Rules by country

Written for Cookie Rocks 2.11.2, checked on 7 November 2026.

What this screen is for. The Rules by country screen comes with Cookie Rocks Pro. It has one setting: Adapt the banner to each visitor’s country. Turn it on, and each visitor gets the rules that apply to them, for the whole world. Everything is worked out from the law sheets. It is off by default: every visitor then gets the same rules, the strictest of the countries of your site.

Cookie Rocks Audit has no such screen. When you use another cookie banner, the row Banner by visitor country on the Consent screen says whether that banner changes with the visitor’s country.

What to do here

1. Check that the Obligations screen knows Where is the site owner based? The screen asks for it: “Tell us where your site is established: the laws of that country may apply to all your visitors.”
2. Tick Adapt the banner to each visitor’s country.
3. Under Where the country comes from, choose the card marked Recommended here: My CDN or my host gives it, or A country database on this server.
4. Click Save Changes. The source is checked on its own. Wait for Source verified.

Turning this setting on or off asks every visitor again: a choice made before may have been made under other rules. The appearance, the texts and the cookie button stay the same for everyone: nothing to set twice.

To see which banner a visitor gets, try the simulator on One setting, the whole world.

The rules each visitor gets

The screen says what the setting does for your site. It depends on the country where the site is established.

Your site is established in	What the screen says
A country that asks for consent first and whose law applies wherever the visitor is, such as the European Union, the EEA, the United Kingdom or Brazil	“Your site is established in [country], so the rules of [country] apply to every visitor, wherever they are: consent first.”
Another country, outside the United States	“Your site is established in [country]: its rules apply to every visitor, together with each visitor’s own law.”
The United States	“Each visitor gets the rules of their own country.” The laws of the US states protect their residents, so they do not add to the law of a visitor from elsewhere.
Not answered yet	“Tell us where your site is established: the laws of that country may apply to all your visitors.” The main box stays disabled until you answer.

When two laws apply, the stricter of the two applies, point by point: the kind of banner and how long a choice lasts. How long a refusal lasts follows the visitor’s own law. The rules by country only add what each visitor’s law asks on top, never less.

The part What your visitors get sums it up for your site, with one card per kind of banner: Asked first, Informed, free to refuse and United States, or Every visitor is asked first. Each card shows the buttons and the number of countries and states. It names the first four, and and N more unfolds the others in place. Each country leads to its law sheet.

On a site that is not established in a consent-first country:

Visitor from	They get
A country that asks for consent first	Consent first: only strictly necessary cookies run before they consent.
A country that lets visitors opt out, or only asks to inform them	A banner that informs: cookies work until they refuse, and “Reject all” is always there.
The United States	The same, with the “Do Not Sell or Share” link, and two equal buttons in the states that have a privacy law. The Global Privacy Control signal counts for every browser that sends it.
Country not known, or source not verified	The strict rules: consent first.

Some laws also ask for more, and Cookie Rocks adds it: a minimum duration for a refusal (12 months in Denmark, for example), or a refusal renewed at each visit in Colorado, where the banner never asks again by itself.

What some laws add lists these rules, each with its countries and a pill. Handled by Cookie Rocks means the setting takes care of it. Yours to check means it depends on your settings or your site.

Below, the screen says: “Every country is covered. If geolocation fails, the strict rules apply.” Each country has a law sheet, 248 in all. A country can be moved to the strict rules under Advanced, never the other way: the law sets the floor.

How the rules are worked out from the law sheets

Each law sheet has a regime: Ask first (prior consent), Opt-out or Notice only. Ask first gives the consent-first banner. Opt-out and Notice only give the banner that informs. A country or state without a law sheet gets the strict rules.

