Consent banner modes: opt-in, opt-out, informational, and do-not-sell

Consent is not one-size-fits-all. A visitor in Munich, a returning customer in Los Angeles, and a first-time reader in Singapore often need different consent experiences. That is why consent banners come in several modes, each tuned to a different legal regime and user expectation. This post covers the four most common modes, when to use each, and how they map to the laws that drive them.

Why banner modes exist

Consent rules differ by jurisdiction. The EU's ePrivacy Directive requires prior consent before non-essential trackers run (an opt-in model). Several U.S. state laws, by contrast, let trackers load by default as long as visitors can opt out. A single global banner cannot satisfy both cleanly, so modern consent tools let you choose a mode per region or per page.

The four consent banner modes

Opt-in

Non-essential trackers stay blocked until the visitor actively accepts. This is the strictest mode and the one the GDPR and ePrivacy Directive expect in Europe. Necessary trackers (the ones your site needs to function) always run. The banner should make accepting and rejecting equally easy, since bundling consent or hiding the reject option risks non-compliance.

Opt-out

Trackers load by default, and the visitor can object. This fits jurisdictions where notice plus an opt-out mechanism is the baseline rather than prior consent. The banner still needs to inform visitors what is running and give them a clear way to object.

Informational

The banner notifies visitors that trackers are present, without gating them behind an accept action. Use this only where the law actually permits implied consent, and never where prior consent is required. Misapplying informational mode in an opt-in region is a common and avoidable compliance mistake.

Do not sell or share

A targeted opt-out focused on the sale or sharing of personal information for cross-context advertising. Under the CCPA and CPRA, qualifying businesses must let consumers opt out of the sale or sharing of their data, often through a recognizable link like "Do Not Sell or Share My Personal Information." Colorado's privacy law similarly requires honoring opt-out preference signals.

How to choose

• Start from where your visitors are. EU and UK traffic means opt-in for non-essential trackers.
• For California and Colorado, add a do-not-sell-or-share path and honor opt-out preference signals like Global Privacy Control.
• Keep necessary trackers outside the consent choice entirely. They are not optional.
• Record each visitor's decision so you can evidence it later.

Banner modes are the bridge between the law and what your visitor actually sees. Pick the mode that matches each region, keep the necessary trackers untouched, and record the choice. The right mode is the one that fits your visitors' jurisdiction, not the one that is easiest to ship.

Materially reviewed July 11, 2026. Regulatory and implementation guidance is general information, not legal advice.