Consent requirements by region
Guides to cookie and consent law in the EU and UK, India and the United States: what each requires, how long to keep records, and how to comply with Macaw.
Guides
Cookie consent in the EU and UK: GDPR, ePrivacy and PECR
European Union & United Kingdom: What the GDPR, the ePrivacy Directive and the UK's PECR require from a cookie banner, what regulators check, and how to set up Macaw to meet it.
Consent under India's DPDP Act and the DPDP Rules 2025
India: What India's Digital Personal Data Protection Act 2023 and the DPDP Rules 2025 require for notice and consent, when the duties apply, and how to meet them with Macaw.
US privacy laws: opt-out rights, Global Privacy Control and record keeping
United States: How the CCPA/CPRA and other US state laws differ from Europe, why Global Privacy Control (GPC) signals now matter, what records to keep, and how to use Macaw alongside them.
How to prove consent: what to record and how long to keep it
All regions: Every privacy regime puts the burden of proof on you. What a consent record should contain, what it should not, how long each region expects you to keep it, and how Macaw handles it.
Regions side by side
| Requirement | EU & UK | India | United States | Macaw |
|---|---|---|---|---|
| Consent model for cookies | Opt-in | Opt-in | Opt-out (opt-in for sensitive data) | Opt-in everywhere |
| Prove who agreed, when, to what wording | GDPR Art. 7(1) | DPDP s.6(10), Rule 3 | CCPA §7101 (requests) | Stored records with notice versions |
| Reject as easy as accept, no pre-ticked boxes | EDPB, CNIL | Rule 3 | Dark-pattern rules | Built into the banner |
| Easy withdrawal | Art. 7(3) | s.6(4) | Opt-out rights | Reopen the banner from your footer |
| Honour browser opt-out signal (GPC) | Recommended | Not required | Mandatory in 12+ states | Not yet: handle in your code |
| Children | Art. 8 | Parental consent under 18 | COPPA and state laws | Not yet: handle in sign-up |
| Keep records | Accountability | 1 year logs; 7 years for consent managers | 24 months | 6 to 84 months, default 24 |
This guide summarises public regulator guidance and legal commentary to help you configure consent. It is not legal advice. Laws, deadlines and enforcement change; have your counsel confirm what applies to your business.