One platform, every privacy law you operate under

The EU's baseline privacy law. It requires a lawful basis for processing personal data, and for cookies and trackers that means freely given, specific, informed and unambiguous prior consent.

The UK's post-Brexit version of GDPR, read together with PECR for cookies. The consent standard mirrors the EU, enforced by the ICO.

California's privacy law gives consumers the right to opt out of the sale or sharing of their personal information, including through the Global Privacy Control signal.

Virginia's privacy law lets consumers opt out of targeted advertising, the sale of personal data and certain profiling, and requires opt-in consent for sensitive data.

The Colorado Privacy Act gives consumers opt-out rights for targeted advertising, sale and profiling, requires opt-in for sensitive data, and mandates recognition of a universal opt-out mechanism.

Connecticut's data privacy act mirrors the Virginia and Colorado model: opt-out of targeted advertising, sale and profiling, opt-in for sensitive data, and recognition of universal opt-out signals.

Utah's privacy law is more business-friendly but still gives consumers the right to opt out of targeted advertising and the sale of personal data, with notice for sensitive data.

Texas's comprehensive privacy law gives opt-out rights for targeted advertising, sale and profiling, requires opt-in for sensitive data, and recognizes universal opt-out signals, with no revenue threshold.

Oregon's consumer privacy act provides opt-out rights for targeted advertising, sale and profiling, opt-in for sensitive data, and recognition of universal opt-out mechanisms.

Montana's privacy law follows the opt-out model with lower applicability thresholds, requiring opt-in for sensitive data and recognition of universal opt-out signals.

Florida's Digital Bill of Rights targets large technology companies, giving opt-out rights for targeted advertising, sale and profiling and opt-in for sensitive data.

Brazil's general data protection law, closely modeled on GDPR, requiring a legal basis such as consent for processing personal data.

Canada's federal private-sector privacy law, based on meaningful consent and the reasonable expectations of the individual.

India's first comprehensive data protection law. It is built around clear, itemized notice and verifiable consent, with strong protections for children.

Personal Data Protection Acts in markets such as Singapore and Thailand require consent and clear notification before collecting and using personal data.

South Africa's data protection law sets conditions for lawful processing of personal information, including consent and purpose limitation.