Colorado privacy act cookie banner: Cookie Consent Rules
The Cookie Consent Rules carries 3 published figures read from 1 source's own page, from 10,000,000 to 20,000,000 EUR, read 17 October 2026.
Cookievo sells its own paid plan in this category (our pricing). It is not counted here: every figure in this index is another provider's own published price, read from its own page.
3 of the 27 named sources read in full publish a figure; 24 publish none, read 17 October 2026.
By requirement
| Breakdown | Median | Range | Sources |
|---|---|---|---|
| requirementGDPR Article 83(4): maximum administrative fine | 10,000,000EUR | 10,000,000 to 10,000,000EUR | 1 |
| requirementGDPR Article 83(5): maximum administrative fine | 20,000,000EUR | 20,000,000 to 20,000,000EUR | 1 |
| requirementGDPR Article 83(6): non-compliance with a supervisory authority order | 20,000,000EUR | 20,000,000 to 20,000,000EUR | 1 |
| requirementQuebec: notice before creating a biometric database | 60day | 60 to 60day | 1 |
| requirementAustralia: agency response to an access request | 30day | 30 to 30day | 1 |
| requirementGDPR Article 8(1): age at which a child can consent to information society services | 16year | 16 to 16year | 1 |
| requirementGDPR Article 8(1): lowest age of consent a member state may set | 13year | 13 to 13year | 1 |
| requirementGDPR Article 12(3): time to act on a data subject request | 1month | 1 to 1month | 1 |
Every figure, with its source
One row per published figure: the figure as the source's own page publishes it, the page, and the day it was read. A figure that is not on a page we read is not on this one.
| Source | Figure | Breakdown | Read |
|---|---|---|---|
| GDPR (Regulation 2016/679) official text | 20,000,000EUR | GDPR Article 83(5): maximum administrative fine | 2026-10-16 |
| GDPR (Regulation 2016/679) official text | 20,000,000EUR | GDPR Article 83(6): non-compliance with a supervisory authority order | 2026-10-16 |
| GDPR (Regulation 2016/679) official text | 10,000,000EUR | GDPR Article 83(4): maximum administrative fine | 2026-10-16 |
| CAI Quebec - principaux changements de la loi 25 | 60day | Quebec: notice before creating a biometric database | 2026-10-17 |
| OAIC - read the Australian Privacy Principles | 30day | Australia: agency response to an access request | 2026-10-17 |
| GDPR (Regulation 2016/679) official text | 16year | GDPR Article 8(1): age at which a child can consent to information society services | 2026-10-16 |
| GDPR (Regulation 2016/679) official text | 13year | GDPR Article 8(1): lowest age of consent a member state may set | 2026-10-16 |
| GDPR (Regulation 2016/679) official text | 1month | GDPR Article 12(3): time to act on a data subject request | 2026-10-16 |
The sentence each figure was read from (8)
- GDPR (Regulation 2016/679) official text, read 2026-10-16:
Infringements of the following provisions shall, in accordance with paragraph 2, be subject to administrative fines up to 20 000 000 EUR, or in the case of an undertaking, up to 4 % of the total worldwide annual turnover of the preceding financial year, whichever is higher:
- GDPR (Regulation 2016/679) official text, read 2026-10-16:
Non-compliance with an order by the supervisory authority as referred to in Article 58(2) shall, in accordance with paragraph 2 of this Article, be subject to administrative fines up to 20 000 000 EUR, or in the case of an undertaking, up to 4 % of the total worldwide annual turnover of the preceding financial year, whichever is higher.
- GDPR (Regulation 2016/679) official text, read 2026-10-16:
Infringements of the following provisions shall, in accordance with paragraph 2, be subject to administrative fines up to 10 000 000 EUR, or in the case of an undertaking, up to 2 % of the total worldwide annual turnover of the preceding financial year, whichever is higher:
- CAI Quebec - principaux changements de la loi 25, read 2026-10-17:
La Loi prévoit un nouveau délai pour divulguer à la Commission (PDF, 326 Ko) la création d’une banque de caractéristiques ou de mesures biométriques. Celle-ci doit désormais être divulguée à la Commission au plus tard 60 jours avant sa mise en service.
- OAIC - read the Australian Privacy Principles, read 2026-10-17:
if the entity is an agency — within 30 days after the request is made; or
- GDPR (Regulation 2016/679) official text, read 2026-10-16:
Where point (a) of Article 6(1) applies, in relation to the offer of information society services directly to a child, the processing of the personal data of a child shall be lawful where the child is at least 16 years old.
- GDPR (Regulation 2016/679) official text, read 2026-10-16:
Member States may provide by law for a lower age for those purposes provided that such lower age is not below 13 years.
