Compliance guide

Cookie Consent for US Websites: What State Privacy Laws Actually Require

US privacy law is opt-out, not opt-in. No US state or federal law requires a prior-consent cookie banner like GDPR does. What 13 states require instead is an opt-out link — and only when you run advertising pixels. Here’s what actually applies to your site.

• No prior consent required
• When opt-out IS required
• Global Privacy Control
• State law table
• Practical scenarios
• Common misconceptions
• What to add to your site
• FAQ

US websites don’t need a prior-consent cookie banner

As of September 2026, there is no US federal cookie consent law, and no US state law requires a prior-consent cookie banner. The 13 states that have enacted comprehensive privacy legislation — California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, New Hampshire, New Jersey, and North Carolina — all use an opt-out model, not an opt-in model.

Under the opt-out model:

• You may load cookies and collect personal data without asking first
• You must disclose what you collect in a privacy policy
• If you share that data with third parties for advertising, you must provide an opt-out mechanism
• You honor opt-outs going forward — you don’t need to delete data already collected

This is the opposite of GDPR’s prior-consent requirement. Under EU law, non-essential cookies cannot fire until the user actively accepts. Under US law, cookies can fire freely — the obligation only arises when you share the resulting data for cross-context behavioral advertising.

When US opt-out IS required: advertising pixels

The US opt-out obligation is triggered by “selling” or “sharing” personal data for cross-context behavioral advertising. In practice, this means running advertising pixels — code that sends visitor identifiers to ad networks so they can show those visitors targeted ads on other websites.

These integrations typically trigger the opt-out requirement:

• Facebook Pixel / Meta Pixel — sends visitor identifiers to Meta for retargeting
• Google Ads remarketing tags — adds visitors to Google retargeting lists
• TikTok Pixel, LinkedIn Insight Tag — cross-site retargeting
• Google AdSense — serves behavioral ads based on cross-site tracking
• Any ad network code that syncs visitor data with an ad platform

These integrations typically do not trigger the opt-out requirement:

• Google Analytics 4 (analytics-only mode) — measures traffic without advertising features
• Plausible Analytics, Fathom — cookieless, privacy-first analytics
• Hotjar, Microsoft Clarity — session recording not tied to ad networks
• Stripe, PayPal payment widgets — payment processing, not behavioral advertising
• First-party functional cookies — session, auth, cart, preferences

The key test: does the code pass visitor identifiers to a third party to enable serving that visitor targeted ads on other sites? If yes, that’s “sharing” under CPRA and equivalent state laws.

Global Privacy Control (GPC): automatic opt-out signal

Global Privacy Control is a browser-level signal (navigator.globalPrivacyControl === true) that users can set to indicate they want to opt out of data selling and sharing. California (CPRA), Colorado (CPA), Connecticut (CTDPA), and Oregon (OCPA) explicitly require businesses to recognize GPC as a valid opt-out — equivalent to clicking the “Do Not Sell or Share” link.

If your site serves visitors from these four states and you run advertising pixels, you must check for the GPC signal and honor it automatically:

if (!navigator.globalPrivacyControl) {
  // GPC not set — user has not opted out via browser signal
  loadFacebookPixel();
  loadGoogleAdsTag();
}
// If navigator.globalPrivacyControl === true, skip advertising pixels

The remaining states with privacy laws (Virginia, Utah, Texas, Montana, Iowa, Delaware, New Hampshire, New Jersey, North Carolina) do not currently require GPC recognition. Implementing GPC support universally is best practice regardless.

US state privacy law table

All 13 US state privacy laws with comprehensive coverage as of September 2026. All use opt-out models — none require prior consent for cookies.

Practical scenarios: what your site actually needs

Common misconceptions about US cookie law

• “I need a cookie banner because I read about GDPR” — GDPR only applies if you have EU or UK visitors. A US-only site with US-only traffic has no GDPR obligations. If you do have EU visitors, a consent banner is required for EU traffic — but not for US traffic specifically.
• “Google Analytics requires consent in the US” — Standard GA4 (no advertising features, no Google Signals) does not trigger any US opt-out requirement. You collect data, but you’re not sharing it for cross-context behavioral advertising. Disclose it in your privacy policy; no opt-out link required.
• “CPRA applies to every US business” — CPRA applies to for-profit businesses meeting one of three thresholds ($25M revenue, 100k consumers, or 50% revenue from data sales). Most indie apps and small businesses fall below all thresholds. No US privacy law applies to every website regardless of size.
• “An opt-out link means I need a consent management platform” — A CMP is one way to implement opt-out, but it’s not required. A simple footer link pointing to an opt-out page, combined with a cookie to remember the preference, satisfies the requirement for many sites.
• “Once I add the opt-out link, I’m fully compliant” — The link must actually work. An opt-out that records a preference but still loads advertising pixels for opted-out users is non-compliant. Opt-outs must be honored within 15 business days under CPRA, and advertising pixels must not fire for opted-out users.

What to actually add to your US-facing site

If you run no advertising pixels: No opt-out link required. Ensure your privacy policy discloses the cookies you use and what data they collect. That’s the complete US compliance requirement.

If you run advertising pixels and meet a state threshold:

1. Add a “Do Not Sell or Share My Personal Information” link to your site footer on every page
2. That link should lead to an opt-out mechanism — a page with a button, or a consent management tool
3. Implement GPC signal detection in your page JavaScript to automatically honor browser-level opt-outs
4. When a user opts out, block advertising pixels from loading for that visitor’s current and future sessions
5. Update your privacy policy to describe the opt-out right and how to exercise it

If you have both US and EU visitors: You need both mechanisms — an opt-out footer link for US visitors, and a prior-consent banner for EU/UK visitors. Most consent management platforms handle both by geo-detecting visitor location and showing the appropriate experience. ComplyKit generates a cookie banner that satisfies the EU consent standard; add the US opt-out footer link separately.

Frequently asked questions

Also in the Copper Bay Labs ship-safety suite

Cookie compliance is one part of launching safely. These free tools cover the other gaps — security headers, exposed secrets, and accessibility: