Geo-targeting rules

Privacy laws differ by jurisdiction. EU visitors need an opt-in banner before any tracking starts, Californians need a way to opt out of the sale and sharing of their data, and many other visitors only need a notice. Geo-targeting rules let one installation do all of this. Geo-targeting is included on Pro and Enterprise plans.

How region detection works

When the Cookiesh script loads, our edge network looks up the visitor’s country, and for the United States, Canada and Brazil, their state or province, from the connection. Only the resulting region code, such as FR or US-CA, is passed to the script. The IP address is never stored or written to a consent record.

The region is stored with each consent record, so you can show which rule applied when a visitor made their choice.

Default rules

New sites start with these rules. They are evaluated from top to bottom, and the first match wins:

Region	Codes	Mode	Consent Mode v2 default
EU and EEA	EU, EEA	Opt-in	All signals denied
United Kingdom	GB	Opt-in	All signals denied
Switzerland	CH	Opt-in	All signals denied
Brazil	BR	Opt-in	All signals denied
California	US-CA	Opt-out, honors GPC	granted, ad signals denied with GPC
Rest of world	*	Notice	All signals granted

The three modes behave as follows:

• Opt-in. Non-essential categories stay blocked until the visitor accepts. The first layer shows Accept all, Reject all and Customize.
• Opt-out. Categories are allowed by default. Visitors can opt out of marketing (sale and sharing) with one click, and a Global Privacy Control signal opts them out automatically.
• Notice. Categories are allowed. A short notice links to your cookie policy and the preference center.

Custom rules

Under Banners → Geo-targeting, click Add rule and choose:

1. Regions. Countries (ISO 3166-1, such as DE), states and provinces (ISO 3166-2, such as US-CO) or groups (EU, EEA).
2. Mode. Opt-in, opt-out or notice.
3. Default state per category for opt-out and notice modes.
4. Banner copy, if this region needs different wording, such as a “Do Not Sell or Share” title.

Drag rules to change their order. Because the first match wins, put specific rules, such as a single US state, above broad ones.

If you are unsure, use opt-in. An opt-in banner meets the strictest requirements, so it is a safe choice for any region you have not reviewed.

Global Privacy Control

Global Privacy Control is a browser signal that tells sites not to sell or share the visitor’s data. In opt-out regions, Cookiesh treats it as a valid opt-out of marketing, records the consent with the method gpc, and shows a short “Your opt-out preference signal was honored” note instead of the banner. You can enable the same behavior for any other rule.

Test your rules

Add ?cookiesh_region= with a region code to any URL on your site to simulate a visitor from that region. The override only works while debug mode is on, which you can turn on under Settings → Debug mode:

https://example.com/?cookiesh_region=US-CA
https://example.com/?cookiesh_region=DE

Then run Cookiesh.debug() in the browser console. It prints the detected region, the rule that matched, the banner shown and the current state of each category. Turn debug mode off again when you are done.