A banner opt out is instant. A request is not.
Requests to see, correct or delete data run on a 45 day clock in most states, extendable once by 45 days if you tell the person in time. Iowa allows 90 days; Florida extends by only 15.
US state privacy laws,
one consent layer.
Nineteen states have a comprehensive privacy law in force, Florida has a narrower one, and four more are signed. Twelve expect sites to honour Global Privacy Control. Here is each one, and what Velo does about it.
The rule,
at a glance.
General information, checked September 2026. Not legal advice.
- Applies to
- Businesses that meet each state's thresholds, usually based on how many residents' data they process.
- The laws
- 19 comprehensive laws in force, from California in 2020 to Indiana, Kentucky and Rhode Island in 2026, plus Florida’s narrower law and 4 signed for 2027 and 2028.
- Consent model
- Opt out of targeted advertising, sale and certain profiling. Sensitive data usually needs opt in.
- Enforced by
- State attorneys general, in Colorado also district attorneys, and in California also the California Privacy Protection Agency, now called CalPrivacy.
- Velo default
- Opt out across the United States, with Global Privacy Control honoured.
Which laws apply
to your business?
Six questions, checked against each law’s own thresholds. It applies your largest state figure to every state, so it shows each law that can reach you at that size. A first screen, not legal advice.
Every state law,
on one map.
20 state laws are in force (19 comprehensive ones plus Florida’s narrower law) and 4 more are signed. Checked 5 October 2026. General information, not legal advice. What it means for your banner.
AKMEVTNHWAIDMTNDMNILWIMINYRIMAORNVWYSDIAINOHPANJCTCAUTCONEMOKYWVVAMDDEAZNMKSARTNNCSCDCOKLAMSALGAHITXFL
- In force, must honour GPC
- In force
- Signed, coming
- No comprehensive law
| State | Law | In force from | Global Privacy Control | Sensitive data | Cure period | Applies to | Source |
|---|---|---|---|---|---|---|---|
| CACalifornia | CCPA, as amended by the CPRA | 1 January 2020 | RequiredSince the 2020 rules; showing the result is required from 1 Jan 2026 | Right to limit its use | None | $26.6M revenue, or 100,000 consumers or households, or half of revenue from selling or sharing data | Read the law |
| VAVirginia | Consumer Data Protection Act | 1 January 2023 | Not required | Opt in | 30 days, permanent | 100,000 consumers, or 25,000 and over half of revenue from data sales | Read the law |
| COColorado | Colorado Privacy Act | 1 July 2023 | Requiredsince 1 Jul 2024 | Opt in | Ended 1 Jan 2025 | 100,000 consumers, or 25,000 and any revenue or discount from data sales | Read the law |
| CTConnecticut | Connecticut Data Privacy Act | 1 July 2023 | Requiredsince 1 Jan 2025 | Opt in | Ended 31 Dec 2024, now discretionary | 35,000 consumers, or any sensitive data, or any data sale (since 1 Jul 2026) | Read the law |
| UTUtah | Consumer Privacy Act | 31 December 2023 | Not required | Notice and a chance to opt out | 30 days, permanent | $25M revenue and 100,000 consumers, or 25,000 and over half of revenue from data sales | Read the law |
| FLFlorida | Digital Bill of Rights | 1 July 2024 | Not required | Opt in; consent to sell | 45 days, at the Attorney General’s discretion | Businesses over $1B in global revenue that meet one more test | Read the law |
| OROregon | Oregon Consumer Privacy Act | 1 July 2024 | Requiredsince 1 Jan 2026 | Opt in; some sales banned | Ended 1 Jan 2026 | 100,000 consumers, or 25,000 and over 25% of revenue from data sales; nonprofits included | Read the law |
| TXTexas | Data Privacy and Security Act | 1 July 2024 | Requiredsince 1 Jan 2025Written as an agent using a browser setting | Opt in | 30 days, permanent | No numeric threshold; SBA small businesses exempt | Read the law |
| MTMontana | Consumer Data Privacy Act | 1 October 2024 | Requiredsince 1 Jan 2025 | Opt in | Removed 1 Oct 2025 | 25,000 consumers, or 15,000 and over 25% of revenue from data sales | Read the law |
