US Cookie Laws: State-by-State Guide (2026)

The United States has no federal cookie law. Instead, 24 states have enacted comprehensive privacy laws regulating how cookies collect and share personal information, all using an opt-out model where tracking starts by default. California's CCPA/CPRA, the most comprehensive, requires opt-out of both the sale and sharing of personal data.

The United States has no federal law governing cookies or requiring cookie consent. Instead, a growing number of states have enacted comprehensive privacy laws that regulate the collection, use, and sharing of personal information through cookies and tracking technologies. These laws do not require the EU-style opt-in consent banners seen across European websites. Instead, they give consumers the right to opt out of certain data practices, including targeted advertising and the sale of personal information.

As of June 2026, 24 states have enacted comprehensive privacy laws, with most taking effect between 2023 and 2028. This guide covers each state's requirements as they relate to cookies and online tracking, the key distinctions between their approaches, and practical compliance guidance for businesses operating across multiple states.

How US State Privacy Laws Affect Cookies

US state privacy laws do not directly regulate cookies as a technology. Instead, they regulate the personal information that cookies collect and how that information is used, sold, or shared. The connection to cookies comes through three main activities:

Targeted advertising. When a website uses advertising cookies to build a profile of a visitor and serve personalized ads, most state privacy laws require that the consumer be able to opt out of this practice.

Sale of personal information. When cookie data (browsing history, device identifiers, geolocation) is transferred to third parties in exchange for money or other valuable consideration, state laws classify this as a "sale" that consumers can refuse.

Sharing for cross-context behavioral advertising. California's CPRA introduced this concept, covering the transfer of personal information to third parties for advertising purposes even when no money changes hands. This captures most advertising cookie arrangements.

State-by-State Requirements

California: CCPA/CPRA

California's Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), is the most comprehensive US state privacy law. It took effect January 1, 2020, with the CPRA amendments effective January 1, 2023.

Cookie-related requirements:

• Businesses must display a "Do Not Sell or Share My Personal Information" link on their homepage
• Must display a "Limit the Use of My Sensitive Personal Information" link if applicable
• Must honor the Global Privacy Control (GPC) browser signal as a valid opt-out
• Must provide a privacy policy that discloses categories of personal information collected, sold, and shared
• Opt-in consent required before selling personal information of consumers under 16

Applies to: Businesses with gross annual revenue over $25 million, or that buy/sell/share the personal information of 100,000+ California residents, or that derive 50%+ of annual revenue from selling/sharing California residents' personal information.

Enforcement: California Privacy Protection Agency (CPPA) and the California Attorney General. Penalties: $2,500 per unintentional violation, $7,500 per intentional violation. The AG has specifically pursued enforcement against businesses failing to honor GPC.

Colorado: Colorado Privacy Act (CPA)

Colorado's Privacy Act (CPA) took effect July 1, 2023.

Cookie-related requirements:

• Consumers can opt out of targeted advertising and the sale of personal data
• Must honor universal opt-out mechanisms (including GPC) as of July 1, 2024
• Must conduct data protection assessments for targeted advertising activities
• Must provide clear opt-out mechanisms "in a manner that is clearly conspicuous"

Applies to: Businesses that control or process personal data of 100,000+ Colorado residents annually, or 25,000+ residents while deriving revenue from selling personal data.

Enforcement: Colorado Attorney General. The AG issued technical specifications for universal opt-out mechanisms in 2024.

Connecticut: Connecticut Data Privacy Act (CTDPA)

Connecticut's Data Privacy Act took effect July 1, 2023.

Cookie-related requirements:

• Opt-out rights for targeted advertising, sale of personal data, and profiling
• Must honor universal opt-out mechanisms (including GPC) as of January 1, 2025
• Must provide a "clear and conspicuous" link for opt-out mechanisms
• Data protection assessments required for targeted advertising

Applies to: Businesses that control or process personal data of 35,000+ Connecticut residents, OR control or process consumers' sensitive data regardless of volume, OR offer consumers' personal data for sale in trade or commerce regardless of volume (effective July 1, 2026, Public Act 25-113, Sec. 6; the pre-amendment 100,000/25,000+25%-revenue test no longer applies).

Enforcement: Connecticut Attorney General.

Virginia: Virginia Consumer Data Protection Act (VCDPA)

Virginia's Consumer Data Protection Act (VCDPA) took effect January 1, 2023.

Cookie-related requirements:

• Consumers can opt out of targeted advertising and the sale of personal data
• Must provide a "reasonably accessible, clear, and meaningful" opt-out mechanism
• Does NOT require recognition of universal opt-out mechanisms like GPC
• Data protection assessments required for targeted advertising activities

Applies to: Businesses that control or process personal data of 100,000+ Virginia residents, or 25,000+ while deriving over 50% of gross revenue from personal data sales.

