Law 25 vs PIPEDA vs US state laws vs GDPR: cookie rules compared
Short answer
Quebec's Law 25 and Europe's GDPR with the ePrivacy rules generally require opt-in consent before non-essential cookies. PIPEDA, for the rest of Canada, allows opt-out consent for some online advertising under strict conditions. US state laws use an opt-out model focused on selling and sharing data, with Global Privacy Control as a valid opt-out in many states.
Key takeaways
- Quebec and the EU: ask first for analytics and marketing cookies.
- Rest of Canada: notice and easy opt-out can work for some advertising.
- US states: let people opt out of sale and sharing, and honour GPC.
- One banner with regional rules covers all four.
If your website has visitors in Quebec, the rest of Canada, the US and Europe, you are dealing with four different approaches to cookies. Here is how they compare, in plain language.
The comparison at a glance
| Quebec Law 25 | PIPEDA (Canada) | US state laws | GDPR and ePrivacy (EU) | |
|---|---|---|---|---|
| Model | Opt-in for tracking that can identify, locate or profile | Meaningful consent; opt-out can be acceptable for some online ads | Opt-out of sale, sharing and targeted ads | Opt-in before non-essential cookies |
| Default | Off until the visitor agrees | Depends on sensitivity and expectations | On until the visitor opts out | Off until the visitor agrees |
| Browser signals | Not named | Not named | GPC required in about a dozen states | Not named |
| Language | French required for Quebec | English or French as appropriate | Usually English | Local language expected |
| Regulator | Commission d’accès à l’information | Office of the Privacy Commissioner | State attorneys general; California Privacy Protection Agency | National data protection authorities |
| Maximum penalties | Up to 25M dollars or 4% of worldwide turnover (penal) | Limited fines for specific offences | Per-violation fines, varies by state | Up to 20M euros or 4% of worldwide turnover (GDPR) |
Quebec Law 25
Since September 2023, technology that can identify, locate or profile a person must be off by default, and people must be told how to turn it on. For websites, that points to opt-in for analytics and advertising. Read the full Law 25 guide.
PIPEDA in the rest of Canada
PIPEDA requires meaningful consent, with the form depending on the sensitivity of the information and what people would reasonably expect. The Office of the Privacy Commissioner has said opt-out consent can be acceptable for online behavioural advertising if people are told clearly at or before collection, can opt out easily and permanently, the information is not sensitive, children are not targeted, and invisible techniques like fingerprinting are not used.
US state privacy laws
California, Colorado, Connecticut, Virginia, Texas, Oregon and many other states now have comprehensive privacy laws. Most follow an opt-out model: you may use cookies for advertising, but people must be able to opt out of the sale or sharing of their data and of targeted advertising, often through a “Do not sell or share my personal information” link. Many states require you to honour Global Privacy Control as an opt-out. Sensitive data often needs opt-in.
GDPR and ePrivacy in the EU
The ePrivacy rules require consent before storing or reading non-essential information on a device, and GDPR defines what valid consent means: freely given, specific, informed and unambiguous. In practice, that means opt-in, a Reject option as easy as Accept, and proof of consent.
How to handle all four with one banner
Use regional rules. Opt-in for Quebec and the EU, a notice with an easy opt-out for the rest of Canada if your counsel agrees, an opt-out notice with a Do not sell or share option for the US, and GPC honoured everywhere. North Consent detects the region in the visitor’s browser and applies the right rule. See regional rules.
This comparison is a simplified overview, not legal advice. Laws change, and thresholds and exceptions apply.
Frequently asked questions
If I follow GDPR, am I covered everywhere?
Following the strictest rule everywhere covers most consent requirements, but you would still need US-specific items such as a Do not sell or share link and GPC handling, and French for Quebec.
Does PIPEDA require a cookie banner?
PIPEDA does not mention banners. A banner is a practical way to give the clear notice and easy opt-out the OPC expects for online advertising.
Which US states require GPC?
About a dozen, including California, Colorado, Connecticut, Oregon, Texas and New Jersey. The list is growing, so check the current laws for your customers' states.
Keep reading
Quebec Law 25 and cookies: what your website needs to do
What Quebec's Law 25 means for cookies on your website: off by default, clear information, an easy way to choose, and proof. A practical checklist.
Global Privacy Control (GPC) explained for website owners
What Global Privacy Control is, which US states require websites to honour it, how browsers send it, and how to respect it on your site automatically.
Google Consent Mode v2: a plain-language setup guide
Set up Google Consent Mode v2 correctly: the four consent signals, default denied, basic vs advanced mode, and how to check it works with Tag Assistant.