| DEDelaware | Personal Data Privacy Act | 1 January 2025 | Requiredsince 1 Jan 2026 | Opt in | Ended 31 Dec 2025, now discretionary | 35,000 consumers, or 10,000 and over 20% of revenue from data sales (lower from 2027) | Read the law |
| IAIowa | Consumer Data Protection Act | 1 January 2025 | Not required | Notice and a chance to opt out | 90 days, permanent | 100,000 consumers, or 25,000 and over half of revenue from data sales | Read the law |
| NENebraska | Data Privacy Act | 1 January 2025 | Requiredsince 1 Jan 2025Written as an agent using a browser setting | Opt in | 30 days, permanent | No numeric threshold; SBA small businesses exempt | Read the law |
| NHNew Hampshire | Data Privacy Act (RSA 507-H) | 1 January 2025 | Requiredsince 1 Jan 2025 | Opt in | Ended 31 Dec 2025, now discretionary | 35,000 consumers, or 10,000 and over 25% of revenue from data sales | Read the law |
| NJNew Jersey | Data Privacy Act | 15 January 2025 | Requiredsince 15 Jul 2025 | Opt in; sale banned since 30 Jun 2026 | Ended July 2026 | 100,000 consumers, or 25,000 and any revenue or discount from data sales | Read the law |
| TNTennessee | Information Protection Act | 1 July 2025 | Not required | Opt in | 60 days, permanent | $25M revenue and 175,000 consumers, or 25,000 and over half of revenue from data sales | Read the law |
| MNMinnesota | Consumer Data Privacy Act | 31 July 2025 | Requiredsince 31 Jul 2025 | Opt in | Ended 31 Jan 2026 | 100,000 consumers, or 25,000 and over 25% of revenue from data sales | Read the law |
| MDMaryland | Online Data Privacy Act | 1 October 2025 | Requiredsince 1 Oct 2025Written as an agent using a browser setting | Only when strictly necessary; sale banned | Discretionary, until 1 Apr 2027 | 35,000 consumers, or 10,000 and over 20% of revenue from data sales | Read the law |
| INIndiana | Consumer Data Protection Act | 1 January 2026 | Not required | Opt in | 30 days, permanent | 100,000 consumers, or 25,000 and over half of revenue from data sales | Read the law |
| KYKentucky | Consumer Data Protection Act | 1 January 2026 | Not required | Opt in | 30 days, permanent | 100,000 consumers, or 25,000 and over half of revenue from data sales | Read the law |
| RIRhode Island | Data Transparency and Privacy Protection Act | 1 January 2026 | Not required | Opt in | None | 35,000 customers, or 10,000 and over 20% of revenue from data sales | Read the law |
| LALouisiana | Louisiana Data Privacy Act (Act 502) | 1 January 2027Signed, not yet in force | Requiredfrom 1 Jan 2027Written as an agent using a browser setting | Opt in | 30 days, until 31 Jul 2027 | Over $25M revenue, or 75,000 consumers, households or devices, or half of revenue from selling data | Read the law |
| OKOklahoma | Consumer Data Privacy Act (SB 546) | 1 January 2027Signed, not yet in force | Not required | Opt in | 30 days, permanent | 100,000 consumers, or 25,000 and over half of revenue from data sales | Read the law |
| ALAlabama | Personal Data Protection Act (Act 2026-552) | 1 May 2027Signed, not yet in force | Not required | Opt in | 45 days, permanent | Over 25,000 consumers, or over 25% of revenue from data sales; small firms that do not sell data exempt | Read the law |
| VTVermont | Data Privacy and Online Surveillance Act (Act 145) | 1 January 2028Signed, not yet in force | Requiredfrom 1 Jan 2028 | Opt in, and only when reasonably necessary | Discretionary, 2028 to mid 2029 | 35,000 consumers, or sensitive data of 3,000, or data of 3,000 offered for sale | Read the law |
One banner for every state on this map.
Velo honours Global Privacy Control for every United States visitor who sends it, tells them in the banner that the signal was applied, and records each choice with a receipt. It reads the country, not the state, so a new state law needs no new setup. On every plan, from €0.
One law in 2020.
24 by 2028.
The year each law takes effect. California is counted from the CCPA; its CPRA amendments took effect in 2023.
