In this guide
- The EU and UK require consent for non-essential cookies and a lawful basis for personal data.
- Many US states use opt-out models and recognise signals such as Global Privacy Control.
- A practical approach: region-aware consent, data minimisation, records and respect for withdrawal.
If you advertise across borders, you meet several privacy regimes at once. They look different on the surface and share the same ideas underneath. This page summarises the main ones in plain words and gives a practical way to handle them in tracking. It is general information, not legal advice, and laws change, so check current rules with a professional. See cookies, GDPR and the ePrivacy Directive, the Digital Omnibus and cookie banners.
The main regimes
| Region | Key rules | What it means for tracking |
|---|---|---|
| EU | GDPR and the ePrivacy Directive | Consent for non-essential cookies and advertising tracking; lawful basis for personal data; rights of access and deletion |
| UK | UK GDPR and PECR | Similar to the EU, with its own regulator and guidance |
| United States | No single federal law; many state laws (for example California, Virginia, Colorado) | Often opt-out of sale, sharing and targeted advertising; recognise opt-out signals in several states |
| Brazil | LGPD | Lawful bases and consent; rights similar to GDPR |
| Canada | PIPEDA and provincial laws such as Quebec's Law 25 | Meaningful consent and transparency |
| India | Digital Personal Data Protection Act | Consent-based processing with notices |
| Australia | Privacy Act | Notice and consent principles, under reform |
Runs on your domain, anywhere
Your tracking runs on your own domain, so a visit from any country is handled the same way.
Consent models
- Opt-in (EU, UK): no non-essential tracking until the visitor agrees.
- Opt-out (many US states): tracking may run until the visitor objects, with clear notice and a way to opt out.
- Signals: Global Privacy Control and similar browser signals are legally recognised in several places.
What they share
Transparency
Tell people what you collect, why and who receives it.
Minimisation
Collect and send only what you need.
Choice
Let people refuse and withdraw.
Security and records
Protect data and keep records of what you do.
Check your tracking in one pass
This is an example. Run the check on your own site to see where yours stands.
A practical global approach
Map where your visitors are
Use country data.
Use region-aware consent
Opt-in for the EU and UK, opt-out with signals for relevant US states, and sensible defaults elsewhere.
Make tags obey
Consent settings on every tag, in the browser and the server container.
Minimise data per vendor
Use transformations and the Anonymizer where possible.
Keep records and notices current
Cookie notice, privacy notice, vendor list.
Review twice a year
Laws and your tools change.
Where a server container helps
A server container gives you one place to apply region and consent logic to every vendor. Open Tracked's Visitor Location power-up (every plan) reads the country and region from your CDN's headers, which can drive region-aware rules, and its consent switches and Anonymizer support minimisation. Your legal rules still come from your advisor.
Watch events arrive, live
A sample feed. In Open Tracked you see the same stream for your own store.
Frequently asked questions
Do privacy laws apply outside the EU?
Yes. Many countries and US states have their own rules, with different consent models.
What is Global Privacy Control?
A browser signal that tells sites the visitor opts out of sale or sharing of data. Several US states require sites to honour it.
Do I need opt-in consent everywhere?
No. The EU and UK require opt-in for non-essential cookies. Other places often use opt-out. Build for the strictest region you serve.
Can server-side tracking help with compliance?
It gives you one place to enforce rules, but the rules still apply.
Where should I get legal advice?
From a qualified privacy professional familiar with the regions you serve.
Do I need spreadsheets to read my results?
No. Once tracking is live, the Open Tracked analytics shows spend, revenue, ROAS and profit, and you can ask Ari, the built-in AI assistant, questions about your own numbers in plain words. Ari's allowance depends on your analytics plan.
Is Open Tracked different from Open Track or Open Space Track?
No. Open Tracked is the official name of our server-side tracking platform, and the website is opentracked.io. Many people search for it as Open Track, OpenTrack or Open Space Track. All of them lead to the same product: server-side Google Tag Manager hosting, first-party analytics and a CRM pipeline.
Fix your tracking at the source
Open Tracked hosts your server-side Tag Manager, keeps first-party cookies alive and shows what each ad is really worth.
The Open Tracked team
We build Open Tracked: server-side tracking hosting, analytics and the tools around them, for stores that spend on ads. Questions about this guide, or an idea for the next one?
Comments
Loading comments...
Guides · 5 min read