Enforcement: Virginia Attorney General exclusively. No private right of action.

Texas: Texas Data Privacy and Security Act (TDPSA)

Texas's Data Privacy and Security Act took effect July 1, 2024.

Cookie-related requirements:

• Opt-out rights for targeted advertising, sale of personal data, and profiling
• Beginning January 1, 2025, must act on opt-out requests sent by the consumer's authorized agent through a browser setting such as GPC when the business can verify the consumer and the agent's authority, with statutory exceptions (Bus. & Com. Code 541.055(e))
• Must provide "one or more secure and reliable means" for consumers to submit opt-out requests
• Small business exception does NOT apply to the sale of sensitive personal data

Applies to: Businesses that conduct business in Texas or produce products/services consumed by Texas residents AND process or sell personal data (but are NOT small businesses as defined by the SBA, unless selling sensitive data).

Enforcement: Texas Attorney General. Civil penalties up to $25,000 per violation.

Oregon: Oregon Consumer Privacy Act (OCPA)

Oregon's Consumer Privacy Act took effect July 1, 2024.

Cookie-related requirements:

• Opt-out rights for targeted advertising, sale of personal data, and profiling
• Must honor universal opt-out mechanisms (including GPC) as of January 1, 2026
• Nonprofit organizations are included (unlike most other state laws)
• Must provide a "clear and conspicuous" method for exercising opt-out rights

Applies to: Businesses that control or process personal data of 100,000+ Oregon residents, or 25,000+ while deriving 25%+ of gross revenue from selling personal data.

Enforcement: Oregon Attorney General.

Montana: Montana Consumer Data Privacy Act (MCDPA)

Montana's privacy law took effect October 1, 2024.

Cookie-related requirements:

• Opt-out rights for targeted advertising and sale of personal data
• Must honor universal opt-out mechanisms as of January 1, 2025
• Low applicability thresholds given Montana's small population

Applies to: Businesses that control or process personal data of 50,000+ Montana residents (excluding payment transaction data), or any number of residents while deriving 25%+ of gross revenue from data sales.

Enforcement: Montana Attorney General.

Additional States with Cookie-Related Privacy Laws

Several additional states have enacted privacy laws taking effect between 2024 and 2028.

Florida (effective July 1, 2024): The Florida Digital Bill of Rights (Fla. Stat. 501.701 et seq., enacted as ch. 2023-201) has by far the narrowest reach of any law on this list. It applies only to for-profit businesses with more than $1 billion in global gross annual revenues that also either derive 50% or more of those revenues from selling advertisements online, operate a consumer smart speaker with a voice assistant, or run an app store or digital distribution platform offering at least 250,000 applications. Businesses within scope must honor opt-outs of targeted advertising and the sale of personal data. The statute contains no universal opt-out (GPC) recognition requirement.

Delaware (effective January 1, 2025): Applies to businesses processing data of 35,000+ residents (or 10,000+ while selling data). Requires recognition of universal opt-out mechanisms (since January 1, 2026).

New Hampshire (effective January 1, 2025): Applies to businesses processing data of 35,000+ residents. Requires recognition of universal opt-out mechanisms.

New Jersey (effective January 15, 2025): Applies to businesses processing data of 100,000+ residents (or 25,000+ while selling data). Requires recognition of universal opt-out mechanisms.

Nebraska (effective January 1, 2025): Applies to businesses that are not small businesses under the federal Small Business Act (no data-volume threshold). Lets consumers use a browser setting such as GPC as an authorized agent to opt out; a controller must comply if it can verify the consumer and the agent's authority, with statutory exceptions (Neb. Rev. Stat. 87-1111(5)).

Iowa (effective January 1, 2025): Applies to businesses processing data of 100,000+ residents. Does NOT require universal opt-out recognition.

Tennessee (effective July 1, 2025): Applies to businesses with $25 million+ revenue processing data of 175,000+ residents. Does NOT require universal opt-out recognition.

Indiana (effective January 1, 2026): Applies to businesses processing data of 100,000+ residents. Does NOT require universal opt-out recognition.

Kentucky (effective January 1, 2026): Applies to businesses processing data of 100,000+ residents. The enacted law contains no universal opt-out (GPC) recognition requirement.

Rhode Island (effective January 1, 2026): The Rhode Island Data Transparency and Privacy Protection Act (R.I. Gen. Laws ch. 6-48.1) applies to for-profit entities that controlled or processed the personal data of 35,000+ customers, or of 10,000+ customers while deriving more than 20% of gross revenue from the sale of personal data. Customers can opt out of targeted advertising, the sale of personal data, and profiling. The statute contains no universal opt-out (GPC) recognition requirement.

Maryland (effective October 1, 2025): Notably stronger than most states. Minimization principle requires that data collection be limited to what is "reasonably necessary." Restricts targeted advertising to minors entirely. A business may satisfy its opt-out duty either with a clear opt-out link or by honoring an opt-out preference signal such as GPC.