• United States. A visitor whose state is not known gets the rules of California, the strictest state. A visitor from a state without its own law sheet gets the sheet of the other states.
• Canada. A province with its own law sheet, such as Québec, gets its own rules. The other provinces get the rules of Canada.
• Territories. 32 territories without a law sheet of their own follow the law that applies there: Réunion follows France, Guam the US states without a comprehensive law, the Falkland Islands the United Kingdom.
• Unknown country. The special values of CDNs (country unknown, Tor network) give the strict rules.

When the law sheets change, the rules follow on their own. If a country or state changes, the list of events on the Overview says so: “Rules by country updated after a change in the law sheets: …”, with See the rules by country.

What changes for a visitor who may opt out

• Preferences, statistics and marketing are on until the visitor refuses them. On a site aimed at children, only preferences are: marketing and statistics stay off.
• The choice lasts at most what the visitor’s country and the country of your site allow. See The choice duration below.

With the setting on, Information mode on the Consent screen does not apply to the whole site: the rules of each visitor decide. Exempt audience measurement, until the visitor objects is offered according to the country where your site is established, and applies only to visitors from countries that allow it. Others are asked first, and the tool starts when they agree. A site in France with Matomo set up for it: a visitor from Brazil is measured until they object. A visitor from Germany is asked first.

The language of the banner

Show the banner in the visitor’s browser language is on this screen too. The banner then speaks the language of the visitor’s browser, even when your site has no version in that language; otherwise it uses the language of the page. It works with any language Cookie Rocks speaks. It helps a site that targets the whole EU without all its languages.

Where the country comes from

Cookie Rocks finds the visitor’s country on your server or through your CDN, never through a third party. The IP address is never kept, and the country is kept only in the proof of a choice made under the opt-out rules. Only the chosen source is believed, and only once verified.

The screen looks at what is in front of your site, and shows three cards: My CDN or my host gives it, A country database on this server and Advanced setting, for developers. The card that fits your site is marked Recommended here.

Source (label on the screen)	Kind	US state
Cloudflare (header CF-IPCountry, every plan)	CDN header, checked on every visit	Yes, when Cloudflare sends it
Bunny CDN (header CDN-RequestCountryCode)	CDN header	Yes, when Bunny sends it
Pantheon (header Pantheon-Geo)	CDN header	No: visitors from the United States get the rules of California
Cloudways (header X-Forwarded-Country)	CDN header	No: visitors from the United States get the rules of California
LiteSpeed, Hostinger (variable GEOIP_COUNTRY_CODE)	Server variable	Yes, when the server sets it
Kinsta (variable GEOIP_COUNTRY_CODE)	Server variable	Yes, when the server sets it
WP Engine GeoTarget (variable HTTP_GEOIP_COUNTRY_CODE)	Variable verified like a header	Yes, when the server sets it
WordPress VIP (variable GEOIP_COUNTRY_CODE)	Server variable	Yes, when the server sets it
A header or server variable of my own	Header, verified like a CDN	With Name of the state header (optional)
The cr_country cookie	Cookie of your own	Yes, in the form US-TX
A country database on this server	Database on your server	No: visitors from the United States get the rules of California

Next to each source, a mark shows what Cookie Rocks sees on your own visit to the screen: seen on this request with the value (for example FR), or not seen on this request for the chosen source. The country database shows its own state instead.

Whatever the source, a visitor from the United States whose state is not known gets the rules of California.

A header of your own, and the cr_country cookie

A header or server variable of my own is for a CDN or a server that is not in the list (Fastly, Nginx, Varnish). Fill in Name of the country header (for example X-Country-Code), with the two-letter code of the country, and, if you have one, Name of the state header (optional) (for example X-Region-Code). A server variable that starts with GEOIP_ works too. These two fields are read only for this source.

The cr_country cookie: your server or CDN sets a session cookie named cr_country, holding only the country (FR) or the state (US-TX). It must be first-party, Secure, SameSite=Lax, with no other use. Cookie Rocks reads it without any request, and lists it in the cookie policy as a session cookie.

