Consent UX That Matches Whatever Privacy Law Actually Applies

Every SaaS site faces the same tension: show a cookie banner to everyone and hurt conversion in places with no privacy law at all, or skip it and risk fines in the places that require explicit consent.

As of 2026, 144 countries have national data privacy laws covering roughly 80% of the global population, and 24 US states have passed comprehensive privacy statutes, 20 of them already in effect (IAPP tracking data, cdp.com). Rules also change often: states amend opt-in thresholds and enforcement rules on an ongoing basis. A single global consent modal can't reflect any of that accurately.

Three Consent Models

                          Incoming Request
                                 |
                     GetVisitor.info Payload
                                 |
            +--------------------+--------------------+
            |                    |                    |
     consent: "OPT IN"        consent: "OPT OUT"      privacy_regime: null
            |                    |                    |
    Render Blocking      Render Unobtrusive      Render ZERO
   Consent Modal (EU)    Footer Link (CA/US)    Clutter (Clean UI)

Opt-in (EU/UK GDPR, Brazil LGPD): non-essential tracking can't run until the visitor actively consents. Show a blocking modal before firing analytics or marketing pixels.

Opt-out (California CCPA/CPRA and similar US state laws): tracking can run by default, but you must provide a clear way to opt out. A persistent footer link, "Do Not Sell or Share My Personal Information," covers it.

None: no statutory framework applies. Show nothing and run analytics normally.

Two things worth building in regardless of jurisdiction: persist the visitor's choice so the modal doesn't refire on every visit, and check for a Global Privacy Control signal in the browser. Some opt-out states now require honoring GPC as equivalent to a manual opt-out, so a visitor broadcasting it should skip straight to the opted-out state without seeing the footer link first.

The Payload

{
  "location": {
    "country": "United States",
    "country_code": "US",
    "state": "California",
    "privacy_regime": { "name": "CCPA", "consent": "OPT OUT" }
  }
}

A German visitor gets the GDPR version of the same payload instead:

{
  "location": {
    "country": "Germany",
    "country_code": "DE",
    "state": "Bavaria",
    "privacy_regime": { "name": "GDPR", "consent": "OPT IN" }
  }
}

function initPrivacyConsent(gviData) {
  const regime = gviData.location.privacy_regime;
  const consent = regime?.consent || "NONE";

  switch (consent) {
    case "OPT IN":
      showOptInModal({
        regimeName: regime.name,
        onAccept: enableAnalyticsAndTracking,
        onReject: disableNonEssentialTracking
      });
      break;
    case "OPT OUT":
      enableAnalyticsAndTracking();
      renderOptOutFooterLink({ onOptOut: disableNonEssentialTracking });
      break;
    default:
      enableAnalyticsAndTracking();
  }
}

Weighing the Options

Sign up at GetVisitor.info to route consent UX by jurisdiction automatically.