- GDPR (Regulation 2016/679) official text, read 2026-10-16:
In the cases referred to in Article 11(2), the controller shall not refuse to act on the request of the data subject for exercising his or her rights under Articles 15 to 22, unless the controller demonstrates that it is not in a position to identify the data subject. The controller shall provide information on action taken on a request under Articles 15 to 22 to the data subject without undue del
Read in full, publishes no figure
24 named sources were read in full on the dates shown and print no usable figure. They are counted, never filled in.
- ICO guide to PECR: cookies and similar technologies, read 2026-10-19: read in full and no accepted figure on the page
- PECR 2003 regulation 6 (statute text), read 2026-09-12: read in full and no accepted figure on the page
- CNIL - les regles a suivre pour les cookies, read 2026-10-17: read in full and no accepted figure on the page
- CNIL lignes directrices modificatives et recommandation, read 2026-10-17: every candidate on the page was refused
- CNIL questions-reponses on the cookie guidelines, read 2026-10-17: read in full and no accepted figure on the page
- EDPB report of the cookie banner taskforce, read 2026-09-26: read in full and no accepted figure on the page
- ePrivacy Directive 2002/58/EC (consolidated text), read 2026-10-17: every candidate on the page was refused
- California Attorney General - CCPA, read 2026-09-11: read in full and no accepted figure on the page
- CPPA regulations index, read 2026-10-17: read in full and no accepted figure on the page
- CPPA - the California Consumer Privacy Act regulations, read 2026-09-26: read in full and no accepted figure on the page
- OAIC - tracking pixels and privacy obligations, read 2026-09-12: read in full and no accepted figure on the page
- OAIC - Australian Privacy Principles guidelines, read 2026-09-12: every candidate on the page was refused
- OPC Canada - guidelines on privacy and online behavioural advertising, read 2026-09-26: read in full and no accepted figure on the page
- OPC Canada - policy position on online behavioural advertising, read 2026-09-26: every candidate on the page was refused
- Garante - cookie topic index, read 2026-10-17: read in full and no accepted figure on the page
- Garante - linee guida cookie e altri strumenti di tracciamento (10 giugno 2021), read 2026-10-03: read in full and no accepted figure on the page
- Datatilsynet (Denmark) English index, read 2026-09-12: read in full and no accepted figure on the page
- CAI Quebec - lois et reglements, read 2026-09-26: read in full and no accepted figure on the page
- Irish DPC - guidance on cookies and other tracking technologies, read 2026-09-12: read in full and no accepted figure on the page
- Irish DPC - what is the law on the use of cookies?, read 2026-09-12: read in full and no accepted figure on the page
- AEPD - update to the guia sobre el uso de las cookies, read 2026-10-10: read in full and no accepted figure on the page
- AEPD guia sobre el uso de las cookies (PDF), read 2026-09-12: read in full and no accepted figure on the page
- Colorado Attorney General - universal opt-out mechanisms, read 2026-09-12: read in full and no accepted figure on the page
- Colorado Attorney General - Colorado Privacy Act, read 2026-09-12: read in full and no accepted figure on the page
Methodology
Every row is a verbatim sentence read from the named source's own page through our fetch service on the date shown, hash-pinned to the stored read (the sha of the page's visible text; the raw page is mirrored to R2).
3 of the 27 named sources that could be read published a usable figure; 24 published none and are recorded as not published, never filled in; 3 could not be read (blocked, dead or unreachable) and count nowhere.
The headline figures (median, minimum, maximum, quartiles) are over ONE figure per source for each breakdown it prices, in EUR (a source's median where its page yielded several accepted sentences for one breakdown), so a page that gives figures for several breakdowns gives one for each and N counts 3 figures, never sentences; 49 candidate sentence(s) were refused by a reviewer with the reason recorded.
The fuller derivation this dataset is chartered to grow into (not yet what the figures above are; they are each source's own published figure as read): one row per jurisdiction per requirement, each quoted verbatim from that jurisdiction's own authority with the effective date and the article or regulation it sits in; across the rows, the comparison nobody publishes - which requirements are universal, which are EU-only, where the US state regimes diverge from consent-first, and which jurisdictions exempt analytics - plus the changed-since diff every time an authority reissues its guidance, which is the news when a regulator moves
49 candidate sentences on these pages were refused by a reviewer; each refusal and its reason is recorded in the review ledger.
