GDPR

GDPR is the European Union's data protection law that requires clear, prior consent before you track people with non-essential cookies or pixels.

Under GDPR, consent has to be freely given, specific, informed, and unambiguous. In plain terms, you cannot load tracking before someone opts in, you cannot rely on a pre-ticked box, and refusing has to be as easy as accepting. It covers anyone in the EU and, through the UK's own version, the United Kingdom too.

Suppose a visitor from Spain opens your site. GDPR says your analytics and ad pixels stay dormant until she actively clicks accept. If your banner drops cookies the moment the page loads, you are already offside no matter what the banner says.

The rule is prior consent, meaning tracking waits for the yes rather than assuming it. The catch that trips people up is that essential cookies, the ones needed to make the site work, are exempt, but almost everything you care about for marketing is not, so the exemption rarely rescues you.

In Europe, silence is a no. Build for the no.