Website Tracking Laws by Country: US, UK, EU, Canada, Australia

Website tracking laws by country sort into three broad families. The opt-in family (EU, UK): get consent before setting non-essential cookies or similar identifiers, with GDPR governing whatever personal data you process. The opt-out family (US): track by default under sectoral and state law, but disclose it, honor sale/sharing opt-outs — including the GPC browser signal in several states — and never deceive. The consent-and-notice family (Canada, Australia): principle-based privacy statutes where implied consent and clear notice do much of the work, paired with unusually strict email laws.

One scoping note before the matrix: this page compares regimes at a high level. For the EU specifically — lawful bases, why company-level visitor identification is defensible and person-level is not, the full compliance checklist — our GDPR and visitor identification guide is the canonical deep dive, and we will point there rather than re-explain it.

The table agencies bookmark. Each cell is the general rule; the sections below add the nuance that matters.

Read the columns separately: a region’s cookie rule and its email rule are different laws with different logic, and the common mistake is assuming they travel together. The US pairs the loosest email regime with a fast-thickening state privacy patchwork; Canada pairs a flexible privacy statute with one of the world’s strictest email laws.

The US has no comprehensive federal privacy law for commercial tracking. What exists is the FTC’s deception/unfairness authority (your privacy policy must be true), sectoral statutes, and a growing stack of state laws — California’s CCPA/CPRA first, with roughly twenty states having passed comprehensive laws since (the IAPP tracker is the running scoreboard). The state-law pattern: notice of collection, consumer rights (access, deletion), and an opt-out of “sale”, “sharing”, and targeted advertising — with several states treating the Global Privacy Control browser signal as a binding opt-out you must honor automatically.

For first-party analytics the practical position is stable: measuring your own site is generally fine with disclosure; the regulated edge is sharing data with ad platforms — conversion APIs, custom-audience uploads — which is where opt-outs and GPC bite. On email, CAN-SPAM permits unsolicited B2B email without prior consent, provided headers are truthful, the message identifies itself, a postal address is included, and opt-outs are honored promptly.

The UK question we get most from agencies: what is the difference between PECR and the UK GDPR? They are two different laws doing two different jobs, and you can be subject to either, both, or neither for a given piece of processing.

Two consequences follow. First, the cookie-banner obligation is a PECR question, not a GDPR one — the ICO’s cookie guidance is explicit that consent is needed for non-essential storage or access regardless of whether personal data is involved. Second, the UK is the friendliest major opt-in market for B2B email: PECR’s consent rule for marketing email protects “individual subscribers,” and corporate email addresses generally fall outside it — though the UK GDPR still governs the personal data involved, so you owe a lawful basis, identification, and a working opt-out.

One moving part to watch: the UK’s Data (Use and Access) Act 2025 amends this regime, and is expected to ease PECR consent for certain low-risk purposes such as first-party analytics cookies. As of August 2026, treat the ICO’s current guidance as the operative rule and check it before relying on any relaxation.

The EU pairs the ePrivacy Directive (the “cookie law,” implemented country by country) with the GDPR, coordinated by national DPAs and the EDPB. The headline rules: prior consent before non-essential cookies or similar identifiers, and a documented lawful basis for any personal-data processing — with enforcement genuinely active, including against dark-pattern consent banners.

We will not re-explain the GDPR mechanics here, because we already did it properly: our visitor identification and GDPR guide covers the lawful bases, why company-level visitor identification is generally defensible under legitimate interests while person-level identification of EU visitors is not, the cookieless question, and the full compliance checklist (DPA, legitimate-interest assessment, disclosure language). If the EU is a market you sell into, read that one — it is the canonical version.

The one EU nuance worth repeating in a by-country comparison: B2B email is not harmonized. Several member states allow a soft-opt-in or legitimate-interest approach for B2B outreach; Germany and Austria, under their unfair-competition rules, generally treat cold email without prior consent as unlawful even between businesses. A single “EU email policy” is a category error — segment DACH separately.

Canada runs on PIPEDA federally: consent-based, but with consent scaled to sensitivity and reasonable expectations — for ordinary, non-sensitive analytics, implied consent with clear and prominent notice is generally workable, while sensitive data or surprising uses need express consent. Quebec’s Law 25 layers stricter, more GDPR-like requirements (including transparency defaults for tracking technologies) on businesses serving Quebec. The sting is email: CASL requires consent before sending commercial electronic messages — express, or implied via an existing business relationship or an email address the recipient conspicuously published in a role-relevant context — plus sender identification and a working unsubscribe, with penalties that are famously large.

Australia is notice-based on the tracking side: the Privacy Act 1988 and its Australian Privacy Principles require fair collection and privacy-policy disclosure rather than cookie-by-cookie consent, and a small-business exemption currently keeps many companies under roughly AU$3M turnover outside the Act entirely (reform proposals to narrow that exemption have been under discussion for years — check status before relying on it). Email mirrors Canada: the Spam Act 2003 requires consent, which may be inferred from an existing relationship or a conspicuously published work address relevant to the recipient’s role, plus identification and unsubscribe, enforced by ACMA.

Across every regime above, the tracking rules hinge on two questions: do you store or read identifiers on the visitor’s device, and do you share data with third parties for advertising? Cookieless first-party analytics — no cross-site cookies, no fingerprinting, identifiers scoped to your own site or absent entirely — changes the answer to the first question, which is why it travels so well across jurisdictions.

• EU/UK: the ePrivacy/PECR consent trigger is the storage or access itself. A genuinely cookieless tracker generally does not engage it — but GDPR still governs whatever personal data (an IP address, briefly) is processed, so you still owe a lawful basis and disclosure. “Cookieless” that hides a persistent cross-site ID in localStorage is a cookie by another name.
• US: first-party measurement was never the regulated edge; sale/sharing is. Cookieless changes little legally, but honoring GPC on the ad-sharing layer (conversion APIs, audience uploads) remains required in the states that bind it.
• Canada/Australia: notice-and-fairness obligations are unchanged — disclose the measurement in your privacy policy either way; cookieless mostly removes the awkward “tracking technologies” disclosure debt.

This is the posture we built BusinessMCP around: cookieless first-party measurement globally, company-level identification with an enrich-then-discard approach to IPs, GPC honored on the ad-sharing layer for US visitors, and consent-gating available as an opt-in for sites that want it — the mechanics are in our consent mode guide. The one-sentence summary of five jurisdictions: measure your own site honestly and disclose it, get consent where the device is touched, and treat email as its own legal problem in every country.