- 20201 law
- 20234 laws
- 20244 laws
- 20258 laws
- 20263 laws
- 20273 laws
- 20281 law
How fast you
have to answer.
Response deadlines in calendar days unless the law says business days. A banner opt out takes effect at once; these clocks matter for requests sent by email or form.
California counts in business days.
An opt out of sale or sharing has to take effect within 15 business days, and requests to know, delete or correct need a receipt within 10. Since 1 January 2026 the site must also show whether it honoured a GPC signal.
Appeals have their own deadline.
Most states give 60 days to decide an appeal. Colorado and Minnesota give 45 with a possible 60 day extension; New Jersey and Oregon give 45. California and Utah have no appeal step.
| State | Access, correct, delete | Opt out of sale and ads | Extension | Appeal decision |
|---|---|---|---|---|
| CACalifornia | 45 days | 15 business days | +45 days | No appeal step |
| VAVirginia | 45 days | 45 days | +45 days | 60 days |
| COColorado | 45 days | As soon as feasible, within 45 days | +45 days | 45 days (+60) |
| CTConnecticut | 45 days | 45 days | +45 days | 60 days |
| UTUtah | 45 days | 45 days | +45 days | No appeal step |
| FLFlorida | 45 days | 45 days | +15 days | 60 days |
| OROregon | 45 days | 45 days | +45 days | 45 days |
| TXTexas | 45 days | 45 days | +45 days | 60 days |
| MTMontana | 45 days | 45 days | +45 days | 60 days |
| DEDelaware | 45 days | 45 days | +45 days | 60 days |
| IAIowa | 90 days | 90 days | +45 days | 60 days |
| NENebraska | 45 days | 45 days | +45 days | 60 days |
| NHNew Hampshire | 45 days | 45 days | +45 days | 60 days |
| NJNew Jersey | 45 days | 45 days | +45 days | 45 days |
| TNTennessee | 45 days | 45 days | +45 days | 60 days |
| MNMinnesota | 45 days | As soon as feasible, within 45 days | +45 days | 45 days (+60) |
| MDMaryland | 45 days | 45 days | +45 days | 60 days |
| INIndiana | 45 days | 45 days | +45 days | 60 days |
| KYKentucky | 45 days | 45 days | +45 days | 60 days |
| RIRhode Island | 45 days | 45 days | +45 days | 60 days |
| LALouisiana | 45 days | 45 days | +45 days | 60 days |
| OKOklahoma | 45 days | 45 days | +45 days | 60 days |
| ALAlabama | 45 days | 45 days | +45 days | No appeal step |
| VTVermont | 45 days | 45 days | +45 days | 60 days |
Where
enforcement lands.
Public actions that turned on opt out links, Global Privacy Control or tracking on the page, newest first. Amounts as announced.
- Aug 2026$275,000
TaxAct Connecticut Attorney General
Tax figures reached advertising partners through tracking tags on the site. The settlement requires a review process and monitoring for every tag.
Announcement - Mar 2026$375,703
Ford CalPrivacy
Visitors had to verify an email address before an opt out of sale or sharing was processed. Ford must audit its site’s tracking and honour opt out signals, GPC included.
Announcement - Mar 2026$1.1M
PlayOn Sports CalPrivacy
Buyers had to accept ad tracking to get their tickets, the only opt out pointed to industry tools, and opt out signals were ignored.
Announcement - Feb 2026$2.75M
Disney California Attorney General
GPC and the opt out toggles applied to one browser or device, not the whole signed in account, and embedded ad tech kept receiving data.
Announcement - Oct 2025$530,000
Sling TV California Attorney General
Cookie preferences were presented as the opt out, but turning cookies off did not stop the sale or sharing of data.
Summary - Sep 2025$1.35M
Tractor Supply California Privacy Protection Agency
No working way to opt out of sale or sharing, and GPC signals were not processed.
Announcement - Sep 2025Letters
Joint GPC sweep California, Colorado and Connecticut
Regulators in three states checked sites for GPC together and wrote to businesses that ignored it.
Announcement - Jul 2025$1.55M
Healthline California Attorney General
The cookie banner said it switched tracking cookies off and it did not. GPC was ignored as well.
Announcement - May 2025$345,178
Todd Snyder California Privacy Protection Agency
A misconfigured consent platform left opt outs unprocessed for 40 days. The agency said using a platform does not move the responsibility.
