Cookie Regulatory Horizon 2026: what is changing globally

2026 is not a single global cookie-law reset. The real shift is narrower and more technical: regulators are tightening enforcement, clarifying edge cases, and expecting businesses to prove what actually fires before and after user choice.

For website operators, the main risk is no longer whether a banner exists. It is whether storage, access, tracking, profiling, and downstream data flows match what the interface claims.

2026 timeline

UK

19 June 2025: the Data (Use and Access) Act 2025 came into law, triggering updates to ICO guidance on storage and access technologies.¹

July to September 2025: the ICO consulted on updated draft guidance covering the new rules.²

Spring 2026: the ICO says final guidance is due for publication in Spring 2026.³

What changed: the UK now has additional exceptions for some statistical, appearance, and emergency-assistance uses, but this is not a broad analytics carve-out. The ICO states that the statistical exception is about aggregate statistical information used to improve the service or website, and does not cover online advertising or monitoring individual users.⁴

Practical effect: most non-essential tracking still needs consent. Any product claim that “UK analytics is exempt now” is too broad and likely wrong.

EU

19 November 2025: the European Commission issued the Digital Omnibus proposal, which the EDPB and EDPS later described as amending a large body of EU digital legislation, including the ePrivacy Directive.⁵

11 February 2026: the EDPB and EDPS adopted Joint Opinion 2/2026 on that proposal.⁶

Practical effect: there is no single pan-EU “cookie law goes live” date in 2026. The more accurate position is ongoing legislative adjustment around the existing framework, with continued pressure on consent, tracking definitions, and digital compliance.

France

2025 enforcement, published in 2026: CNIL states that cookies, employee monitoring, and data security were the main subjects of sanctions imposed in 2025.⁷

CNIL’s public material also records major cookie-related sanctions in 2025, including Google (€325 million), American Express (€1.5 million), and Condé Nast / Vanity Fair (€750,000).⁸

Practical effect: France remains one of the clearest enforcement benchmarks for cookie and consent risk. This is not hypothetical tightening. It is already active enforcement.

California

1 January 2026: updated California Consumer Privacy Act regulations became effective.⁹

CPPA materials also state that businesses subject to risk-assessment requirements must begin compliance by 1 January 2026, including activities such as selling or sharing personal information, processing sensitive personal information, and using certain automated technologies.¹⁰

Practical effect: California is not adding an EU-style cookie regime. The more important change is stronger operational scrutiny around sharing, opt-outs, sensitive data, and profiling-related processing.

US multi-state enforcement

9 September 2025: Connecticut, California, and Colorado announced a joint investigative privacy sweep focused on potential noncompliance with Global Privacy Control signals.¹¹

Practical effect: US enforcement is becoming more technical and coordinated. The issue is not just disclosure language. It is whether browser-based opt-out signals are actually honoured in practice.

Brazil

ANPD’s 2025–2026 Regulatory Agenda includes priority work on children and adolescents’ personal data, including digital environments and consent-related issues, as well as other higher-risk processing themes.¹²

Practical effect: Brazil is not presenting a single new cookie-specific deadline for 2026, but the regulatory direction increases pressure on digital tracking where profiling, vulnerable users, or higher-risk processing is involved.

Canada

The Office of the Privacy Commissioner of Canada continues to treat meaningful consent as central to online behavioural advertising and states that, as a best practice, organisations should avoid tracking children and tracking on websites aimed at children.¹³

Practical effect: the main pressure point is not a major new 2026 cookie statute. It is ongoing scrutiny of consent quality, behavioural advertising, and child-directed tracking.

What the global pattern looks like

• Consent remains the default for most non-essential tracking in the UK and EU.¹
• Regulators are narrowing what can credibly be claimed as exempt analytics.⁴
• France is already enforcing cookie rules at scale.⁷
• US states are focusing on whether opt-outs and browser signals work in practice.¹¹
• Higher-risk tracking involving sensitive data, profiling, or children is under increasing pressure across multiple jurisdictions.¹⁰¹²¹³

What website operators should take from this

The 2026 question is not “do we have a cookie banner?”

The 2026 question is: what storage, access, pixels, scripts, identifiers, and downstream disclosures still happen before consent, after opt-out, or under weak exemption claims?

That is where regulatory risk is concentrating.

Sources

1. ICO: Guidance on the use of storage and access technologies
2. ICO: consultations listing for updated storage and access technologies guidance
3. ICO: plans for new and updated guidance
4. ICO: Mind Your Banners presentation
5. EDPB/EDPS Joint Opinion 2/2026 PDF
6. EDPB: Joint Opinion 2/2026 page
7. CNIL: sanctions and corrective measures in 2025
8. CNIL: sanctions issued by the CNIL
9. CPPA: CCPA updates effective January 1, 2026
10. CPPA: 7 things to know before 2026 CCPA updates take effect
11. Connecticut AG: joint investigative privacy sweep
12. ANPD: Regulatory Agenda for 2025–2026 biennium
13. OPC Canada: Guidelines on privacy and online behavioural advertising