Minnesota (effective July 31, 2025): Includes targeted advertising opt-out rights. Requires data protection assessments. Requires businesses to honor universal opt-out mechanisms such as GPC (Minn. Stat. 325M.14).

Oklahoma (effective January 1, 2027): Applies to businesses processing data of 100,000+ residents (or 25,000+ while deriving more than 50% of revenue from data sales). The enacted law does not require recognition of universal opt-out mechanisms such as GPC.

Alabama (effective May 1, 2027): Applies to businesses processing data of more than 25,000 residents, or deriving more than 25% of gross revenue from data sales regardless of volume. A Senate amendment removed a proposed universal opt-out (GPC) recognition requirement before passage, so the enacted law does not require it.

Louisiana (effective January 1, 2027): Applies to businesses processing data of 75,000+ consumers, households, or devices. Grants an opt-out right for the sale of personal data, targeted advertising, and certain profiling; universal opt-out (GPC) recognition has not been confirmed for this law.

Vermont (effective January 1, 2028): Applies to businesses processing data of 35,000+ residents, or the sensitive data or sale of personal data of 3,000+ residents. No consumer privacy rights, including opt-out rights, are in force under this law until it takes effect.

State-by-State Comparison Table

Universal Opt-Out Mechanisms and GPC

The Global Privacy Control (GPC) is a browser-level signal specified at globalprivacycontrol.org. When enabled, GPC sends a technical signal (the Sec-GPC: 1 HTTP header) with every web request, communicating the user's preference to opt out of the sale or sharing of their personal information.

Which States Require GPC Recognition?

As of September 2026, nine states require businesses to honor universal opt-out mechanisms: California, Colorado, Connecticut, Delaware, Minnesota, Montana, New Hampshire, New Jersey, and Oregon (Oregon since January 1, 2026). Texas and Nebraska let consumers use such a signal as an authorized agent to opt out, and a business must comply when it can verify the request, with statutory exceptions. Maryland lets a business choose between an opt-out link and honoring the signal. Kentucky, Oklahoma, and Alabama do not require universal opt-out recognition.

How GPC Works Technically

When a user enables GPC in their browser (built into Firefox, Brave, and DuckDuckGo; available as an extension for Chrome and other browsers), the browser sends a Sec-GPC: 1 header with every HTTP request and sets navigator.globalPrivacyControl = true in the JavaScript environment.

Websites must detect this signal and suppress data practices covered by the applicable state laws (sale, sharing, targeted advertising) without requiring any additional action from the user. The opt-out should be applied automatically, without displaying a banner asking the user to confirm.

GPC vs. Do Not Track (DNT)

GPC differs from the older Do Not Track (DNT) signal in a critical way: GPC has legal backing. The CCPA/CPRA and other state laws require businesses to honor GPC. DNT was a voluntary standard with no legal enforcement mechanism, and the advertising industry broadly ignored it. The FTC has signaled support for GPC in enforcement actions, further establishing its legal weight.

Opt-In vs. Opt-Out: Understanding the US Approach

The fundamental difference between US and EU cookie law is the default setting. In the EU, tracking is off until the user turns it on (opt-in). In the US, tracking is on until the user turns it off (opt-out).

Why the US Uses Opt-Out

The US approach reflects a different legal philosophy. US privacy law traditionally treats personal information collection as permissible unless restricted, placing the burden on the consumer to object. The EU approach treats personal data as belonging to the individual, requiring justification for any collection.

Exceptions: When US Law Requires Opt-In

There are narrow exceptions to the US opt-out model:

• Children's data under COPPA: The federal Children's Online Privacy Protection Act (COPPA) requires verifiable parental consent before collecting personal information from children under 13
• California minors (13-15): The CCPA/CPRA requires opt-in consent before selling personal information of consumers between 13 and 15
• Sensitive data in some states: Maryland and other states with stronger laws may require opt-in for certain sensitive data categories

Practical Compliance for Multi-State Operations

Option 1: Universal Opt-Out (Recommended)

The simplest approach for businesses operating nationwide is to implement a single opt-out mechanism that honors requests from all visitors regardless of state. This avoids the complexity of geolocation and state-specific logic.

A universal approach includes:

1. A "Do Not Sell or Share My Personal Information" link in the footer and privacy policy
2. GPC auto-detection that suppresses targeted advertising and data sharing when the signal is present
3. A privacy preference center where users can manage their data choices
4. Automatic honoring of opt-out requests for targeted advertising, data sales, and data sharing

Option 2: State-Specific Geolocation

Organizations that want to maximize data collection in states without privacy laws can implement geolocation-based compliance. This approach uses IP geolocation to determine the visitor's state and displays opt-out mechanisms only where legally required.

