Privacy regulations and cookie consent
These pages explain, one regulation at a time, what the law asks of your website's cookies and trackers, how ConnectWiz cookie consent handles it, and what is still yours to do.
These pages describe the law as we understand it on 5 November 2026 and how ConnectWiz behaves. They are not legal advice, and using ConnectWiz does not by itself make a website compliant: your privacy notice, the tags you add, what you do with the data and your contracts with providers are yours. When in doubt, ask a lawyer who knows your market.
Three models
Regulations fall into three ways of handling cookies:
| Model | What the visitor sees | Where |
|---|---|---|
| Consent first (opt-in) | Nothing that is not strictly necessary runs until the visitor says yes; refusing is as easy as accepting. | EU/EEA, UK, Switzerland, Türkiye, Québec; Brazil for advertising cookies |
| Notice and opt-out | Tracking may run; the visitor is told and can opt out of the "sale" or "sharing" of personal data, and a browser's opt-out signal counts. | US state laws (California and the others) |
| Notice only | A cookie policy, no banner required. | Places without a cookie rule |
ConnectWiz starts every site on the strictest model: everything is denied, everywhere, until the visitor chooses. You can open other regions with region rules and give US visitors the opt-out model. Türkiye, the EU/EEA, the United Kingdom and Switzerland can never be opened.
What ConnectWiz does on every site
- Equal choices. Accept all, Reject all and Preferences, drawn alike, on the first layer; no box is pre-ticked; no cookie wall.
- Before any tag. The consent defaults are set in the first lines of your page, before Google, Meta, Microsoft or any other tag runs.
- Withdrawal. A cookie button on every page reopens the choice; withdrawing deletes the known cookies of the withdrawn category.
- Proof. Every choice is recorded: consent id, banner version, categories, page, language, time, country, a shortened IP with a keyed hash and the device type. See The consent records.
- Global Privacy Control is honoured everywhere.
- Your cookie list stays current: scans every week and every month, and a live cookie declaration for your cookie policy page.
The regulations
| Page | In short |
|---|---|
| GDPR and ePrivacy (EU, UK) | Consent before non-essential cookies; reject on the first layer; proof; the UK's new 2026 exceptions |
| KVKK (Türkiye) | Explicit consent for non-essential cookies; equal buttons; notice kept apart from consent |
| US state privacy laws | Notice, "Do not sell or share", Global Privacy Control, IAB GPP |
| Québec Law 25 | Tracking functions off by default |
| LGPD (Brazil) | Consent or legitimate interest per cookie type; reject on the first layer |
| Google Consent Mode and the DMA | What Google asks of advertisers in the EEA, UK and Switzerland |
| Amazon Consent Signal | What Amazon Ads asks for UK and EEA data |
| IAB TCF | Not supported yet; what to do if you need it |