Regions & domains
Choose regional behavior, trusted hosts and optional consent sharing across subdomains.
Regional rules choose the consent behavior for an audience. Domain settings choose where the published configuration is trusted and where a visitor’s saved choice can be shared. Configure both in the intended project environment.
Geotargeting & regional rules
Cookie automatically selects the regional rule using the country and subdivision estimated from the visitor’s direct request to Cookie Edge. It does not request browser location permission. The default rule applies when the location is unavailable or no configured audience matches.
Rules can match the European Economic Area group, selected countries or subdivisions such as US-CA. A subdivision rule takes precedence over a country rule, and a country rule over a group. The EEA group does not include the United Kingdom or Switzerland; add them explicitly when needed. Preview the resolved rule for a representative location, including the fallback used when no more specific rule applies.
Regional rules lists Everywhere else first, then your rules in the order they apply. Choose Edit in a rule's actions menu to change it in a side panel, and use Preview a visitor to see which draft rule applies to a location without changing your live banner.
GPC is a browser privacy signal. When a rule honors it, the banner shows a short Opt-out request honored status, as California requires since 2026; visitors open its details by hovering, focusing or tapping it, and preferences show the full message. Edit both texts in Content & languages → Service messages as Global Privacy Control status and Global Privacy Control details; Banner design & content covers translations and regional content. Test GPC in a fresh browser context and inspect the resulting policy; it is not interchangeable with an analytics-category choice. US privacy choices and category preferences have distinct purposes.
Visitors in the United States, or whose location is unknown, see the sale and sharing and targeted advertising opt-outs as a group of their preferences when a published service involves those purposes. Saving preferences saves purposes and opt-outs together, and changing only the opt-outs keeps the earlier category choice. Accepting all never changes the opt-outs, and an honored GPC signal locks them. Visitors elsewhere see only the purposes.
Rules describe the behavior you select. Review which configuration and disclosures are appropriate for your website before publishing.
US privacy signals (IAB GPP)
Advertising partners in the United States, such as Google AdSense and Ad Manager, read privacy choices through the IAB Global Privacy Platform. Turn on Report US privacy choices (IAB GPP) in Services → Google and US privacy signals to share the visitor's sale and sharing, targeted advertising and Global Privacy Control choices through the __gpp API (US National section). It changes no banner text and does not ask visitors to choose again.
With the website script, the installation snippet starts with a small GPP stub; keep it before your advertising tags so they can wait for the visitor's choices. With Google Tag Manager, add that stub to your page head outside the container. Visitors outside the United States get no applicable section.
Select a Multi-State Privacy Agreement mode only if your company signed the IAB MSPA. GPP does not cover advertising in the European Economic Area, which requires IAB TCF and a Google-certified CMP that SiteOS does not provide.
Trusted hosts
Explicitly list allowed hostnames within the same root domain, including the project’s canonical host, in Settings → General → Domains. Changes apply when you publish. Wildcards and unrelated domains are not allowed in this list. An environment binding is not inferred from matching names or URLs.
For example, example.com, www.example.com and shop.example.com can be reviewed as one trusted set. another-company.com cannot be added as another host in that set.
Share a choice across subdomains
Consent is host-scoped unless you explicitly configure a shared parent domain with Remember choices across subdomains in Settings → General; publishing that change asks visitors to choose again. A shared consent cookie can let trusted subdomains reuse the visitor’s choice. All participating hosts must use the intended compatible configuration. Browsers cannot limit a parent-domain cookie to the listed hosts, so enable sharing only when every subdomain under that parent is trusted.
This does not share consent across unrelated websites. Keep production and test environments separate rather than relying on a broadly scoped cookie to connect them.
Verify the resolved configuration
Your agent can inspect which published or draft rule applies to a location:
After publication, test both the initial choice and reopening preferences on each participating host. Check a rejected choice as well as an accepted one, and include GPC when using an opt-out rule. Saved cloud scans also check rejection, acceptance, withdrawal and a Global Privacy Control visit on the environment’s website.