no non-technical cookies on first access, prohibition of cookie walls… [Profile →](/jurisdictions/italy/)[Brief](/reports/?t=entry&j=IT) [Ivory Coast](/jurisdictions/ivory-coast-uemoa-bloc/) (CI) Africa Red No CI-specific evidence was found on cookie/tracker consent regimes, dark-pattern prohibitions, opt-out signal recognition, clean-room rules, cross-context advertising, or direct-marketing… [Profile →](/jurisdictions/ivory-coast-uemoa-bloc/)[Brief](/reports/?t=entry&j=CI) [Japan](/jurisdictions/japan/) (JP) Asia-Pacific Amber Cookie-derived browsing/behavioural data is regulated indirectly through APPI's 'individual related information' provision rule: a provider must confirm the recipient has obtained consent where the… [Profile →](/jurisdictions/japan/)[Brief](/reports/?t=entry&j=JP) [Jersey](/jurisdictions/jersey/) (JE) Europe Red No Jersey-specific cookie/ePrivacy transposition, direct-marketing consent rule, dark-pattern prohibition, opt-out-signal regime, clean-room rule, or cross-context-advertising rule was located. The… [Profile →](/jurisdictions/jersey/)[Brief](/reports/?t=entry&j=JE) [Kansas, USA](/jurisdictions/kansas-usa/) (US-KS) Americas Red Kansas has no cookie/tracker consent regime, no dark-pattern prohibition, no state-mandated recognition of opt-out signals (e.g., GPC), no clean-room/data-collaboration rules, and no… [Profile →](/jurisdictions/kansas-usa/)[Brief](/reports/?t=entry&j=US-KS) [Kazakhstan](/jurisdictions/kazakhstan/) (KZ) Asia-Pacific Red No confirmed cookie/tracker consent regime, dark-pattern prohibition, opt-out-signal recognition, clean-room framework, cross-context-advertising rule, or direct-marketing consent/suppression regime… [Profile →](/jurisdictions/kazakhstan/)[Brief](/reports/?t=entry&j=KZ) [Kentucky, USA](/jurisdictions/kentucky-usa/) (US-KY) Americas Amber The KCDPA's primary adtech-relevant lever is the opt-out right for targeted advertising and sale of personal data, paired with privacy-notice disclosure duties. Dark-patterns prohibition and… [Profile →](/jurisdictions/kentucky-usa/)[Brief](/reports/?t=entry&j=US-KY) [Kenya](/jurisdictions/kenya/) (KE) Africa Amber The General Regulations 2021 create a direct-marketing consent/opt-out regime: commercial use of data (including direct marketing) requires either that the data subject was informed at collection… [Profile →](/jurisdictions/kenya/)[Brief](/reports/?t=entry&j=KE) [Laos](/jurisdictions/laos/) (LA) Asia-Pacific Red No cookie/tracker consent regime, dark-pattern prohibition, recognised opt-out signal (GPC/DAA-equivalent), clean-room rule, cross-context-advertising rule, or direct-marketing consent/suppression… [Profile →](/jurisdictions/laos/)[Brief](/reports/?t=entry&j=LA) [Latin America bloc](/jurisdictions/latin-america-bloc/) (LATAM) Americas Red General cookie/tracker consent regimes, dark-pattern prohibitions, opt-out signals, clean-room rules, cross-context advertising and direct-marketing suppression were not evidenced at bloc level. The… [Profile →](/jurisdictions/latin-america-bloc/)[Brief](/reports/?t=entry&j=LATAM) [Latvia](/jurisdictions/latvia/) (LV) Europe Amber DVI has actively enforced cookie-consent standards, conducting a 2021-2022 preventive audit of 29 websites belonging to 26 large e-merchants that found none obtained appropriate consent, with three… [Profile →](/jurisdictions/latvia/)[Brief](/reports/?t=entry&j=LV) [Liechtenstein](/jurisdictions/liechtenstein/) (LI) Europe Amber Cookie/tracker consent follows the ePrivacy/GDPR baseline as applied by the DSS, which has issued updated cookie guidance. Dark-pattern prohibitions, opt-out signals (e.g., GPC), clean-room… [Profile →](/jurisdictions/liechtenstein/)[Brief](/reports/?t=entry&j=LI) [Lithuania](/jurisdictions/lithuania/) (LT) Europe Amber Cookie consent and direct-marketing rules follow GDPR/ePrivacy transposition. VDAI's Vinted enforcement establishes a precedent against non-transparent 'shadow blocking' practices analogous to dark… [Profile →](/jurisdictions/lithuania/)[Brief](/reports/?t=entry&j=LT) [Louisiana, USA](/jurisdictions/louisiana-usa/) (US-LA) Americas Amber The LDPA (effective 2027-01-01) includes universal opt-out mechanism support and opt-out rights for