Which US state privacy laws affect your cookie banner?

All posts

Nineteen US states have a comprehensive privacy law in force, Florida has a narrower one, and four more are signed. None requires EU style opt in for ordinary cookies. Each expects a working opt out of sale and targeted ads, and twelve, including California, Colorado, Texas and New Jersey, require you to honour Global Privacy Control.

Every state’s threshold, deadlines and statute link are on our US state privacy law map, with a calculator that shows which laws reach your business. This post covers what they mean for your banner.

Which US states have a privacy law in force?

As of 5 October 2026, nineteen states have a comprehensive consumer privacy law in force. California came first in 2020. Virginia, Colorado, Connecticut and Utah followed in 2023, and Oregon, Texas and Montana in 2024. Eight more arrived in 2025, and Indiana, Kentucky and Rhode Island on 1 January 2026. Florida’s Digital Bill of Rights, also from 2024, is usually counted apart because it only reaches companies with over $1 billion in revenue.

Oklahoma and Louisiana follow on 1 January 2027, Alabama on 1 May 2027 and Vermont on 1 January 2028.

Each law has its own threshold. Most start at 100,000 residents a year, or fewer if you sell data. Some go much lower: Montana starts at 25,000, Delaware, New Hampshire, Maryland and Rhode Island at 35,000, and since 1 July 2026 Connecticut covers anyone who processes sensitive data or sells any personal data. Texas and Nebraska have no numeric threshold at all; they exempt small businesses as the SBA defines them. Tennessee only applies above $25 million in revenue.

Do US state privacy laws require a cookie banner?

Not in the EU sense. No state requires consent before ordinary analytics or advertising cookies run. The model is opt out: residents can tell you to stop selling their data, using it for targeted ads and, in most states, certain profiling.

What the laws require is a way to make that choice. In California that means a “Do Not Sell or Share My Personal Information” link, or the shorter “Your Privacy Choices” link with its icon. Connecticut and Delaware ask for a clear link to a page where people can opt out. Most other states ask you to explain in your privacy notice how to opt out. A banner meets all of these at once, on the page where the tracking happens.

Two exceptions run the other way. Sensitive data, such as health, precise location or a child’s data, needs opt in consent in most states. And teenagers get more protection. Connecticut and Maryland now bar targeted advertising and sale for known users under 18, and Oregon does the same for known under 16s.

Which states require you to honour Global Privacy Control?

Global Privacy Control is a browser signal that says “do not sell or share my data”. Brave and DuckDuckGo send it by default, and Firefox has a setting for it. Twelve states treat it, or a signal like it, as a valid opt out.

Texas, Nebraska and Maryland word it as an agent acting through a browser setting. California goes furthest: since 1 January 2026 its regulations require a site to show whether it processed the signal, for example with a note that the opt out request was honoured. From 2027 California’s AB 566 also requires browsers to offer the setting, so more visitors will send it. Louisiana adds a similar duty in 2027 and Vermont in 2028.

More on the signal itself: what Global Privacy Control is.

What have regulators fined companies for?

California has announced fourteen penalties under its privacy law. The ones closest to a cookie banner:

• Honda, $632,500 (March 2025). Allow all took one click and refusing took more. The agency called it a dark pattern.
• Todd Snyder, $345,178 (May 2025). A misconfigured consent platform left opt outs unprocessed for 40 days. The agency said using a vendor does not move the responsibility.
• Healthline, $1.55 million (July 2025). The banner said tracking cookies were off when they were not, and GPC was ignored.
• Tractor Supply, $1.35 million (September 2025). No working opt out, and GPC signals were not processed.
• Sling TV, $530,000 (October 2025). Switching cookies off did not stop the sale or sharing of data.
• Disney, $2.75 million (February 2026). GPC and opt outs applied to one browser or device, not to the signed in account.
• Ford, $375,703 (March 2026). Visitors had to verify an email address before an opt out was processed.

In September 2025 regulators in California, Colorado and Connecticut also ran a joint sweep of sites that ignore GPC. The common thread: the choice has to change what the page actually does.

What changed in 2026?

• 1 January: California’s rule on showing that GPC was honoured, the GPC duties in Delaware and Oregon, and the Indiana, Kentucky and Rhode Island laws all took effect.
• 30 June: New Jersey banned the sale of sensitive data outright, with no consent exception.
• 1 July: Connecticut lowered its threshold to 35,000 residents and banned targeted ads and sale for known minors under 18.
• 30 September: California signed SB 690, which from 2027 leaves pen register claims over website tracking to the Attorney General. Wiretap claims over pixels are not affected.

How do you set up one banner for every state?

You do not need fifty banners. One setup that meets the strictest common rules covers the banner side of every state law. Some duties sit elsewhere, such as New Jersey’s ban on selling sensitive data.

1. Show a refusal as easy as acceptance

   Put reject next to accept on the first layer, the same size and the same number of clicks. California’s rules say a banner with only “Accept All” and “Preferences” is not a fair choice, and closing the banner does not count as agreeing. Colorado’s rules ask for the same symmetry, and it is the easiest standard to apply everywhere.

2. Make the refusal actually stop the tags

   Advertising tags must follow the advertising signal. In Google Tag Manager each tag checks ad_storage, ad_user_data and ad_personalization. Test it: refuse, reload and confirm no advertising tag fires.

3. Honour Global Privacy Control automatically

   Read the signal on every page and treat it as an opt out of sale and targeted ads, with no click needed. Keep it applied while the signal is present.

4. Tell the visitor the signal was honoured

   California now requires it, and it costs nothing elsewhere. A short line in the banner is enough.

5. Add the opt out link

   Label the refusal, or add a footer link that reads “Do Not Sell or Share My Personal Information” or “Your Privacy Choices”. Point it at the preferences, not at a form that asks for an email address.

6. Keep a record of every choice

   Store when the choice was made, what it was and whether GPC was present, so you can answer a regulator or a request later.

How does Velo handle US state privacy laws?

Velo does steps three to six for you, on every plan including Free:

• GPC honoured automatically. A visitor whose browser sends it gets a recorded refusal of advertising, with no click needed.
• California’s notice built in. The banner tells the visitor the signal was applied and advertising is off.
• The statutory label. Regional defaults can relabel the reject button “Do not sell or share my personal information”.
• A receipt for every choice. Each decision is stored with the region and the GPC state.
• One setting for every state. Velo reads the visitor’s country, not their state, so a new state law needs no new banner. You can also make the whole United States opt in.

To see what a refusal has to stop on your own site, run the free scan: it lists the cookies and tags your pages load. Then set up the free cookie banner and check it from a GPC browser.