Sources (30)
- ICO guide to PECR: cookies and similar technologies(the publisher's own terms; quoted for reporting and comment)
- PECR 2003 regulation 6 (statute text)(the publisher's own terms; quoted for reporting and comment)
- CNIL - les regles a suivre pour les cookies(the publisher's own terms; quoted for reporting and comment)
- CNIL lignes directrices modificatives et recommandation(the publisher's own terms; quoted for reporting and comment)
- CNIL questions-reponses on the cookie guidelines(the publisher's own terms; quoted for reporting and comment)
- EDPB report of the cookie banner taskforce(the publisher's own terms; quoted for reporting and comment)
- ePrivacy Directive 2002/58/EC (consolidated text)(the publisher's own terms; quoted for reporting and comment)
- GDPR (Regulation 2016/679) official text(the publisher's own terms; quoted for reporting and comment)
- California Attorney General - CCPA(the publisher's own terms; quoted for reporting and comment)
- CPPA regulations index(the publisher's own terms; quoted for reporting and comment)
- CPPA - the California Consumer Privacy Act regulations(the publisher's own terms; quoted for reporting and comment)
- OAIC - tracking pixels and privacy obligations(the publisher's own terms; quoted for reporting and comment)
- OAIC - Australian Privacy Principles guidelines(the publisher's own terms; quoted for reporting and comment)
- OAIC - read the Australian Privacy Principles(the publisher's own terms; quoted for reporting and comment)
- OPC Canada - guidelines on privacy and online behavioural advertising(the publisher's own terms; quoted for reporting and comment)
- OPC Canada - policy position on online behavioural advertising(the publisher's own terms; quoted for reporting and comment)
- Garante - cookie topic index(the publisher's own terms; quoted for reporting and comment)
- Garante - linee guida cookie e altri strumenti di tracciamento (10 giugno 2021)(the publisher's own terms; quoted for reporting and comment)
- Datatilsynet (Denmark) English index(the publisher's own terms; quoted for reporting and comment)
- Legifrance - article 82, loi Informatique et Libertes(the publisher's own terms; quoted for reporting and comment)
- ICO guidance on the use of storage and access technologies (PDF)(the publisher's own terms; quoted for reporting and comment)
- CAI Quebec - principaux changements de la loi 25(the publisher's own terms; quoted for reporting and comment)
- CAI Quebec - lois et reglements(the publisher's own terms; quoted for reporting and comment)
- Irish DPC - guidance on cookies and other tracking technologies(the publisher's own terms; quoted for reporting and comment)
- Irish DPC - what is the law on the use of cookies?(the publisher's own terms; quoted for reporting and comment)
- AEPD - update to the guia sobre el uso de las cookies(the publisher's own terms; quoted for reporting and comment)
- AEPD guia sobre el uso de las cookies (PDF)(the publisher's own terms; quoted for reporting and comment)
- Colorado Attorney General - universal opt-out mechanisms(the publisher's own terms; quoted for reporting and comment)
- Colorado Attorney General - Colorado Privacy Act(the publisher's own terms; quoted for reporting and comment)
- edpb.europa.eu(the publisher's own terms; quoted for reporting and comment)
Cite or embed this figure
Cite or embed this figure
The Cookie Consent Rules carries 3 published figures read from 1 source's own page, from 10,000,000 to 20,000,000 EUR, read 17 October 2026.
3 of the 27 named sources read in full publish a figure; 24 publish none, read 17 October 2026.
Cookie Consent Rules, requirement GDPR Article 83(4): maximum administrative fine: median 10,000,000 EUR across 1 source, read 17 October 2026.
Cookie Consent Rules, requirement GDPR Article 83(5): maximum administrative fine: median 20,000,000 EUR across 1 source, read 17 October 2026.
Cookie Consent Rules, requirement GDPR Article 83(6): non-compliance with a supervisory authority order: median 20,000,000 EUR across 1 source, read 17 October 2026.
Cookie Consent Rules, requirement Quebec: notice before creating a biometric database: median 60 day across 1 source, read 17 October 2026.
Cookie Consent Rules, requirement Australia: agency response to an access request: median 30 day across 1 source, read 17 October 2026.
Cookie Consent Rules, requirement GDPR Article 8(1): age at which a child can consent to information society services: median 16 year across 1 source, read 17 October 2026.
Cookie Consent Rules, requirement GDPR Article 8(1): lowest age of consent a member state may set: median 13 year across 1 source, read 17 October 2026.
Cookie Consent Rules, requirement GDPR Article 12(3): time to act on a data subject request: median 1 month across 1 source, read 17 October 2026.
Cite as: "Cookievo Cookie Consent Rules", updated 2026-10-21, https://cookievo.com/datasets/cookie-consent-rules/.
Download the CSV (8 rows, computed 2026-10-21)