targeted advertising and sale of personal data: The bill, approved 94-0 by… [Profile →](/jurisdictions/louisiana-usa/)[Brief](/reports/?t=entry&j=US-LA) [Luxembourg](/jurisdictions/luxembourg/) (LU) Europe Amber CNPD's dedicated cookie guidelines address both consent architecture and dark patterns in banners; the Amazon decision independently evidences enforcement against cross-context/targeted-advertising… [Profile →](/jurisdictions/luxembourg/)[Brief](/reports/?t=entry&j=LU) [Maine, USA](/jurisdictions/maine-usa/) (US-ME) Americas Red Maine has no general cookie/tracker consent law, dark-pattern prohibition, opt-out-signal recognition mandate, clean-room regulation, or cross-context-advertising ('sale'/'share') regime. The only… [Profile →](/jurisdictions/maine-usa/)[Brief](/reports/?t=entry&j=US-ME) [Malaysia](/jurisdictions/malaysia/) (MY) Asia-Pacific Red No Malaysia-specific cookie/tracker consent regime, dark-pattern prohibition, opt-out-signal (GPC/DAA) recognition, clean-room rule, cross-context-advertising rule, or direct-marketing/Do-Not-Call… [Profile →](/jurisdictions/malaysia/)[Brief](/reports/?t=entry&j=MY) [Malta](/jurisdictions/malta/) (MT) Europe Amber Cookie/tracker consent is governed by the ePrivacy transposition (S.L. 586.01) with published IDPC cookie-consent guidance; the IDPC and UK ICO cooperate on cross-border unsolicited-marketing… [Profile →](/jurisdictions/malta/)[Brief](/reports/?t=entry&j=MT) [Marshall Islands](/jurisdictions/marshall-islands/) (MH) Asia-Pacific Red No cookie/tracker consent rule, dark-pattern prohibition, opt-out-signal recognition, clean-room rule, or direct-marketing consent/suppression regime exists in RMI law. Searched for an RMI… [Profile →](/jurisdictions/marshall-islands/)[Brief](/reports/?t=entry&j=MH) [Maryland, USA](/jurisdictions/maryland-usa/) (US-MD) Americas Amber MODPA's commercial-privacy provisions center on an under-18 targeted-advertising ban, an optional (not mandatory) universal opt-out mechanism, and an 'unambiguous affirmative action' consent standard… [Profile →](/jurisdictions/maryland-usa/)[Brief](/reports/?t=entry&j=US-MD) [Massachusetts, USA](/jurisdictions/massachusetts-usa/) (US-MA) Americas Red Massachusetts has no cookie-consent law, Global Privacy Control recognition statute, clean-room regulation, or CPRA-style 'sale'/'share' framework. The only MA-specific adtech-adjacent rule is the… [Profile →](/jurisdictions/massachusetts-usa/)[Brief](/reports/?t=entry&j=US-MA) [Mexico](/jurisdictions/mexico/) (MX) Americas Red Mexico's private-sector data protection law does not specifically address internet cookies or trackers, and no dedicated dark-pattern prohibition, opt-out-signal recognition (e.g., Global Privacy… [Profile →](/jurisdictions/mexico/)[Brief](/reports/?t=entry&j=MX) [Michigan, USA](/jurisdictions/michigan-usa/) (US-MI) Americas Amber Michigan has no state-level cookie-consent, opt-out-signal, clean-room, or cross-context-advertising ('sale'/'share') statute. FTC Section 5 enforcement against location-data brokers and adtech… [Profile →](/jurisdictions/michigan-usa/)[Brief](/reports/?t=entry&j=US-MI) [Minnesota, USA](/jurisdictions/minnesota-usa/) (US-MN) Americas Amber The MCDPA mandates honoring browser-based universal opt-out mechanisms (GPC-style signals) for targeted advertising and data-sale opt-out, and grants a direct consumer opt-out right for… [Profile →](/jurisdictions/minnesota-usa/)[Brief](/reports/?t=entry&j=US-MN) [Mississippi, USA](/jurisdictions/mississippi-usa/) (US-MS) Americas Red Mississippi has no state-specific cookie/tracker consent law, dark-pattern prohibition, opt-out-signal (e.g., GPC) recognition requirement, clean-room regulation, or 'sale'/'share'… [Profile →](/jurisdictions/mississippi-usa/)[Brief](/reports/?t=entry&j=US-MS) [Missouri, USA](/jurisdictions/missouri-usa/) (US-MO) Americas Red Missouri has no cookie/tracker consent law, no dark-patterns prohibition, no Global-Privacy-Control-style opt-out-signal recognition duty, no clean-room/data-collaboration rules, and no CPRA-style… [Profile →](/jurisdictions/missouri-usa/)[Brief](/reports/?t=entry&j=US-MO) [Montana, USA](/jurisdictions/montana-usa/) (US-MT) Americas Amber Montana recognises