Verification

The check runs on its own when you save, and the Verification section gives the result. Verify again runs it at any time. It checks two things, with two requests the site sends to itself:

1. Whether the geo file of the plugin answers. If your host blocks it, a route of the WordPress REST API answers instead.
2. For a header, whether a visitor could forge it. The site sends itself a request with a forged country header. If your CDN rewrites it, a visitor cannot forge the country: the source is verified.

A server variable, a cookie of your own and the country database cannot be forged, so the check always passes: the screen says Source verified, or Source trusted before the first check. The daily check of Cookie Rocks verifies the source again. The last line says when: “Last check: … Checked again every day.”

Changing the source, or the name of a header, cancels the verification: every visitor gets the strict rules until the new check has passed.

What the Verification section says, case by case

Mark	What it means	What to do
Geo file reachable	The country is answered by a file of the plugin, without loading WordPress: a few milliseconds.	Nothing.
Geo file blocked: REST route used	Your host does not let the plugin file answer. The REST route answers instead, a few milliseconds slower.	Nothing. The Overview shows it as information.
Source verified	The forged header came back rewritten by your CDN, or the source cannot be forged.	Nothing.
Source verified, with a note about your origin (Cloudflare)	Your request carries the marks of Cloudflare, checked again on every visit. A visitor who reaches your origin directly gets the strict rules.	You may restrict access to your origin to the addresses of Cloudflare.
Header not seen	The forged request got no country back: this source does not seem to be in front of the site.	Check the setting of your CDN, then verify again.
Header can be forged	The forged header came back unchanged: the site answers without going through your CDN. Every visitor gets the strict rules.	Restrict access to your origin to the addresses of your CDN, then verify again.
Your host hides Cloudflare	Your host replaces the address of Cloudflare with the visitor’s address. Cookie Rocks cannot tell a request through Cloudflare from a forged one. Every visitor gets the strict rules.	In Cloudflare, add the rule given on the screen (Rules, Transform Rules, Modify Request Header), then verify again. Or choose the country database.
Check did not complete	Your site could not reach itself. This often happens for a few minutes after a change of DNS servers. Nothing was changed.	Try again in a few minutes.
Not verified yet	No check yet. Every visitor gets the strict rules.	Click Verify again.

After a click on Verify again, the result shows in this section.

The verification of a header lasts 8 days. The daily check renews it. A failed daily check does not remove a verification that worked: only a failed click on Verify again does. If the source stays unverified for 8 days, every visitor gets the strict rules.

Cloudflare is checked on every visit too: a country header counts only on a request that carries the mark of Cloudflare and comes from one of its addresses. The rule for a host that hides Cloudflare adds a secret header, X-CR-Origin, with a value shown on the screen. Keep this value private: it proves that a request came through Cloudflare.

The country database

The country database is for a site without a CDN or server geolocation. It is a free database (DB-IP lite, about 8 MB), downloaded from Cookie Rocks. The visitor’s address is looked up on your server only, and never kept. It gives the country only, no US state: visitors from the United States get the rules of California.

When it is the chosen source, the Country database section shows its state, with a Download now or Update now button. A bar follows the three steps: Request to Cookie Rocks, Download and Signature check. You can leave the page: the download goes on, and nothing needs reloading.

Mark	What it means
Not downloaded yet	Downloaded when you open this screen, by the daily check, or with Download now. Until then, every visitor gets the strict rules.
Present: edition of (date), downloaded on (date), and its size	Checked and refreshed by the daily check. The rules by country work.
More than 3 months old	Every visitor gets the strict rules until it is updated.
Last attempt failed	With the reason, for example that Cookie Rocks did not answer. The daily check tries again.