Announcement - Mar 2025$632,500
Honda California Privacy Protection Agency
The privacy choices tool offered Allow All in one click and no equally easy way to refuse.
Announcement - Aug 2022$1.2M
Sephora California Attorney General
Trackers on the site counted as a sale, and GPC signals were not treated as opt outs.
Announcement
What state laws ask.
What Velo does.
One setup for every state
Velo applies opt out defaults across the United States, so you do not maintain a banner per state as new laws take effect.
Universal opt out signals
Twelve states expect sites to honour signals like Global Privacy Control. When a browser sends GPC, Velo turns the advertising signals off and the banner says so.
Records you can show
Each decision gets a receipt id, with the region and the GPC state at the time, so a request can be answered later.
A clear way to say no
Visitors can reject advertising and tracking from the banner and reopen their preferences from the floating button at any time.
What the law
actually says.
Since Virginia's law took effect in 2023, state after state has passed its own privacy act. Thresholds and details differ, but most share a core: residents can opt out of targeted advertising, the sale of their data and certain automated profiling, and a business has to give them a clear way to do it.
Twelve of them, including California, Colorado, Connecticut, Texas, Oregon and New Jersey, require sites to honour universal opt out signals such as Global Privacy Control. Sensitive data, such as health information or precise location, generally needs opt in consent instead, and Maryland and New Jersey now ban its sale.
Up and running
in four steps.
From the first script tag to the first recorded choice.
-
Add Velo to your site
Install it with the Google Tag Manager template or paste one script tag. Guides cover WordPress, Shopify, Webflow and other platforms.
-
Scan and sort your cookies
Velo scans your pages, lists the cookies and scripts it finds and suggests a category for each one. You confirm or change them.
-
Design the banner
Pick colours, wording and languages. Reject sits next to accept on the first layer.
-
Publish and check
Visitors in the United States get opt out defaults, and Global Privacy Control switches advertising off. Each choice lands in your consent log with its receipt id.
Before you
go live.
Velo handles the banner, the regional defaults and the records. These parts stay with you.
- Your privacy or cookie notice names each purpose and each third party that sets cookies.
- Tags in Google Tag Manager wait for the matching consent signal before they fire.
- You tested from the region itself: nothing optional loads before a visitor chooses.
- Someone on the team reviews new scripts when a scan finds them.
- Your privacy notice explains how residents can opt out and, in states that require it, how to appeal a refused request.
In every plan, from €0
Consent Mode v2 advancedRegional defaults by countryGlobal Privacy Control honouredReceipt for every choiceReject as easy as acceptFloating preferences button
Nine banner languagesCookie and tracker scanChoices by categoryConsent log and dashboardWorks with Google Tag ManagerInstallation help
Questions,
answered.
What teams ask about state privacy laws.
Which states have comprehensive privacy laws?
As of 5 October 2026, nineteen: California, Virginia, Colorado, Connecticut, Utah, Oregon, Texas, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky and Rhode Island. Florida also has a narrower law for companies with over $1 billion in revenue. Oklahoma and Louisiana follow on 1 January 2027, Alabama on 1 May 2027 and Vermont on 1 January 2028.
Do these laws require opt in consent for cookies?
Generally no. Most give residents the right to opt out of targeted advertising, the sale of personal data and profiling. Sensitive data is the main exception, where several states require opt in consent.
Which states require honouring Global Privacy Control?
Twelve: California, Colorado, Connecticut, Delaware, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon and Texas. Texas, Nebraska and Maryland word it as an agent acting through a browser setting. Velo honours GPC for United States visitors who send it.
What does California's 2026 rule change for banners?
Since 1 January 2026 a business must show whether it processed a visitor's opt out preference signal, for example with a note that the opt out was honoured. When a browser sends GPC, Velo's banner says the signal was applied and advertising is off.
Is this legal advice?
No. This page is general information. Thresholds and obligations differ by state, so check which laws apply to you.
Website privacy, in one place.
Scan your site →
Regulations
GDPR
UK GDPR
CCPA / CPRA
US state laws
LGPD
Ley 1581 (Colombia)
Ley 25.326 (Argentina)
Ley 29733 (Peru)
