Analytics privacy compliance, mapped across 36 countries and 16 laws.

M.K. · 7 May 2026

Editorial reading as of 2026-05-07 — not legal advice. GDPR-style omnibus laws are not cookie laws. Most regimes here address data subject access in some form, but a clear opt-in posture for non-essential cookies sits primarily in the EU/UK ePrivacy stack (the ePrivacy Directive plus its national implementations such as PECR) read alongside GDPR/UK GDPR consent standards. Outside Europe, Quebec's Law 25 reads as the only North American statute requiring affirmative opt-in for tracking technologies, and South Korea's PIPC has consistently treated identifiable / behavioural cookies as personal information requiring prior, specific consent under PIPA. Several other regimes regulate cookies indirectly via general consent principles, deemed-consent constructs (e.g. Singapore PDPA), or sector-specific telecoms statutes (e.g. Switzerland's FMG Art. 45c, which uses a transparency / opt-out model) rather than a dedicated cookie opt-in rule. Conflating GDPR-style omnibus rules with cookie rules is the most expensive consent-banner mistake we see in compliance reviews.

M.K. · 7 May 2026

Editorial reading as of 2026-05-07 — not legal advice. Two of the topics on this page are not statutory in origin. Google Consent Mode v2 and the Certified-CMP requirement operate as Google contractual policy obligations layered on top of GDPR / ePrivacy consent — the underlying consent regime is statutory, but the Google signal protocol and CMP-certification step are not themselves written into the law. They do not replace statutory consent, and dropping the Google ad stack does not make a statutory opt-in obligation go away. We surface them as topics because they regularly come up in compliance reviews.

M.K. · 6 May 2026

Editorial reading as of 2026-05-06 — not legal advice. The Conditional column is doing real work. Take PIPEDA's accountability principle as the canonical example: it requires every organisation to designate an individual accountable for compliance (Schedule 1, Principle 4.1.1), so on a 'is there a DPO?' yes/no test it ticks the box — but the statute does not articulate the statutory powers, formal training mandates, or independence guarantees that GDPR Articles 37–39 spell out for the DPO role. We mark it Conditional rather than Yes for that reason. Treat Conditional as: you still need the function; the legal scaffolding is thinner — and qualified counsel should map it to your facts.