Privacy ComplianceConsent Banners
Should Subdomains Share Consent? Why It May Depend on the Choice
Many businesses run their websites, stores, booking tools, and help centers on different subdomains. Consent banners usually record visitors' choices in browser cookies, which may not follow them from one subdomain to the next by default. However, regulators expect opt-outs to follow consumers across devices and services, while agreement to tracking should stay within the scope that visitors understood.
By Alex Proctor
Published October 21, 2026
Summary
Cross-subdomain consent refers to whether visitors' web tracking choices on businesses' main pages also apply on parts of their websites that run on other subdomains, such as stores or help centers. Consent platforms can share choices across subdomains when they are configured to do so, and across separate domains only imperfectly. The tension is that regulators expect opt-outs to reach as far as possible, while agreement to tracking has to be specific and may not extend to subdomains that visitors see as separate services. I recommend that businesses decide deliberately which choices their banners share across subdomains, and confirm what happens to both kinds of choice at each handoff to another domain.
How Do Choices Carry Across Subdomains?
Because consent banners usually store visitors' choices in cookies, browser rules decide where those choices can be read. Browser documentation explains that a cookie can be made available to a domain "and all its subdomains," but that a cookie set without that instruction is returned only to the address that created it. As a result, whether a choice made on www.example.com also applies on shop.example.com is usually a setting in the consent platform.
| Where Visitors Go Next | Does the Choice Carry Over? |
|---|---|
| Another page on the same subdomain | Yes |
| Another subdomain, such as a store | Only if the banner is configured to share it |
| Another domain the business owns | Only partly, through workarounds |
| A page hosted on a vendor's domain | Rarely, and only with the vendor's cooperation |
Based on browser documentation published by MDN, as of October 2026.
Can Choices Carry Across Separate Domains?
Separate domains pose a greater challenge than subdomains, because websites cannot set cookies for other domains. Sharing a choice between them typically requires an imperfect workaround.
For example, consent platforms may store the choice on a central domain that every website reads, but this relies on third-party cookies. Several major browsers block these by default.
Another method passes the choice in the address when visitors follow a link from one domain to another. It generally works in every browser, but only for visitors who use that link. The most reliable method applies to visitors who are logged in, whose choices can be saved with their accounts and applied wherever they log in.
Should Opt-Outs Be Shared?
Opt-outs should generally be shared widely, because regulators expect them to travel. California's regulations require an opt-out preference signal to be applied to "that browser or device and any consumer profile associated with that browser or device," and to the consumer when the consumer is known. In 2026, Connecticut's Attorney General wrote that an opt-out "must apply to all devices which a consumer uses to log into an account maintained by the controller, including on mobile apps."
Regulators have enforced this. In February 2026, California's Attorney General announced a $2.75 million settlement with Disney, whose opt-out toggles applied only to the streaming service a user was watching, and often only to one device. The Attorney General stated that businesses "can't force people to go device-by-device or service-by-service."
These rules speak of devices, accounts, and services rather than subdomains. I am not aware of a U.S. rule that specifically requires anonymous visitors' banner choices to follow them from one subdomain to another. However, regulators clearly expect opt-outs to reach as far as businesses can carry them, which on subdomains is usually a matter of configuration. The Global Privacy Control avoids much of the problem, because browsers send it to every website that visitors open.
Should Agreement to Tracking Be Shared?
Agreement to tracking should be shared more cautiously. California defines consent as "specific, informed, and unambiguous" agreement "for a narrowly defined particular purpose." Agreement given on a main website does not necessarily extend to a store or booking subdomain, especially one that looks like a separate service or tracks more than the main website. The clearest risk is consent collected on pages with little tracking disclosed, then carried to a subdomain that expands the scope of tracking.
Wiretapping law points the same way. In an early website tracking case, a federal appeals court wrote that a party "may consent to the interception of only part of a communication or to the interception of only a subset of its communications." It added that courts must examine "the dimensions of the consent" and whether the interception "exceeded those boundaries."
Spain's data protection authority allows one consent interaction to cover several domains of the same publisher, but only if the domains are similar and visitors are told which domains will use cookies, what types of cookies, and for what purposes. Where the domains differ, it calls for additional precautions.