The drawbacks of this approach include implementation complexity, risk of misidentification (VPNs, mobile users crossing state lines), and the reputational risk of appearing to respect privacy only where legally compelled.

Option 3: National Baseline + California Extras

A middle-ground approach provides basic opt-out mechanisms nationwide (satisfying most state laws) while adding California-specific elements (the "Do Not Sell or Share" and "Limit Sensitive Information" links, GPC recognition, and age-gating for minors) for California visitors.

Federal Privacy Legislation: Still Pending

As of August 2026, Congress has not passed a comprehensive federal privacy law. See our US state privacy laws comparison for the current landscape. The American Privacy Rights Act (APRA) advanced through committee in 2024 but did not receive a full vote. If a federal law is enacted, it could preempt the state-by-state patchwork and establish uniform national requirements for cookies and tracking technologies.

Until federal legislation passes, businesses must navigate the growing number of state laws independently.

This is general legal information, not legal advice. State privacy laws are evolving rapidly, with new laws taking effect and existing laws being amended through regulation. Consult a privacy attorney for advice specific to your business operations and the states where you operate.

Frequently Asked Questions

Does any US state require EU-style opt-in cookie consent?

No. As of August 2026, no US state requires affirmative opt-in consent before placing cookies on a user's device. All US state privacy laws use an opt-out model, where tracking begins by default and consumers can request it stop. The only opt-in requirements relate to specific categories: COPPA requires parental consent for children under 13 nationwide, and California requires opt-in consent before selling personal information of consumers aged 13 to 15.

What is the Global Privacy Control (GPC) and which states require it?

GPC is a browser signal that communicates a user's preference to opt out of the sale or sharing of personal information. Nine states require businesses to honor GPC: California, Colorado, Connecticut, Delaware, Minnesota, Montana, New Hampshire, New Jersey, and Oregon; Texas and Nebraska let consumers use it as an authorized agent to opt out, with exceptions. GPC is built into Firefox, Brave, and DuckDuckGo browsers, and available as an extension for Chrome. When detected, websites covered by those laws must automatically suppress data sales and targeted advertising without requiring additional user action.

Which state privacy law is the strictest on cookies and tracking?

California's CCPA/CPRA remains the most comprehensive. It has the broadest definition of 'sale' (expanded by CPRA to include 'sharing' for advertising), mandatory GPC recognition, a dedicated enforcement agency (the CPPA), and penalties of $7,500 per intentional violation. Maryland's law (effective October 2025) is notably strict on data minimization and restricts targeted advertising to minors entirely, which may have significant implications for cookie-based tracking.

Do I need a 'Do Not Sell My Personal Information' link on my website?

If your business sells personal information or shares it for cross-context behavioral advertising and meets the applicability thresholds, California requires this link. Similar opt-out mechanisms are required by Colorado, Connecticut, Virginia, Texas, Oregon, and other states with comprehensive privacy laws. If you use advertising cookies that share data with ad networks or data brokers, you likely need this link. The safest approach is to display it for all visitors.

How does the CCPA define 'sale' of personal information through cookies?

The CCPA defines 'sale' broadly as transferring personal information to a third party for monetary or other valuable consideration. The CPRA amendment added 'sharing,' defined as transferring personal information for cross-context behavioral advertising, even without monetary exchange. This means that using advertising cookies from networks like Google Ads or Meta, where cookie data flows to the ad platform to serve targeted ads, constitutes 'sharing' under the CPRA even if no money directly changes hands for the data.

What happens if my business operates in a state without a privacy law?

In states without comprehensive privacy laws, there are no state-level requirements for cookie opt-out mechanisms. However, the federal FTC Act's prohibition on unfair or deceptive practices still applies. If your privacy policy makes promises about data practices or opt-out rights, the FTC can enforce those promises. Businesses should also prepare for new state laws, as the pace of state privacy legislation has accelerated significantly since 2023.

Are there different rules for sensitive personal data collected through cookies?

Several states distinguish between general personal data and sensitive personal data. California requires a 'Limit the Use of My Sensitive Personal Information' link if sensitive data is used beyond what is necessary. Precise geolocation data (collected through cookies or scripts) is classified as sensitive in California, Colorado, Connecticut, Virginia, and most other state privacy laws. Processing sensitive data through cookies may trigger heightened obligations including data protection impact assessments.

Can I just apply one state's rules nationwide instead of tracking each state?

Yes, and many privacy professionals recommend this approach. Applying California's CCPA/CPRA requirements (the strictest US standard) nationwide satisfies the requirements of all other state privacy laws. This means displaying opt-out links, honoring GPC, providing a privacy policy with required disclosures, and implementing processes for consumer rights requests. The simplicity of a single compliance standard often outweighs the marginal cost of providing opt-out mechanisms to residents of states that do not yet require them.