Legal questions

On the Laws covered page, or in WordPress on the Laws page of Cookie Rocks.

Laws covered lists the cookie rules of 248 jurisdictions, in plain words. Each sheet links to the official texts, and to the authority in charge where there is one.

On the Laws page in WordPress, the countries of your site come first. The others are grouped by region and folded: Rules common to the European Union, Countries of the European Union and the EEA, Europe outside the European Union, Americas, Asia, Middle East, Africa and Oceania. The US states are grouped under one United States line. The Find a country field opens the regions that match.

Where a country has rules of its own in some regions, its sheet has a Regional rules line.

They are the three regimes a sheet can name. Each says what the law asks before a cookie that is not necessary may be set.

• Ask first (prior consent): cookies that are not strictly necessary wait until the visitor consents.
• Opt-out: cookies may run from the first visit, but the visitor must be told and be able to opt out at any time.
• Notice only: no prior consent rule; the site must tell visitors clearly what it uses and why.

Asking for consent first is allowed everywhere.

Those of your answers on the Obligations page: Where is the site owner based? and Who are your visitors?

• Tick a country only if you address its residents. A language alone does not count. Prices in its currency, delivery there, a local domain or ads aimed there do.
• United States covers every US sheet. To address some states only, tick them under United States: only some states.
• Another country of the European Union counts as the rules common to the European Union.
• As soon as one country of the European Union or the EEA is involved, the rules common to the European Union are added.
• Under Whole regions of the world, a ticked region counts every sheet of that region. All regions ticks them all: for the checks of the banner, every sheet then counts.

When several countries apply, the strictest rule counts. If you change your countries, the checks and the options offered change too.

Yes. They come with each version of the plugin, and the legal watch can update them between two versions.

Once a day, Cookie Rocks reads two lists signed by its legal watch, on feed.cookierocks.com: the alerts that concern your countries and your cookies, and the law fact sheets.

Nothing about your visitors is sent. The request only carries your server’s IP address and an access token shared by every copy of the Audit. With Cookie Rocks Pro, the token is your licence key.

To turn this reading off, untick Tell me when a law or a cookie tool used on this site changes, under Law updates on the Obligations page. Cookie Rocks then uses the sheets of its own version.

Usually 6 months, within the limits of your countries.

Some authorities set a maximum, others a minimum before asking again. The Audit compares the choice duration of your banner with these limits. On the Consent page, Choice kept for shows the duration and what your countries ask for. It says Not readable from your site when the Audit cannot read it: check it in your banner’s settings.

For a country of the European Union without a duration of its own, the point of the Overview says that the law sets none, and that 6 to 12 months is the usual practice of European authorities.

In many countries, yes. The Audit reads the buttons of your banner on your home page.

When one of your countries requires buttons of equal weight and your banner does not have them, the Overview lists it under To fix. When your countries only recommend it, the Overview does not list it. Banners that mislead visitors remain banned in many countries, even where button colour is not regulated.

Yes, at any time. Many countries expect a button or link on every page to change the choice.

When one of your countries requires it and none was found on your home page, the Overview lists it under To fix. Add the “Manage cookies” link of your banner to your footer.

It is a signal sent by some browsers. It asks sites not to sell or share the visitor’s data. Several US states require sites to honour it.

When you address the United States, the Audit checks it state by state. If your banner ignores it, the Overview names the states of your visitors that require it, in a red Alert at the top of the list. If none requires it, it says that honouring it is simple and safe.

Only if your business sells or shares personal data and passes the thresholds of the law of some US states.

When one of your US states requires the Global Privacy Control signal and your site uses marketing cookies, the Obligations page shows the point United States: a “Do Not Sell or Share” link. Those states ask for a “Do Not Sell or Share My Personal Information” link on every page, usually in the footer.

Step by step: Get ready for visitors from the United States.

Not with the Audit. It works from the countries you chose, not from the visitor’s location. The strictest rule of your countries applies to every visitor.

In a few countries, under conditions. Never with Google Analytics.

The tool must be set up to count visits to this site only, without following visitors elsewhere: never shared, a shortened IP address. Visitors must be told and able to object. No authority approves a tool by name: the conditions apply to how the tool is set up.

Only where the law asks for information and a way to refuse, and only if you do not address visitors from the European Union or the United States.

Authorities disagree. Check what the authority of your country says.

The French authority, the CNIL, asks for consent when Google reuses the data, and an Austrian court did too.

Not with Cookie Rocks.

To show personalised Google ads in the EEA, the United Kingdom and Switzerland, Google requires a certified consent tool that supports the IAB TCF. Cookie Rocks is not certified. On such a site, use Google’s own consent message or a certified tool.

The Obligations page says so when you answer Media with advertising (AdSense…) to What kind of site?

It depends on your banner.

On the Consent page, Record of the choices says whether your banner keeps the choices on your site. If it says None on your site, you cannot show who consented to what, and when, if an authority asks.

It does not change the cookie rules. It matters for your other data.

It decides how data may be sent abroad from your country, and whether the countries you address require their residents’ data to stay on their territory. Your privacy policy must say where the site is hosted. The Obligations page says what to do.

Sometimes more than cookies. The Obligations page lists it, when it applies to your countries.

For example: where your site is hosted and how data may be sent abroad, data that must stay in a country, a local representative, how long to keep proofs of consent, the accessibility of the site, and chat or AI tools on your pages.