universal opt-out mechanisms (UOOM), with UOOM-related requirements in effect since January 1, 2025, alongside a direct consumer right to opt out of sale of personal data and use… [Profile →](/jurisdictions/montana-usa/)[Brief](/reports/?t=entry&j=US-MT) [Morocco](/jurisdictions/morocco/) (MA) Africa Red No sourced evidence was found of a Moroccan cookie/tracker consent regime, dark-pattern prohibition, opt-out-signal recognition (e.g. GPC), clean-room/data-collaboration rules… [Profile →](/jurisdictions/morocco/)[Brief](/reports/?t=entry&j=MA) [Mozambique](/jurisdictions/mozambique/) (MZ) Africa Red No cookie/tracker consent regime, dark-pattern prohibition, opt-out-signal recognition, clean-room rules, cross-context-advertising regime, or direct-marketing consent/suppression framework has been… [Profile →](/jurisdictions/mozambique/)[Brief](/reports/?t=entry&j=MZ) [Myanmar](/jurisdictions/myanmar/) (MM) Asia-Pacific Red No cookie/tracker consent regime, dark-pattern prohibition, opt-out-signal recognition, clean-room rule, cross-context-advertising regime, or direct-marketing consent/suppression framework was… [Profile →](/jurisdictions/myanmar/)[Brief](/reports/?t=entry&j=MM) [Nebraska, USA](/jurisdictions/nebraska-usa/) (US-NE) Americas Amber Nebraska requires businesses to honor universal opt-out mechanisms (UOOM) for sale and targeted-advertising opt-outs, a requirement already in effect since January 1, 2025. No separate cookie-consent… [Profile →](/jurisdictions/nebraska-usa/)[Brief](/reports/?t=entry&j=US-NE) [Nepal](/jurisdictions/nepal/) (NP) Asia-Pacific Red No cookie/tracker consent regime, dark-pattern prohibition, recognised opt-out signal, clean-room rules, cross-context-advertising regime, or direct-marketing consent/suppression framework was… [Profile →](/jurisdictions/nepal/)[Brief](/reports/?t=entry&j=NP) [Netherlands](/jurisdictions/netherlands/) (NL) Europe Amber The Telecommunicatiewet's cookie-consent rule requires prior, informed consent before storing or accessing information on a user's terminal equipment, applying technology-neutrally to all tracking… [Profile →](/jurisdictions/netherlands/)[Brief](/reports/?t=entry&j=NL) [Nevada, USA](/jurisdictions/nevada-usa/) (US-NV) Americas Amber Nevada's only adtech-relevant provision is SB 220's narrow opt-out-of-sale right, which uses a materially narrower definition of 'sale' than the CCPA/CPRA and requires a single 'designated request… [Profile →](/jurisdictions/nevada-usa/)[Brief](/reports/?t=entry&j=US-NV) [New Brunswick, Canada](/jurisdictions/new-brunswick-canada/) (CA-NB) Americas Red Evidence in this pass is limited to OPC guidance on deceptive design patterns ('dark patterns'). No NB/federal cookie-consent statute, opt-out-signal recognition regime (e.g., GPC), clean-room rules… [Profile →](/jurisdictions/new-brunswick-canada/)[Brief](/reports/?t=entry&j=CA-NB) [New Hampshire, USA](/jurisdictions/new-hampshire-usa/) (US-NH) Americas Green The NHDPA gives consumers a right to opt out of targeted advertising and sale of personal data, and requires controllers to provide an opt-out submission process; consumers may designate a third… [Profile →](/jurisdictions/new-hampshire-usa/)[Brief](/reports/?t=entry&j=US-NH) [New Jersey, USA](/jurisdictions/new-jersey-usa/) (US-NJ) Americas Green The NJDPL's principal adtech mechanism is a consumer opt-out right covering targeted advertising, sale of personal data, and — unusually among state laws — significant-effect profiling, reinforced by… [Profile →](/jurisdictions/new-jersey-usa/)[Brief](/reports/?t=entry&j=US-NJ) [New Mexico, USA](/jurisdictions/new-mexico-usa/) (US-NM) Americas Red New Mexico has no cookie/tracker consent law, dark-pattern prohibition, opt-out-signal mandate, clean-room regulation, cross-context-advertising 'sale'/'share' framework, or general direct-marketing… [Profile →](/jurisdictions/new-mexico-usa/)[Brief](/reports/?t=entry&j=US-NM) [New Zealand](/jurisdictions/new-zealand/) (NZ) Asia-Pacific Red No NZ-specific cookie/tracker consent regime, dark-pattern prohibition, recognised opt-out signal (e.g. GPC), clean-room framework, or CPRA-style 'sale/share' concept was identified; the general… [Profile →](/jurisdictions/new-zealand/)[Brief](/reports/?t=entry&j=NZ) [Nigeria](/jurisdictions/nigeria/) (NG) Africa Red The NDPA does not contain a dedicated ePrivacy-style cookie/tracker consent regime, dark-pattern prohibition, opt-out signal recognition, clean-room framework, or direct-marketing suppression rule… [Profile →](/jurisdictions/nigeria/)[Brief](/reports/?t=entry&j=NG) [North Carolina, USA](/jurisdictions/north-carolina-usa/) (US-NC) Americas Red North Carolina has no cookie/tracker consent law, dark-pattern prohibition, opt-out-signal recognition mandate, clean-room regulation, cross-context-advertising 'sale/share' regime, or… [Profile →](/jurisdictions/north-carolina-usa/)[Brief](/reports/?t=entry&j=US-NC) [North Dakota, USA](/jurisdictions/north-dakota-usa/) (US-ND) Americas Red North Dakota has no cookie/tracker consent statute, no dark-pattern prohibition, no recognition of opt-out signals (GPC/DAA), no clean-room regulation, and no CPRA-style 'sale'/'share'… [Profile →](/jurisdictions/north-dakota-usa/)[Brief](/reports/?t=entry&j=US-ND) [Norway](/jurisdictions/norway/) (NO) Europe Green Datatilsynet is a highly active regulator of adtech practices: it has fined multiple websites over unlawful tracking-pixel data sharing, imposed a temporary ban on Meta's behavioural advertising… [Profile →](/jurisdictions/norway/)[Brief](/reports/?t=entry&j=NO) [Ohio, USA](/jurisdictions/ohio-usa/) (US-OH) Americas Red Ohio has no cookie/tracker consent statute, dark-pattern prohibition, opt-out-signal mandate, clean-room regulation, cross-context-advertising 'sale/share' framework, or direct-marketing consent… [Profile →](/jurisdictions/ohio-usa/)[Brief](/reports/?t=entry&j=US-OH) [Oklahoma, USA](/jurisdictions/oklahoma-usa/) (US-OK) Americas Amber No Oklahoma cookie-consent law, dark-patterns prohibition, or clean-room regulation currently exists. SB 546 will introduce an opt-out right for targeted advertising and sale of personal data from 1… [Profile →](/jurisdictions/oklahoma-usa/)[Brief](/reports/?t=entry&j=US-OK) [Ontario, Canada](/jurisdictions/ontario-canada/) (CA-ON) Americas Amber Direct marketing/commercial electronic messaging is governed federally by CASL (jointly enforced by CRTC, OPC and Competition Bureau) requiring express or implied consent, sender identification and… [Profile →](/jurisdictions/ontario-canada/)[Brief](/reports/?t=entry&j=CA-ON) [Oregon, USA](/jurisdictions/oregon-usa/) (US-OR) Americas Amber OCPA requires recognition of universal opt-out mechanisms (e.g., Global Privacy Control) from January 1, 2026, prohibits dark-pattern consent practices implicitly, and gives consumers opt-out rights… [Profile →](/jurisdictions/oregon-usa/)[Brief](/reports/?t=entry&j=US-OR) [Pakistan](/jurisdictions/pakistan/) (PK) Asia-Pacific Red No cookie/tracker consent law, dark-pattern prohibition, opt-out-signal recognition (e.g., GPC), clean-room/data-collaboration rule, cross-context-advertising restriction, or direct-marketing… [Profile →](/jurisdictions/pakistan/)[Brief](/reports/?t=entry&j=PK) [Palau](/jurisdictions/palau/) (PW) Asia-Pacific Red No cookie/tracker consent regime, dark-pattern prohibition, opt-out-signal recognition, clean-room rule, or direct-marketing consent rule could be located for Palau. [Profile →](/jurisdictions/palau/)[Brief](/reports/?t=entry&j=PW) [Panama](/jurisdictions/panama/) (PA) Americas Red No cookie/tracker-consent regime, dark-pattern prohibition, opt-out-signal framework, clean-room rules, cross-context-advertising rules, or direct-marketing-specific suppression regime distinct from… [Profile →](/jurisdictions/panama/)[Brief](/reports/?t=entry&j=PA) [Pennsylvania, USA](/jurisdictions/pennsylvania-usa/) (US-PA) Americas Red Pennsylvania has no cookie/tracker consent law, dark-pattern prohibition, recognized opt-out signal regime, clean-room framework, or cross-context-advertising 'sale/share' concept of the CPRA type.