Cross-domain cookie consent means a visitor makes one choice on one of your sites and that choice applies to the other sites you run, so they are not asked again on every domain. It works when the sites share the same banner configuration and the same purposes, and when your tools can read the stored choice on each domain.

A consent management platform (CMP) is what carries the choice from one site to the next. The harder questions come after that: whether sharing is valid for your sites, and whether Google, Meta and your analytics tags on each domain actually receive the right signal. This guide covers both.

Browsers keep a cookie tied to the place that set it. MDN's documentation of the Set-Cookie header explains that a cookie without a Domain attribute is returned only to the host that sent it. With a Domain set, the cookie is available to that domain and all its subdomains.

The same page adds that the value must be the domain of the server that sends the header, or a parent of it. A cookie set by shop.example.com can cover example.com and its subdomains, but it can never be set for another-brand.com.

Subdomains are the easy case. If your sites are www.example.com, blog.example.com and app.example.com, one consent cookie scoped to the parent domain can be read by all three. Most setups handle this without anything special.

Separate domains are different. If one company runs example.com and another-brand.com, the browser will not hand one site's cookie to the other. Sharing the choice needs a method outside the cookie itself, and vendors differ in how they do it. Ask yours how the choice is stored and read back, and what happens when a visitor blocks the storage it relies on.

Technology is only half of the question. Under the GDPR, consent has to be specific, and the law defines it as a "freely given, specific, informed and unambiguous indication of the data subject's wishes" (Article 4(11)). One banner choice stretched over several sites only holds if each site means the same thing by it.

The European Data Protection Board's guidelines on consent give three tests you can apply:

• Same purpose. Consent must be given for specific purposes, and a controller that wants to use data for another purpose needs fresh consent (paragraphs 55 to 58 of the EDPB Guidelines 05/2020).
• Same choices. Each purpose needs its own opt-in, so a shared choice has to keep the same categories on every site (paragraph 60).
• Named controllers. When consent is relied on by several controllers, they should all be named (paragraph 65).

Asking once can be enough in principle, the guidelines say in paragraph 90, but a new and specific consent is needed if the purposes change. In practice that gives you a simple sorting rule:

This is a map, not legal advice. Your lawyer decides the final setting.

Most guides stop at "consent applies to all your domains". The risk sits one step later, in the tags. A banner that remembers the choice is not the same as a site whose tags obey it.

Google's consent documentation tells you to call the default consent command on every page, before any command that sends measurement data, and to send the visitor's choice with update. It also says that after consent is given, the site should persist the choice and call update on subsequent pages.

Consent Mode does not save anything itself. When a visitor lands on your second domain with a choice already made on the first, your CMP has to read it and send the update early enough. The four types to check on each site are ad_storage, analytics_storage, ad_user_data and ad_personalization. The full mechanics are in our Google Consent Mode guide.

The default command accepts a region, so a visitor from the EEA can start with denied while others start differently. If your domains serve different markets, set the regional defaults on each of them. A shared choice replaces the default only once it exists. Our guide to consent management across countries explains how those market rules fit together.

Global Privacy Control is sent by the browser to each site the visitor opens. The California Attorney General's CCPA page says it "must be honored by covered businesses as a valid consumer request". Check that your setup reads the signal on every domain, not only on the one where the visitor first arrived, and ask your lawyer how a stored choice and a signal that says otherwise should be reconciled. Our GPC explainer covers the states that require it.

Withdrawal has to travel too. Article 7(3) of the GDPR says withdrawing consent must be as easy as giving it. If a visitor reverses the choice on one domain, the other domains need to stop their tags on the next page load. Test this one directly, because it is the step teams forget.

On AdOpt, each cookie banner is a single tag that can be installed on one or more sites. The plans page, checked on 23 October 2026, lists "Cross-site consent" from the Pro plan upward and describes it as applying a single installation code across multiple sites, so that "user consent on one site will automatically apply to the others". Check the page before you plan, because plans change.

The new-site checklist is short:

1. List the domains and subdomains that will share a banner, and confirm they share purposes and notices.
2. Install the same banner tag on each one, and connect Google Tag Manager so third-party tags stay blocked until the visitor agrees.
3. Set the regional defaults for each site's audience.
4. Run the test below before the launch.

Try AdOpt on your own sites with the 30-day free trial, then compare plans once you know how many domains you need.

Use a clean browser profile, or clear cookies and local storage, between runs.

1. Open site A and refuse non-essential cookies. Open site B and confirm no analytics or advertising tag fires, and that no banner is shown again.
2. Clear everything, accept on site A, then open site B. Check in your tag tool that analytics_storage and ad_storage read granted before any measurement is sent.
3. Change your mind on site B and withdraw. Reload site A and confirm the tags stop.
4. Repeat with GPC switched on and with a visitor from another region, if you serve one.
5. Open the consent record for each domain and confirm the choice appears with the right date, time and policy version. AdOpt's Consent Log keeps the date and time, the tags and cookies accepted or refused, and the versions of your policies.

A pass on all five means the shared choice reaches the tags, not only the banner. Repeat the test whenever you add a domain or a tag, because most failures appear after a change, not on launch day.

• How to choose a CMP
• How a cookie banner works

Yes, if the sites share the same purposes, categories and privacy notice, and the CMP supports sharing the choice. For sites with different tags or different owners, a shared banner can mislead visitors about what they agreed to. Review each site before you group them.

It can. A consent cookie scoped to the parent domain is available to its subdomains, so blog.example.com can read a choice stored for example.com. A different domain such as another-brand.com cannot read that cookie, so sharing across separate domains needs another mechanism.

The GDPR does not ban it, but consent has to stay specific and informed. That means the same purposes on each site, separate choices per purpose, and controllers named when several rely on the consent. If the purposes differ, ask again instead of reusing the earlier answer.

Not always. One banner tag can serve several sites when the rules match. Use separate banners when a site has different tags, a different audience, or a different owner. AdOpt's plans list the number of cookie banners each plan includes, so count the domains before you choose.