Regions / Geo-targeting

One of the powerful features of CookieHub is the ability to adapt consent behavior based on the user’s geographic location.

Using Regions, you can define how consent is collected, which dialog is shown, and which privacy framework applies for users in specific countries or states.

Regions can represent a single country, a U.S. state, a Canadian province or territory, or a predefined group of countries with similar privacy requirements. Each region can be configured independently in the CookieHub dashboard.

Note on Regulatory Updates: Privacy regulations are constantly evolving. The region groups listed below reflect the regulatory landscape as of January 2026.

CookieHub actively monitors global privacy laws (such as new U.S. state regulations or updates to international data protection acts) and updates these pre-defined definitions as new laws come into effect. When a new law becomes enforceable, CookieHub automatically updates the relevant region group logic to ensure continued compliance without requiring manual reconfiguration on your part.

How a visitor is matched to a regionCopy Anchor Link

A visitor is matched to exactly one region. When several of your configured regions could apply, the most specific one wins:

1. A region for the visitor's exact state or province — US-CA, CA-QC.
2. A region group that contains that state or province — US ("Do not sell or share" states) contains US-CA.
3. A region for the visitor's exact country — US, CA.
4. A region group that contains that country — Recommended opt-in contains CA.
5. Your default region, if nothing above matched.

So a subdivision always beats a country, and a group holding the subdivision beats the country on its own. Two things follow that are worth knowing before you configure overlapping regions:

• Adding a province- or state-level region never affects the rest of that country. A domain configured with both Canada required opt-in provinces and Recommended opt-in serves Quebec visitors the first and every other Canadian visitor the second.
• A visitor whose subdivision cannot be determined falls back to their country, not to your default region. Geolocation does not always resolve to a state or province; when it does not, a Canadian visitor is still treated as Canadian.

If two groups both apply and neither is more specific than the other, CookieHub picks the one that comes first in the list below.

Pre-defined regionsCopy Anchor Link

GDPR & GDPR-equivalent regions (EU, EEA, UK & similar)Copy Anchor Link

This region includes countries and territories where strict, GDPR-style consent requirements apply.

Users located in these jurisdictions must provide explicit consent (opt-in) before non-essential cookies or similar technologies are used.

The group covers the European Union (EU), European Economic Area (EEA), the United Kingdom, and other jurisdictions with GDPR-equivalent consent expectations, such as Switzerland and certain European overseas territories.

This region is typically used when full compliance with GDPR, ePrivacy-style rules, and equivalent national laws is required.

US ("Do not sell or share" states)Copy Anchor Link

This region includes U.S. states with comprehensive privacy laws that grant users the right to opt out of the sale or sharing of personal data, including data used for targeted advertising.

In these states, CookieHub typically presents a “Do not sell or share my personal data” option and honors applicable opt-out signals in accordance with state law.

This region is intended for compliance with laws such as the California Consumer Privacy Act (CCPA/CPRA) and other state-level privacy frameworks with similar requirements.

US (Recommended opt-out states)Copy Anchor Link

This region includes U.S. states that do not currently have comprehensive privacy laws equivalent to CCPA/CPRA, but where opt-out consent and transparency are recommended based on consumer protection laws, regulatory guidance, or enforcement trends.

While explicit opt-in consent is generally not required in these states, providing clear notice and opt-out mechanisms is considered best practice and may reduce legal and reputational risk.

Canada required opt-in provincesCopy Anchor Link

This region covers the Canadian provinces whose law requires opt-in consent, where cookies and similar technologies must be deactivated until the visitor actively consents, per purpose, with nothing pre-selected.

Quebec is currently the only one. Law 25 section 8.1 requires technology used to identify, locate or profile an individual to be deactivated by default, which is stricter than the implied consent PIPEDA allows elsewhere in Canada.

The group has one member deliberately. Alberta's and British Columbia's PIPA are substantially similar to PIPEDA and neither has diverged — British Columbia's 2026 Bill 9 amends FIPPA, the public-sector law, not PIPA. If a second province does diverge, it is added here and your configuration picks it up without you changing anything.

All thirteen Canadian provinces and territories are also individually selectable, whether or not they currently carry a distinct regime: CA-AB Alberta, CA-BC British Columbia, CA-MB Manitoba, CA-NB New Brunswick, CA-NL Newfoundland and Labrador, CA-NS Nova Scotia, CA-NT Northwest Territories, CA-NU Nunavut, CA-ON Ontario, CA-PE Prince Edward Island, CA-QC Quebec, CA-SK Saskatchewan and CA-YT Yukon. This matches the U.S., where states without comprehensive laws are selectable on the same basis.

Why Canada appears twiceCopy Anchor Link

Canada appears in two places on this page, and that is deliberate — not a duplication.

Quebec is a legal requirement. The rest of Canada is a recommendation you may choose to relax — PIPEDA accepts implied consent for lower-sensitivity purposes, and some operators rely on that.

Until these were separable, Canada was all-or-nothing: you either ran opt-in across the whole country, or you were wrong in Quebec. Configuring both regions gives you the combination most Canadian sites want — required opt-in in Quebec, your own choice everywhere else. Because a subdivision beats a country, the two never conflict.

If you only configure Recommended opt-in, Quebec visitors are served by it exactly as they are today. Nothing changes until you add the Quebec region yourself.

Recommended opt-in (excluding EU/EEA/UK/US)Copy Anchor Link

This region includes countries outside the EU, EEA, UK, and United States where privacy laws or regulatory guidance generally require explicit consent (opt-in) for the use of cookies or similar tracking technologies.

These jurisdictions often have comprehensive data protection laws inspired by or aligned with GDPR principles, even if they are not part of the European regulatory framework.

CookieHub recommends using opt-in consent in these countries to ensure compliance with local privacy expectations and enforcement practices.

Recommended opt-out (excluding EU/EEA/UK/US)Copy Anchor Link

This region includes countries where privacy laws generally allow the use of cookies based on implied consent (opt-out), provided that users receive clear notice and meaningful choices.

In many of these jurisdictions, cookie-specific requirements are less explicit or are interpreted differently than under GDPR. However, enforcement practices and guidance may vary.

Due to this uncertainty, CookieHub recommends evaluating whether opt-in consent is more appropriate for your use case, even if opt-out consent is legally permissible.