Do you need a cookie banner in the US and Canada? Consent for B2B websites compared with GDPR

Most European B2B websites run an opt-in banner because Article 5(3) of the ePrivacy Directive requires consent before storing or accessing information on a user’s device unless an exemption applies. The European Data Protection Board’s Guidelines 2/2023 extended that reading to tracking pixels, tracking links and some fingerprinting. Email has separate rules, set out in our comparison of GDPR, CASL and CAN-SPAM.

Copying that banner to North American traffic has a cost: in our experience opt-in banners reduce the share of visits that can be measured and retargeted, which hurts the paid programs you are funding to build pipeline there. Removing consent entirely has a different cost: exposure in California, other US states and Quebec. The answer is a banner that behaves differently by region.

This is a marketer’s summary of the rules most likely to touch a B2B website. It is not legal advice; confirm your setup with counsel.

There is no federal US equivalent of the ePrivacy cookie rule. The obligations come from state laws, and California’s is the one most B2B companies meet first. The California Privacy Protection Agency’s FAQ lists the thresholds: annual gross revenue of $26.625 million or more, buying, selling or sharing the personal information of 100,000 or more California residents or households, or deriving half of revenue from selling or sharing it.

Two points matter for B2B marketers. First, the CCPA’s exemptions for business-to-business and employee data expired on December 31, 2022, so business contacts are covered. Second, consumers can ask businesses to stop selling or sharing their data, including for cross-context behavioral advertising, and businesses must honor opt-out preference signals such as Global Privacy Control. If your LinkedIn Insight Tag, Google tags or retargeting pixels share data for advertising, they sit inside that opt-out.

California is not alone. Bloomberg Government counted 20 states with comprehensive consumer privacy laws in September 2024. Their details differ, so the practical approach is to apply the California-grade opt-out and Global Privacy Control handling to all US traffic rather than maintaining a state-by-state map in your tag manager.

Quebec’s Law 25 brought most of its amendments into force on September 22, 2023. Section 8.1 requires businesses that collect personal information with technology that can identify, locate or profile a person to inform them and to explain how to activate those functions. McCarthy Tétrault reads the word activate as meaning such functions should be deactivated by default, while noting that guidance on cookies is still limited.

For a B2B site this means visitors from Quebec should be treated closer to European visitors than to US ones: profiling and advertising tags off until the visitor turns them on. Elsewhere in Canada, the federal standard is meaningful consent under PIPEDA. Our Law 25 consent guide covers how to collect and record consent for Quebec contacts.

This is the configuration we build for European companies with North American traffic. It keeps one consent platform and one tag manager, with rules by region.

1. Detect region at the consent platform level: EEA and UK, Quebec, rest of Canada, US.
2. Set defaults per region: denied until consent for the EEA, UK and Quebec; granted with notice and a visible opt-out for the US and the rest of Canada, subject to counsel’s review.
3. Honor Global Privacy Control automatically for US visitors and record the opt-out against the visitor and, once known, the contact.
4. Pass consent state to Google tags through consent mode and to LinkedIn and other platforms through their consent settings, so the platforms receive the signals they expect.
5. Send qualified conversions from the CRM server-side, through Google offline conversion imports and the LinkedIn Conversions API, so measurement does not depend on browser cookies that visitors declined.

The last step is what protects pipeline reporting. Server-side imports move the conversion that matters, a qualified meeting or opportunity, from the browser to the CRM. Our server-side tracking guide explains the setup in detail.

These are the gaps we find most often in consent audits for European companies.

• One global banner configured for the EEA and applied to every country, with North American retargeting audiences that never grow.
• A US opt-out link that updates the banner but not the tags, so data keeps flowing to ad platforms.
• Global Privacy Control ignored because the consent platform was set up before it mattered.
• Quebec treated as the rest of Canada because the platform only detects countries, not provinces.
• Consent state never reaching the CRM, so sales tools and email tracking work outside the visitor’s choice.

Our RevOps team configures consent platforms, tag managers and server-side conversion imports, and works with your counsel on the defaults.

We do this for clients across the United States and Canada, so the regional rules above are part of everyday setup rather than a special project.

If your North American site still runs the European banner, talk to our team about a region-aware setup that keeps pipeline measurable.