Updates, signature and licence of the database

• The database is downloaded only when the setting is on and the database is the chosen source. It is removed when you turn the setting off or choose another source.
• The daily check downloads a fresh copy when the one on your site is more than 30 days old. Cookie Rocks believes an edition for 90 days at most: after that, the strict rules apply.
• Your site talks only to Cookie Rocks. It checks the signature of the list published by Cookie Rocks, then the size and the checksum of the file. A file that does not match is not installed, and the reason shows under Last attempt failed.
• The file is kept in the uploads folder of your site, under cookie-rocks/geo/.
• Licence: DB-IP lite country database, under CC BY 4.0, as republished by the ip-location-db project, copied and signed by Cookie Rocks each month. The licence asks for a credit. Cookie Rocks shows it on this screen, with the link IP Geolocation by DB-IP, and in the file THIRD-PARTY.txt of the plugin. Never on the banner, and not in the cookie policy: the database runs on your server only.

A site behind a reverse proxy that hides the visitor’s address gets the strict rules with this source: the address seen is not the visitor’s.

Advanced

Advanced: move a country to the strict rules, discreet banner, texts of each group of countries is folded. It is rarely useful: the rules already follow the law of each country.

On a site where every visitor gets the strict rules, only the settings of the consent-first banner show.

Setting	What it does
Discreet banner for visitors whose law lets them opt out	A small box in a corner, with OK and Reject all side by side. Everywhere else, the banner keeps the shape chosen on the Appearance page.
Texts of the consent-first banner, Texts of the opt-out banner	Banner title, Banner sentence, Reject button, Accept button, Choose button, Details title, Details sentence, Save button. One set per language of the site.
Cookie button after the choice, for each banner	Same as the site, or Hidden: your pages have their own Manage cookies link.
Countries and states that let visitors opt out	Tick Apply the strict rules anyway to give a country or state the strict rules. Never the other way: the law sets the floor. Moving a country or state asks every visitor again.

Texts and cookie button: the rules

An empty text field keeps the text the banner shows, in grey. Keep “Reject all” as clear as “Accept all”: you can change the words, not the balance the law requires. Your text may leave out the word “reject” as long as the Reject all button stays on the banner. Do not write that using the site means agreeing. Say what the cookies do before the choice (ads, measurement), without playing it down.

Without the cookie button, keep a Cookie settings link elsewhere on the site, for example in the footer: visitors must be able to change their choice at any time. Under the strict rules, the button can be hidden only once such a link is found on your home page. Add the shortcode [cookie_rocks_link] to your footer or menu, then hide the button again.

The texts of a language removed from Polylang or WPML are kept, for the day it comes back.

What the setting changes elsewhere

The choice duration

When the visitor’s country, or the country where your site is established (outside the United States), allows a shorter duration than Remember the choice for on the Consent screen, the choice lasts the shorter of the two. This limit is kept with the choice, in the cookie of the banner. When the cookie is written again (a video allowed, a fresh choice), the limit stays: the longer duration of the site never comes back. When the country sets a shortest duration for a refusal, the banner waits that long before asking again. See How long a cookie choice lasts.

The proofs

With the setting on, the register on the Proof of consent screen has a Rules shown column: Same for everyone, Strict or Opt-out. The country and its source are kept only when the country led to the opt-out rules, for example “Opt-out, US-CA from the CDN”. The source says from the CDN (a CDN or your server), from the local database or from the country cookie. The IP address is never kept.

The cookie policy

The cookie policy written by Cookie Rocks gets a Rules by country paragraph. It tells visitors that the rules of the banner follow the law of their country, that the country is worked out from their connection on your server or through your CDN, that the IP address is not stored, and that the country stays in their browser until they choose or close it. When proofs are kept, it adds that the record of a choice keeps the country when the country led to less strict rules. With the cr_country cookie, that cookie is listed. See Get a cookie policy that writes itself.

Global Privacy Control and Do Not Sell

With the setting on, the Global Privacy Control signal counts for every browser that sends it, from the first page. Its line on the Consent screen is greyed out. Under the opt-out rules, a visitor whose browser sends it sees no banner to read: only the cookie button, with the status of the request. Under the consent-first rules, or on a site for children, the banner stays, with a note.

