TL;DR
The GDPR is not the only regulation that sets rules on cookies and consent. Brazil (LGPD), South Africa (POPIA), Thailand (PDPA), India (DPDPA) and other countries have adopted their own data protection laws, each with specific requirements on trackers. For websites with an international audience, managing cookies outside Europe has become as important as GDPR compliance.
Why cookies are regulated beyond Europe
Europe led the way with the GDPR and the ePrivacy Directive, but the trend towards online privacy regulation is global. Between 2018 and 2026, more than 40 countries adopted or strengthened personal data protection laws. Most include provisions that directly affect the placing of cookies and online tracking.
Even in Europe the framework is still evolving, as our article on what the ePrivacy Regulation changes for cookies explains.
If your website receives traffic from Brazil, South Africa, Southeast Asia or India, you are potentially subject to these regulations, in addition to the GDPR and the CCPA. This article reviews the main laws outside Europe and what they mean for your cookies.
LGPD (Brazil): what are the rules for cookies?
The Lei Geral de Protecao de Dados (LGPD) is Brazil’s personal data protection law, in force since September 2020. It is heavily inspired by the GDPR but differs in important ways regarding consent and the legal bases applicable to cookies.
Consent is not the only legal basis
Unlike the GDPR, where consent is the dominant legal basis for non-essential cookies, the LGPD provides ten legal bases for data processing. Legitimate interest is a valid legal basis in Brazil, which means that some cookies (analytics cookies, for example) could in theory be placed without prior consent, provided the principles of transparency and necessity are respected.
In practice, however, the Brazilian authority (ANPD) recommends obtaining consent for tracking and advertising cookies. Consent under the LGPD must be free, informed, unambiguous and specific to each purpose.
These criteria are close to the European ones, detailed in our guide to the 7 requirements for valid GDPR consent.
What the LGPD requires in practice
The LGPD requires a clear privacy policy, identification of the cookies placed and their purposes, a mechanism for withdrawing consent, and the appointment of a person in charge of data processing (encarregado). Cookie categories (necessary, analytics, advertising) are relevant in this Brazilian context.
POPIA (South Africa): the GDPR of the African continent
The Protection of Personal Information Act (POPIA) is South Africa’s data protection law, fully applicable since July 2021. It applies to any organisation that processes the personal data of South African residents, including foreign websites.
Consent and cookies under POPIA
POPIA requires data processing to be justified by one of the legal bases set out in the law. Consent is one of them, but legitimate interest (section 11(1)(f)) may also apply in some cases. For advertising and tracking cookies, prior consent is recommended by the Information Regulator (the South African authority).
Consent under POPIA must be voluntary, specific and informed. Users must be able to withdraw it at any time. POPIA also requires an opt-out mechanism for direct marketing, which concerns cookies used for remarketing.
Keeping a timestamped record of each choice makes this easier to demonstrate, as explained in our guide on what proof of cookie consent to store.
PDPA (Thailand): Asia’s strictest law
Thailand’s Personal Data Protection Act (PDPA) has been in force since June 2022. It is often regarded as the Asian equivalent of the GDPR, with similar requirements on consent and data subject rights.
Explicit consent required
The Thai PDPA requires explicit consent before any collection of personal data, including through cookies. Consent must be free, specific, informed and given through a clear affirmative action. Pre-ticked cookies or banners without a reject option do not comply with the PDPA.
The Thai authority (PDPC) has published guidelines that align the PDPA requirements with European standards. A GDPR-compliant consent banner will generally comply with the PDPA, with a few minor adjustments to language and legal notices.
For concrete models, browse these GDPR cookie banner examples and best practices.
DPDPA (India): the new law to watch
India’s Digital Personal Data Protection Act (DPDPA) was adopted in August 2023. With 1.4 billion inhabitants and a fast-growing digital economy, India is a major market. The DPDPA makes consent the main legal basis for processing personal data.
The DPDPA requires consent to be free, specific, informed and unambiguous. The implementing rules (via notifications) are still being published. The planned penalties are significant: up to INR 250 crore (around €27 million) per breach.
For websites targeting the Indian market, it is advisable to display a consent banner in English and Hindi, with a cookie policy adapted to the DPDPA framework.
Comparison of cookie laws outside Europe
The four main laws outside Europe take different approaches to cookie consent. The table below summarises the key points to bear in mind when adapting your CMP to each jurisdiction.
How to adapt your CMP to multiple jurisdictions
The most effective strategy is to adopt an approach based on your visitors’ geolocation. Rather than applying the same rules to everyone, you can adapt the behaviour of your consent banner according to the user’s country.
Geolocation-based approach
A modern CMP can detect the visitor’s location and display the appropriate banner. For European visitors: a full GDPR banner with opt-in. For Brazilian visitors: an adapted banner with an LGPD notice and opt-out. For Thai visitors: an opt-in banner similar to the GDPR one. For Indian visitors: a consent banner with a DPDPA notice. FlowConsent offers this built-in geolocation feature to automatically adapt the banner to the visitor’s country.
The highest level of protection strategy
An alternative approach is to apply the highest level of protection to all visitors, whatever their country. This strategy simplifies compliance but may lower consent rates in less strict countries. It is recommended for websites with moderate traffic outside Europe, where geolocation is not justified in terms of return on investment.
If you choose this route, track the effect with our guide on how to measure and improve your cookie consent rate.
Key takeaways
Cookie management is no longer a purely European issue. Laws are multiplying, penalties are increasing, and users around the world are increasingly concerned about protecting their data. For a website with an international audience, investing in a CMP that can handle multiple jurisdictions has become essential.
Identify where your traffic comes from, check whether these regulations apply to you, and adapt your banner accordingly. Scan your website with FlowConsent to check your configuration and identify possible improvements.