It depends on the law that covers each visitor. GrantCookie labels each privacy law it supports with the consent model its banner uses there: opt-in for the GDPR, opt-out for California’s CCPA and notice for Australia’s Privacy Act.
Three models, defined
The regulations hub lists every privacy law and framework GrantCookie supports, grouped by region, with the consent model the banner uses in each place. It defines each model in one line:
- Opt-in: non-essential cookies wait until the visitor agrees.
- Opt-out: cookies can run until the visitor opts out.
- Notice: the banner tells the visitor and records the choice.
The hub adds that these labels describe what the banner does in each market and are not legal advice. The sections below take one law for each model.
Opt-in: the GDPR
The GDPR is the EU’s data protection law, and the UK GDPR is the UK’s version. Under it, you need opt-in consent, given by a clear affirmative action, before setting non-essential cookies, and withdrawing consent must be as easy as giving it. Since February 2026 the UK exempts some low-risk cookies.
The GDPR reaches beyond Europe. It affects organisations established in the EU or UK, and also organisations elsewhere that offer goods or services to people there or monitor their behaviour, for example with tracking cookies. GrantCookie also applies opt-in where Brazil’s LGPD or India’s DPDP Act applies, and the DPDP Act’s consent rules apply from May 2027. The GDPR guide has the detail.
Opt-out: the CCPA
The California Consumer Privacy Act gives California residents the right to opt out of the sale or sharing of their personal information. For cookies, as the CCPA guide puts it, this means a clear opt-out mechanism rather than the GDPR’s opt-in consent. If you sell or share personal information, you must show a “Do Not Sell or Share My Personal Information” link, or an allowed alternative, in the header or footer of your homepage.
Not every business is covered. The CCPA applies to for-profit businesses that do business in California and meet at least one of its tests, such as annual gross revenue over USD 26,625,000 in the previous calendar year. GrantCookie applies the opt-out model for Virginia, Colorado, Connecticut and Utah as well as California.
Notice: Australia’s Privacy Act
Australia’s Privacy Act 1988 has no cookie-consent rule as such, but cookies that identify or could reasonably identify someone count as personal information. Under the Act, you must tell people about the collection at or before the time you collect their information, or as soon as practicable afterwards. It covers Australian Government agencies and private-sector organisations with annual turnover above AUD 3 million, plus all health service providers and some other categories regardless of size. Singapore’s PDPA also works on notice. The Privacy Act guide explains more.
Visitors from more than one market
A site with visitors in the EU, California and Australia may need all three models. With GrantCookie you select the privacy laws that apply to you, and the banner follows the rule for the market each visitor is in:
- Opt-in: non-essential cookies are blocked until the visitor chooses, with Reject all beside Accept all.
- Opt-out: cookies run until the visitor opts out, with a “Do Not Sell or Share My Personal Information” link and a preference centre.
- Notice: the banner gives the notice and records the choice; in Australia, it does so where a cookie can identify someone.
Whichever model applies, every choice is timestamped and stored with the banner version the visitor saw. GDPR and CCPA templates come with every plan, Free included. The cookie consent banner page shows what the banner does under each model.
Where to start
First, find out what your site sets. The free cookie scanner checks one public page, with no account needed; a GrantCookie account scans your whole site and sorts every cookie, tracker and pixel it finds into categories. Then read the guide for each market your visitors come from, starting with who the law affects. The guides are general guidance, not legal advice, so check your specific obligations with a qualified adviser.