… [Profile →](/jurisdictions/pennsylvania-usa/)[Brief](/reports/?t=entry&j=US-PA) [Peru](/jurisdictions/peru/) (PE) Americas Amber Direct-marketing/commercial-prospecting processing requires the data subject's direct, first-contact consent under the 2024 Reglamento, with fines from 5-50 UIT for marketing without consent and… [Profile →](/jurisdictions/peru/)[Brief](/reports/?t=entry&j=PE) [Philippines](/jurisdictions/philippines/) (PH) Asia-Pacific Amber NPC Advisory No. 2026-01 (issued April 13, 2026) is the most direct recent evidence in this module, addressing lawful scraping of publicly available personal data for commercial/adtech-adjacent uses.… [Profile →](/jurisdictions/philippines/)[Brief](/reports/?t=entry&j=PH) [Poland](/jurisdictions/poland/) (PL) Europe Amber Cookie and tracker consent in Poland follows the ePrivacy Directive framework as transposed into Polish Telecommunications Law, supplemented by UODO cookie guidance. UOKiK (the competition/consumer… [Profile →](/jurisdictions/poland/)[Brief](/reports/?t=entry&j=PL) [Portugal](/jurisdictions/portugal/) (PT) Europe Red No Portugal-specific cookie/tracker statute, dark-pattern prohibition, opt-out-signal recognition, clean-room rule, or cross-context-advertising rule distinct from general GDPR/ePrivacy was… [Profile →](/jurisdictions/portugal/)[Brief](/reports/?t=entry&j=PT) [Qatar](/jurisdictions/qatar/) (QA) Middle East Red Mainland Law 13/2016 prohibits sending direct electronic marketing messages without prior consent. No cookie/tracker-specific consent regime, dark-pattern prohibition, recognized opt-out signal… [Profile →](/jurisdictions/qatar/)[Brief](/reports/?t=entry&j=QA) [Quebec, Canada](/jurisdictions/quebec-canada/) (CA-QC) Americas Amber Privacy-by-default rules require deactivation of identification/location/profiling functions absent opt-in, and marketing/'prospection' uses require identity disclosure and consent-withdrawal rights.… [Profile →](/jurisdictions/quebec-canada/)[Brief](/reports/?t=entry&j=CA-QC) [Rhode Island, USA](/jurisdictions/rhode-island-usa/) (US-RI) Americas Amber RIDTPPA grants an opt-out right for targeted advertising and profiling but, notably, does NOT recognize universal opt-out mechanisms (e.g., Global Privacy Control) unlike Colorado, Connecticut, Texas… [Profile →](/jurisdictions/rhode-island-usa/)[Brief](/reports/?t=entry&j=US-RI) [Romania](/jurisdictions/romania/) (RO) Europe Amber Cookie/tracker consent in Romania follows the ePrivacy Directive as transposed by Law No. 506/2004, enforced by ANSPDCP with the same GDPR-aligned active-consent standard applied in the Microstockr… [Profile →](/jurisdictions/romania/)[Brief](/reports/?t=entry&j=RO) [Russia](/jurisdictions/russia/) (RU) Europe Amber Direct marketing is the best-evidenced adtech sub-area: Article 18 of the Law on Advertising, enforced by the Federal Antimonopoly Service (FAS Russia, a distinct authority from Roskomnadzor)… [Profile →](/jurisdictions/russia/)[Brief](/reports/?t=entry&j=RU) [Rwanda](/jurisdictions/rwanda/) (RW) Africa Red Beyond the general right-to-object provision covering direct marketing and related profiling (Article 24), no dedicated cookie/tracker consent regime, dark-pattern prohibition, recognized opt-out… [Profile →](/jurisdictions/rwanda/)[Brief](/reports/?t=entry&j=RW) [Saudi Arabia](/jurisdictions/saudi-arabia/) (SA) Middle East Amber The PDPL Implementing Regulation regulates direct marketing consent (Arts. 28-29), and marketing/promotional messaging without prior consent is among the most commonly cited SDAIA enforcement… [Profile →](/jurisdictions/saudi-arabia/)[Brief](/reports/?t=entry&j=SA) [Senegal](/jurisdictions/senegal/) (SN) Africa Red The CDP has issued a dedicated deliberation on the conditions for direct marketing (Deliberation No. 2014-20/CDP). No cookie-consent-specific regime, dark-pattern prohibition, recognised opt-out… [Profile →](/jurisdictions/senegal/)[Brief](/reports/?t=entry&j=SN) [Serbia](/jurisdictions/serbia/) (RS) Europe Red As of the Commissioner's 2016-2017 model-law consultation period, direct marketing, biometrics, video surveillance and internet data-security processing were identified by the Commissioner (citing… [Profile →](/jurisdictions/serbia/)[Brief](/reports/?t=entry&j=RS) [Seychelles](/jurisdictions/seychelles/) (SC) Africa Red No cookie/tracker-specific provision, dark-pattern prohibition, opt-out-signal regime, clean-room rule, or direct-marketing consent/suppression rule specific to Seychelles was identified. Searched… [Profile →](/jurisdictions/seychelles/)[Brief](/reports/?t=entry&j=SC) [Singapore](/jurisdictions/singapore/) (SG) Asia-Pacific Amber Direct marketing is governed by the PDPA's own DNC regime rather than a distinct ePrivacy statute. The Do Not Call (DNC) Registry helps individuals exercise the right to opt out of… [Profile →](/jurisdictions/singapore/)[Brief](/reports/?t=entry&j=SG) [Slovakia](/jurisdictions/slovakia/) (SK) Europe Red Cookie/tracker consent in Slovakia follows the EU ePrivacy Directive's consent requirement as implemented nationally, overlaid by GDPR consent standards where personal data are involved. No… [Profile →](/jurisdictions/slovakia/)[Brief](/reports/?t=entry&j=SK) [Slovenia](/jurisdictions/slovenia/) (SI) Europe Amber No Slovenia-specific adtech enforcement action (cookies/dark patterns/cross-context advertising) was identified in this research pass. Cookie and tracker consent is presumed governed by the national… [Profile →](/jurisdictions/slovenia/)[Brief](/reports/?t=entry&j=SI) [South Africa](/jurisdictions/south-africa/) (ZA) Africa Amber Only direct-marketing consent/suppression rules were substantively confirmed, via POPIA's Section 69-adjacent direct-marketing restrictions and the DMASA industry POPIA Code of Conduct.… [Profile →](/jurisdictions/south-africa/)[Brief](/reports/?t=entry&j=ZA) [South Carolina, USA](/jurisdictions/south-carolina-usa/) (US-SC) Americas Amber H.3431 prohibits dark patterns and targeted advertising directed at minors, with a private right of action for dark-pattern violations arising via the state's general consumer-protection statute. No… [Profile →](/jurisdictions/south-carolina-usa/)[Brief](/reports/?t=entry&j=US-SC) [South Dakota, USA](/jurisdictions/south-dakota-usa/) (US-SD) Americas Red South Dakota has not enacted state-level cookie/tracker consent, dark-pattern, opt-out-signal (e.g., GPC), clean-room, cross-context-advertising, or direct-marketing-specific privacy statutes.… [Profile →](/jurisdictions/south-dakota-usa/)[Brief](/reports/?t=entry&j=US-SD) [South Korea](/jurisdictions/south-korea/) (KR) Asia-Pacific Red Under the Network Act, senders of commercial advertising messages must obtain clear, specific consent to 'advertising information' (vague terms such as 'benefit notifications' are disallowed) and… [Profile →](/jurisdictions/south-korea/)[Brief](/reports/?t=entry&j=KR) [Spain](/jurisdictions/spain/) (ES) Europe Amber AEPD's Guía sobre el uso de las cookies (last major update aligning with EDPB Guidelines 03/2022 on deceptive patterns) governs cookie/tracker consent, mandating equal prominence for accept/reject… [Profile →](/jurisdictions/spain/)[Brief](/reports/?t=entry&j=ES) [Sri Lanka](/jurisdictions/sri-lanka/) (LK) Asia-Pacific Amber The PDPA's Part IV restricts the use of personal data for unsolicited direct-marketing messages; no cookie/tracker-specific consent regime, dark-pattern prohibition, recognised opt-out signal, or… [Profile →](/jurisdictions/sri-lanka/)[Brief](/reports/?t=entry&j=LK) [Sweden](/jurisdictions/sweden/) (SE) Europe Red Cookie/tracker consent is governed by LEK Ch.9 §28 (ePrivacy transposition) alongside GDPR. IMY has run structured audits of adtech tools (Google Analytics, Meta Pixel) resulting in multiple large… [Profile →](/jurisdictions/sweden/)[Brief](/reports/?t=entry&j=SE) [Switzerland](/jurisdictions/switzerland/) (CH) Europe Amber The FDPIC has issued cookie guidelines and has taken direct enforcement interest in dark-pattern-style consent practices, including an enforcement notice to a major Swiss e-commerce retailer (Digitec… [Profile →](/jurisdictions/switzerland/)[Brief](/reports/?t=entry&j=CH) [Taiwan](/jurisdictions/taiwan/) (TW) Asia-Pacific Red The PDPA contains a marketing-related restriction (allowing regulators to act against non-compliance with marketing restrictions), but no dedicated cookie/tracker consent regime, dark-pattern… [Profile →](/jurisdictions/taiwan/)[Brief](/reports/?t=entry&j=TW) [Tanzania](/jurisdictions/tanzania/) (TZ) Africa Red No qualifying source was located covering cookie/tracker consent rules, dark-pattern prohibitions, opt-out signal recognition, clean-room/data-collaboration rules, cross-context advertising, or… [Profile →](/jurisdictions/tanzania/)[Brief](/reports/?t=entry&j=TZ) [Tennessee, USA](/jurisdictions/tennessee-usa/) (US-TN) Americas Amber TIPA's principal adtech-relevant mechanism is the consumer opt-out right over targeted advertising and sale of personal data. No Tennessee-specific cookie-consent statute, dark-pattern prohibition… [Profile →](/jurisdictions/tennessee-usa/)[Brief](/reports/?t=entry&j=US-TN) [Texas, USA](/jurisdictions/texas-usa/) (US-TX) Americas Amber TDPSA requires recognition of universal opt-out mechanisms (effective Jan 1, 2025), includes dark-patterns provisions affecting the validity of consent, and grants opt-out rights for targeted… [Profile →](/jurisdictions/texas-usa/)[Brief](/reports/?t=entry&j=US-TX) [Thailand](/jurisdictions/thailand/) (TH) Asia-Pacific Amber Direct marketing is multi-regulator: direct-marketing activity in Thailand is governed by the Direct Sale and Direct Marketing Act B.E. 2545, the Consumer Protection Act… [Profile →](/jurisdictions/thailand/)[Brief](/reports/?t=entry&j=TH) [Trinidad and Tobago](/jurisdictions/trinidad-and-tobago/) (TT) Caribbean Red Section 42(a) and (b) of the DPA 2011 — the only Part IV-adjacent provisions proclaimed, on 23 August 2021 — is commonly associated with direct-marketing control in comparable Caribbean DPAs, but its… [Profile →](/jurisdictions/trinidad-and-tobago/)[Brief](/reports/?t=entry&j=TT) [Tunisia](/jurisdictions/tunisia/) (TN) Africa Red No cookie/tracker consent regime, dark-pattern prohibition, opt-out-signal recognition, clean-room rules, cross-context-advertising rules, or direct-marketing suppression regime specific to Tunisia… [Profile →](/jurisdictions/tunisia/)[Brief](/reports/?t=entry&j=TN) [Turkey](/jurisdictions/turkey/) (TR) Europe Red KVKK has issued cookie-related guidance and Turkey separately regulates commercial electronic messaging, but this run only retrieved title-level references (draft cookie guidelines, Commercial… [Profile →](/jurisdictions/turkey/)[Brief](/reports/?t=entry&j=TR) [Uganda](/jurisdictions/uganda/) (UG) Africa Red No dedicated cookie/tracker consent regime, dark-pattern prohibition, recognised opt-out signal (e.g., GPC/DAA equivalent), clean-room/data-collaboration rule, cross-context-advertising concept, or… [Profile →](/jurisdictions/uganda/)[Brief](/reports/?t=entry&j=UG) [Ukraine](/jurisdictions/ukraine/) (UA) Europe Red No confirmed cookie-consent, dark-pattern, opt-out-signal, data-clean-room, cross-context-advertising, or direct-marketing-specific statutory provisions were identified for Ukraine in this research… [Profile →](/jurisdictions/ukraine/)[Brief](/reports/?t=entry&j=UA) [United Arab Emirates](/jurisdictions/united-arab-emirates/) (AE) Middle East Red No AE-specific cookie/tracker consent regime, dark-pattern prohibition, Global-Privacy-Control-style opt-out recognition, clean-room rule, or direct-marketing-specific consent/suppression regime was… [Profile →](/jurisdictions/united-arab-emirates/)[Brief](/reports/?t=entry&j=AE) [United Kingdom](/jurisdictions/united-kingdom/) Expert reviewed (UK) Europe Amber PECR governs cookie consent, with DUAA-inserted exceptions; the ICO has historically found legitimate-interest justifications for real-time-bidding (RTB) adtech insufficient. The Children's code… [Profile →](/jurisdictions/united-kingdom/)[Brief](/reports/?t=entry&j=UK) [United States](/jurisdictions/united-states/) (US) Americas Amber Cookie/tracker, dark-pattern, and opt-out-signal obligations are driven almost entirely by state comprehensive privacy law (principally CCPA) rather than a federal ePrivacy analogue. California's… [Profile →](/jurisdictions/united-states/)[Brief](/reports/?t=entry&j=US) [United States — California](/jurisdictions/united-states-california/) (US-CA) Americas Amber California is the most developed U.S. state jurisdiction for adtech-adjacent privacy rules: the CCPA/CPRA's 'sale' and 'share' definitions specifically capture cross-context behavioral advertising… [Profile →](/jurisdictions/united-states-california/)[Brief](/reports/?t=entry&j=US-CA) [United States — New York](/jurisdictions/united-states-new-york/) (US-NY) Americas Red New York has no CPRA-style 'sale'/'share' framework, no state