This creates an asymmetry, because sharing an opt-out across subdomains is consistent with what regulators expect, while sharing agreement to tracking is hard to defend unless the subdomains look and work like one website. The challenge is that the same setting usually carries both kinds of choice, so banners that share opt-outs across subdomains typically share agreement to tracking in the same way. Devices and apps differ from subdomains, but a similar principle applies to both.
Where Is the Legal Exposure Greatest?
When choices are shared, the consent model makes little difference, because visitors' own decisions apply on every subdomain. When choices are not shared, each subdomain falls back to its default:
| What Is Shared | Opt-In Model | Opt-Out Model |
|---|---|---|
| Tracking acceptance | Moderate risk
| Moderate risk
|
| Tracking rejection | Low risk
| Low risk
|
| Nothing | Moderate risk
| High risk
|
My view of the legal risk, with the effects on prompts and data.
Asking visitors again has costs under either model. Europe's data protection board warns that repeated requests can cause "click fatigue," in which "the actual warning effect of consent mechanisms is diminishing." California also requires businesses to wait at least 12 months before asking consumers who opted out of the sale or sharing of their personal information to consent again. Banners that ask those visitors for consent on another subdomain may sit uneasily with that rule.
The greatest exposure is on sensitive pages, such as booking tools and patient portals, which often run on another domain and can reveal health or financial information. A federal complaint filed in June 2026 alleges that a healthcare organization's patient portal, reached after its booking process, "keeps on tracking."
Lost rejections are the most likely to appear in litigation, because wiretapping claims regularly allege tracking that continued after visitors declined it. Logged-in customers raise the stakes further, because regulators expect their opt-outs to follow their accounts. As far as I know, no court has yet ruled on a consent choice that failed to carry over.
What Reduces the Risk?
Businesses have a few common ways to reduce the risk:
- Choose which subdomains a choice covers. Consent platforms can generally be configured to store choices for a domain and all of its subdomains. Where a subdomain performs more tracking than the main website, a separate banner configuration there can let visitors decide again.
- Tell visitors specifically what a shared choice covers. When consent is shared across subdomains, the banner or privacy notice can name the subdomains it applies to and the tracking that runs on them.
- Save opt-outs with profiles and accounts. For known visitors, opt-outs can be applied to their profiles and accounts as well as their browsers.
- Treat vendor-hosted pages as separate. Each one has its own tools and its own consent experience.
I recommend that businesses map the subdomains and domains that visitors pass through, and confirm what happens to both opt-outs and consent at each one.
Questions
Which choice applies when visitors choose differently on two subdomains?+
Generally, the most recent one, when choices are shared. Each new choice replaces the shared record, so it applies on every subdomain from then on. That helps visitors who change their minds, but an acceptance given on a subdomain that performs less tracking can also switch on broader tracking across the main website. With separate records, each subdomain keeps its own choice.
Are businesses responsible for tracking on pages that vendors host?+
Possibly, depending on the facts. California's regulations describe a first party as the business that consumers intend and expect to interact with. Visitors who move from companies' websites to their branded booking or checkout pages may not realize that the address changed. Businesses should know which tools run on those pages and what their contracts with the vendors allow.
Does the Global Privacy Control carry across subdomains?+
Yes, for the opt-outs it represents. Browsers send the signal to every subdomain and domain, so an opt-out of sale and sharing does not depend on a record stored on one of them. However, it only helps visitors who have enabled the signal. Other choices that visitors make in consent banners still depend on how each banner shares them.
Briefings are informational and do not constitute legal advice.
Not sure your banner works?
I'll check whether visitor choices are honored.
Website Privacy Audits include a detailed video review of your live site, a written report for your team or counsel, and a remediation review call. Priority audits add 72-hour delivery and testing of demand letter claims.
Standard $449. Priority $649.
My audits are most useful when you have a consent management setup to validate, a demand letter with specific claims to assess, or a team or client that needs an external web privacy expert. If you already know you have major gaps, your budget may be better spent addressing them directly. I recommend Captain Compliance, the platform I help build, for privacy technology needs.