One Banner, Two Rulebooks: Geolocating Consent for EU and US Visitors
A visitor from Berlin gets an opt-in banner. A visitor from Texas gets a notice with an opt-out link. The site serves both from the same codebase, and the geolocation that decides which banner appears is doing legal work, which means it has to be right, and the choice it records has to stay on the right side of the border.
Two regimes, one site
The EU regime is opt-in. Under the GDPR and the ePrivacy Directive, a site needs consent before it sets non-essential cookies or reads identifiers, and the consent has to be freely given, specific, and informed. The US regime is mostly opt-out, and it varies by state: California's CCPA as amended gives residents the right to opt out of the sale and sharing of personal information and to limit sensitive data use, while other states have their own thresholds and definitions. A banner that shows the EU opt-in flow to a US visitor is annoying. A banner that shows the US opt-out flow to an EU visitor is a violation, because it sets trackers before consent that was never given.
The geolocation decides which regime applies, and it has to be accurate enough to trust. IP-based geolocation is the usual method, and it is wrong often enough to matter: VPNs, corporate egress, mobile carriers routing through another country, and IPv6 tunnels all produce a location that is not the visitor's. A visitor in France on a VPN endpoint in Virginia gets the US banner, and the site sets marketing cookies before consent. That is a real exposure, not a theoretical one, and it is the reason the geolocation logic needs a fallback and a test plan.
The rules for getting it right
First, default to the stricter regime when the location is uncertain. If the geolocation is ambiguous, show the opt-in banner, because an EU visitor who gets an unnecessary opt-in loses a little convenience, while an EU visitor who gets an opt-out flow loses their legal protection. Second, do not reuse a choice across regimes. A choice made under the US opt-out rules is not consent under the GDPR, and a consent given under the GDPR is not an opt-out under California law. When the visitor's location changes, or the rules change, ask again. Third, log the location basis with the choice, because the record that says accepted is meaningless if you cannot show which rulebook applied.
Test it the way a regulator would: from a VPN endpoint in each region, on mobile and desktop, with the browser language set to the local language, and confirm the right banner appears and the right trackers are blocked before consent. For the string that carries the consent, see Reading the IAB TCF Consent String by Hand, and for the translation side, Auditing Consent Banner Translations: The Language Mismatch.
The banner that travels
The hardest case is the visitor who crosses the border: a European traveling in the US, or an American working in Berlin for a month. Their stored choice was made under one regime and is now being read under another. The safe behavior is to re-ask when the detected region changes, because a choice made under one set of rules should not be reused when another set applies. It costs the visitor one extra click. It saves the site from enforcing a consent that was never given under the rules that now apply.
Frequently asked questions
Why do EU and US visitors see different banners?
The regimes are different. The EU requires opt-in consent before non-essential tracking. Most US states use opt-out, with California's CCPA as amended giving residents a right to opt out of sale and sharing. One banner cannot satisfy both.
What happens if geolocation gets the region wrong?
An EU visitor shown the US opt-out flow gets trackers set before consent that was never given, which is a violation. VPNs, corporate egress, and mobile routing all produce wrong locations often enough to matter.
Should we default to opt-in when the location is uncertain?
Yes. An EU visitor who gets an unnecessary opt-in loses a little convenience. An EU visitor who gets an opt-out flow loses their legal protection. Default to the stricter regime.
Can a choice made in the US be reused in the EU?
No. A choice made under opt-out rules is not consent under the GDPR, and a GDPR consent is not a CCPA opt-out. When the detected region changes, ask again.