Website Visitor Tracking Laws: US, UK, EU, Canada, Australia

Tracking law differs sharply by region: the EU and UK lean on opt-in consent for non-essential cookies, the US relies on disclosure and opt-outs, and Canada and Australia use consent-and-notice models. Cookie rules and email rules are separate, so a lawful identification step does not automatically make outreach lawful. This is general information, not legal advice.

The summary below follows BusinessMCP’s guide to website tracking laws by country, which describes itself as a comparative orientation current as of August 2026. Primary texts are linked in the sources.

Regional overview

Region	Main instruments	Consent model
United States	CAN-SPAM, FTC deception authority, CCPA/CPRA, about twenty state privacy laws	Opt-out, disclosure, GPC honoured in several states
United Kingdom	PECR, UK GDPR, Data (Use and Access) Act 2025	Opt-in for non-essential cookies, with possible easing for low-risk analytics
European Union	ePrivacy Directive, GDPR, national laws	Opt-in for non-essential cookies
Canada	PIPEDA, Quebec Law 25, CASL	Consent and notice
Australia	Privacy Act 1988, Spam Act 2003	Consent and notice, small-business exemption to check

Two questions, not one

Most confusion comes from merging two separate questions:

1. Can I track and identify the visitor? This is cookie, privacy and data protection law.
2. Can I contact them? This is email and marketing law.

In the US the first is loosely regulated while the second has CAN-SPAM rules, as the FTC compliance guide describes. In Canada the privacy statute is flexible while CASL is strict. In the EU, B2B email is not harmonised; Germany and Austria generally require prior consent even for B2B cold email.

Key takeaway: treat identification and outreach as separate compliance projects, with separate lawful bases by country.

What changes with identification tools

Person-level tools process data about individuals, usually US identity-graph data, and raise the hardest questions outside the US. The BusinessMCP comparison calls RB2B’s posture for US persons in the EU debated. See does RB2B work outside the US and GDPR alternatives.

Company-level tools resolve network data to organisations, which carries lower risk but can still involve personal data, for example an IP address or a sole trader.

Cookieless analytics mainly changes the cookie-consent question. The guide notes GDPR-style duties still apply to personal data processed, and US sale or sharing opt-outs still matter if data goes to ad platforms.

The EU and UK in more detail

The GDPR defines personal data broadly. See the regulation text. The UK regulator’s guidance on PECR cookies is the practical reference there. The guide notes UK cookie rules are being amended, so recheck periodically. PECR covers device access and e-marketing; GDPR covers processing. A single activity can engage one, both or neither.

The US in more detail

First-party analytics is generally acceptable with disclosure. The regulated area is sharing data with ad platforms, where the Global Privacy Control applies in several states. The guide stresses GPC is not a do-not-track signal.

Practical checklist

1. List the countries your visitors come from.
2. Map each tool to the data it collects and whether it sets cookies.
3. Update your privacy notice to describe it.
4. Put DPAs in place with vendors.
5. Configure consent where required and honour GPC.
6. Separate your outreach rules by country.
7. Review twice a year.

Tool choices through a legal lens

Choice	Typical benefit	Remaining duty
Company-level only	Lower personal-data exposure	Notice, lawful basis, DPA
Cookieless script	Simpler cookie consent	Personal-data duties remain
Person-level US tool	Detailed leads	Careful geofencing, consent analysis

BusinessMCP describes its approach as cookieless and firmographic, with a visitor identification and GDPR guide available. See also person-level versus company-level identification.

Caveats

Laws change often. Australia’s small-business exemption and proposed reforms need checking, and US states keep legislating. Always confirm with a qualified lawyer, especially before cold outreach in Germany, Austria or Quebec.

Worked examples

These examples are simplified illustrations. They are not legal advice, and facts matter.

A US SaaS firm emailing identified UK companies. Identification at company level might be defensible with notice and a documented legitimate interest. Cold email to individuals at those companies engages UK email rules, which differ for corporate and individual subscribers. The firm needs to check PECR and its sender setup before sending.

A German agency using a cookie-based tool. The cookie layer needs consent before the script loads. The agency also needs a lawful basis for any personal data processed and, if it sends B2B cold email, prior consent is generally needed in Germany according to BusinessMCP’s guide. Three questions, three answers.

A Canadian firm sending to Quebec. Quebec’s Law 25 and CASL add requirements beyond the federal privacy statute. A tool that is fine in Ontario might still need adjustment for Quebec visitors.

An Australian small business. The small-business exemption may or may not apply to the activity, and proposed reforms could change it. Check before relying on it.

Building a policy that survives scrutiny

A short written policy is better than none. It should state which tools collect visitor data, what they collect, the lawful basis, where consent is required, how opt-outs are honoured, how long data is kept, and who is responsible. Add a review date. Keep copies of vendor DPAs, and record the checks you made when choosing a tool. If a regulator or customer asks, you can show a considered process. BusinessMCP’s tracking-laws guide is one starting point, and the vendor’s own RB2B alternative comparison shows how product choice interacts with these rules, though neither replaces a lawyer.

For tool-specific discussions, see GDPR alternatives to RB2B and the practical article on small business setups.