cookie-consent statute, and no codified dark-pattern prohibition or Global Privacy Control recognition requirement. Adtech-adjacent… [Profile →](/jurisdictions/united-states-new-york/)[Brief](/reports/?t=entry&j=US-NY) [Uruguay](/jurisdictions/uruguay/) (UY) Americas Red No dedicated cookie/tracker consent regime, dark-pattern prohibition, opt-out signal recognition, clean-room rule, cross-context-advertising rule, or direct-marketing-specific suppression regime was… [Profile →](/jurisdictions/uruguay/)[Brief](/reports/?t=entry&j=UY) [Utah, USA](/jurisdictions/utah-usa/) (US-UT) Americas Amber The UCPA's adtech/commercial-privacy toolkit is limited to a notice-and-opt-out right for sale and targeted advertising, using a narrow monetary-only definition of 'sale.' The Act does not mandate… [Profile →](/jurisdictions/utah-usa/)[Brief](/reports/?t=entry&j=US-UT) [Vanuatu](/jurisdictions/vanuatu/) (VU) Asia-Pacific Red No cookie/tracker consent regime, dark-pattern prohibition, opt-out-signal recognition, clean-room rule, or direct-marketing consent rule specific to Vanuatu could be sourced. Searches run: 'Vanuatu… [Profile →](/jurisdictions/vanuatu/)[Brief](/reports/?t=entry&j=VU) [Venezuela](/jurisdictions/venezuela/) (VE) Americas Red No cookie/tracker consent regime, dark-pattern prohibition, recognised opt-out signal, clean-room rule, cross-context-advertising rule, or direct-marketing consent/suppression regime was located in… [Profile →](/jurisdictions/venezuela/)[Brief](/reports/?t=entry&j=VE) [Vermont, USA](/jurisdictions/vermont-usa/) (US-VT) Americas Amber S.71 introduces opt-out-signal recognition and cross-context-advertising opt-outs effective 2028; no dedicated Vermont cookie-consent, dark-pattern, clean-room, or direct-marketing statute was… [Profile →](/jurisdictions/vermont-usa/)[Brief](/reports/?t=entry&j=US-VT) [Vietnam](/jurisdictions/vietnam/) (VN) Asia-Pacific Red The PDPL restricts personal-data processing for marketing/advertising purposes and prohibits unauthorised buying/selling of personal information. No dedicated cookie/ePrivacy-style consent regime… [Profile →](/jurisdictions/vietnam/)[Brief](/reports/?t=entry&j=VN) [Virginia, USA](/jurisdictions/virginia-usa/) (US-VA) Americas Amber The VCDPA regulates commercial data use primarily through opt-out rights covering targeted advertising, the narrowly-defined monetary 'sale' of personal data, and significant-effect profiling, rather… [Profile →](/jurisdictions/virginia-usa/)[Brief](/reports/?t=entry&j=US-VA) [Washington State, USA](/jurisdictions/washington-state-usa/) (US-WA) Americas Amber Washington has no dedicated cookie-consent, dark-pattern, opt-out-signal, or clean-room statute. MHMDA's broad 'sell' definition indirectly reaches health-data monetization via third-party… [Profile →](/jurisdictions/washington-state-usa/)[Brief](/reports/?t=entry&j=US-WA) [West Virginia, USA](/jurisdictions/west-virginia-usa/) (US-WV) Americas Red West Virginia has no cookie/tracker consent statute, no recognition of universal opt-out signals (e.g., Global Privacy Control), no dark-pattern prohibition, and no CPRA-style 'sale'/'share' opt-out… [Profile →](/jurisdictions/west-virginia-usa/)[Brief](/reports/?t=entry&j=US-WV) [Wisconsin, USA](/jurisdictions/wisconsin-usa/) (US-WI) Americas Red Wisconsin has no state-specific cookie/tracker, dark-pattern, opt-out-signal, clean-room, cross-context-advertising, or 'sale'/'share' regime. Online tracking and marketing practices affecting… [Profile →](/jurisdictions/wisconsin-usa/)[Brief](/reports/?t=entry&j=US-WI) [Wyoming, USA](/jurisdictions/wyoming-usa/) (US-WY) Americas Red Wyoming has no state-level cookie/tracker consent regime, dark-pattern prohibition, opt-out-signal recognition mandate, clean-room regulation, or 'sale'/'share' cross-context-advertising restriction.… [Profile →](/jurisdictions/wyoming-usa/)[Brief](/reports/?t=entry&j=US-WY) [Zambia](/jurisdictions/zambia/) (ZM) Africa Red No T1/T2 or credible T3 material on cookie/tracker consent rules, dark-pattern prohibitions, opt-out signals, clean-room/DCR rules, cross-context advertising, or direct-marketing consent/suppression… [Profile →](/jurisdictions/zambia/)[Brief](/reports/?t=entry&j=ZM)