Every visitor located in the United States gets the Do Not Sell or Share My Personal Information link, even on a site that does not target the United States. Under the consent-first rules, it shows only in the states that have their own law sheet. It opens a view with Opt out of sale and sharing, in one click. In the US states that have a privacy law, the two buttons look the same: neither is put forward. Your own link, [cookie_rocks_link type="do-not-sell"], works for every visitor.

Google Consent Mode

When Consent Mode is on (Google screen), Cookie Rocks also gives Google a default state for each region with the opt-out rules, except on a site where every visitor gets the strict rules. Google tags then know the rules of the visitor’s region from the first tag, before the country is known. A browser that sends the Global Privacy Control signal gets no such regional default: the refusal applies from the first page.

How the country is asked, and what is kept

• The page stays the same for every visitor. Your cache plugin or CDN can keep it: the country is never written in the page. See Caching plugins.
• A small script asks for the rules, only while the visitor has not chosen. It sends one request to your own site, never cached: the file geo.php of the plugin, which answers in a few milliseconds without loading WordPress. When your host blocks it, the REST route /wp-json/cookie-rocks/v1/geo answers instead. Both answer with the rules and the details of the country, never with the IP address. With the setting off, both answer “not found”.
• Until the answer comes, every optional cookie stays held and the banner waits. If the answer takes more than 1.5 seconds, the strict rules apply. If the script cannot load at all, the strict rules apply after 3 seconds. The banner never stays silent.
• The answer stays in the browser, in the session storage (cr_geo), so the next pages ask nothing. It is erased once the visitor chooses, or when the browser is closed.
• Once the visitor has chosen, the country is not asked again. The rules and the duration limit stay with the choice. The country goes only to the proof, and only when it led to the opt-out rules.
• The IP address is used only by your CDN or your server to find the country, or by the country database on your server. Cookie Rocks never keeps it, never writes it, never sends it.
• Weight. Rules by country are part of the advanced settings of the engine, which add 0.30 kB compressed when they are on. See Weight.

The settings of geo.php are written to the uploads folder of your site, under cookie-rocks/geo/, each time you save, and by the daily check. On a multisite network, each site has its own file.

For developers: CookieRocks.setProfile

Cookie Rocks calls CookieRocks.setProfile(profile) itself once it knows the visitor’s profile. Leave it to Cookie Rocks, unless you locate visitors with your own code. profile.p is strict or objection. An empty object gives the strict rules. Before a choice, the state of each category is worked out again and sent to Google and WP Consent API when it changes. See JavaScript events.

After turning it on: what to check

1. The Rules by country card of the Overview says On, source verified on a date, or On, source trusted. On a site established in a consent-first country: “On: the site owner is based in a country with prior consent, every visitor gets the strict rules”.
2. The chosen source shows seen on this request with your own country. A server variable is trusted without a test: this mark is the only sign that your host really sets it.
3. The cards of What your visitors get say what you expect.
4. The Overview shows no point about the rules by country.
5. Your cookie policy has its Rules by country paragraph.

Limits

• VPN and proxies. The country is the one of the connection. A visitor using a VPN gets the rules of the VPN’s country.
• Travellers. A visitor gets the rules of the country they connect from, not of the country where they live. Once they have chosen, their choice keeps the rules it was made under, until the banner asks again.
• Countries and states without a law sheet get the strict rules. The Laws covered page lists the 248 jurisdictions Cookie Rocks knows.
• US states. With Cloudways, Pantheon or the country database, the state is not known: every visitor from the United States gets the rules of California.
• Your own visits. The screen shows what your own request carries. It cannot show what every visitor’s request carries: the verification is there for that.

Cookie Rocks helps you find your way through cookie and privacy rules. It does not replace a lawyer’s advice.

Next step: Proof of consent.