US Cookie Laws: State-by-State Guide (2026)

The United States has no federal cookie law. Instead, 24 states have enacted comprehensive privacy laws regulating how cookies collect and share personal information, all using an opt-out model where tracking starts by default. California's CCPA/CPRA, the most comprehensive, requires opt-out of both the sale and sharing of personal data.

The United States has no federal law governing cookies or requiring cookie consent. Instead, a growing number of states have enacted comprehensive privacy laws that regulate the collection, use, and sharing of personal information through cookies and tracking technologies. These laws do not require the EU-style opt-in consent banners seen across European websites. Instead, they give consumers the right to opt out of certain data practices, including targeted advertising and the sale of personal information.

As of June 2026, 24 states have enacted comprehensive privacy laws, with most taking effect between 2023 and 2028. This guide covers each state's requirements as they relate to cookies and online tracking, the key distinctions between their approaches, and practical compliance guidance for businesses operating across multiple states.

How US State Privacy Laws Affect Cookies

US state privacy laws do not directly regulate cookies as a technology. Instead, they regulate the personal information that cookies collect and how that information is used, sold, or shared. The connection to cookies comes through three main activities:

Targeted advertising. When a website uses advertising cookies to build a profile of a visitor and serve personalized ads, most state privacy laws require that the consumer be able to opt out of this practice.

Sale of personal information. When cookie data (browsing history, device identifiers, geolocation) is transferred to third parties in exchange for money or other valuable consideration, state laws classify this as a "sale" that consumers can refuse.

Sharing for cross-context behavioral advertising. California's CPRA introduced this concept, covering the transfer of personal information to third parties for advertising purposes even when no money changes hands. This captures most advertising cookie arrangements.

State-by-State Requirements

California: CCPA/CPRA

California's Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), is the most comprehensive US state privacy law. It took effect January 1, 2020, with the CPRA amendments effective January 1, 2023.

Cookie-related requirements:

• Businesses must display a "Do Not Sell or Share My Personal Information" link on their homepage
• Must display a "Limit the Use of My Sensitive Personal Information" link if applicable
• Must honor the Global Privacy Control (GPC) browser signal as a valid opt-out
• Must provide a privacy policy that discloses categories of personal information collected, sold, and shared
• Opt-in consent required before selling personal information of consumers under 16

Applies to: Businesses with gross annual revenue over $25 million, or that buy/sell/share the personal information of 100,000+ California residents, or that derive 50%+ of annual revenue from selling/sharing California residents' personal information.

Enforcement: California Privacy Protection Agency (CPPA) and the California Attorney General. Penalties: $2,500 per unintentional violation, $7,500 per intentional violation. The AG has specifically pursued enforcement against businesses failing to honor GPC.

Colorado: Colorado Privacy Act (CPA)

Colorado's Privacy Act (CPA) took effect July 1, 2023.

Cookie-related requirements:

• Consumers can opt out of targeted advertising and the sale of personal data
• Must honor universal opt-out mechanisms (including GPC) as of July 1, 2024
• Must conduct data protection assessments for targeted advertising activities
• Must provide clear opt-out mechanisms "in a manner that is clearly conspicuous"

Applies to: Businesses that control or process personal data of 100,000+ Colorado residents annually, or 25,000+ residents while deriving revenue from selling personal data.

Enforcement: Colorado Attorney General. The AG issued technical specifications for universal opt-out mechanisms in 2024.

Connecticut: Connecticut Data Privacy Act (CTDPA)

Connecticut's Data Privacy Act took effect July 1, 2023.

Cookie-related requirements:

• Opt-out rights for targeted advertising, sale of personal data, and profiling
• Must honor universal opt-out mechanisms (including GPC) as of January 1, 2025
• Must provide a "clear and conspicuous" link for opt-out mechanisms
• Data protection assessments required for targeted advertising

Applies to: Businesses that control or process personal data of 35,000+ Connecticut residents, OR control or process consumers' sensitive data regardless of volume, OR offer consumers' personal data for sale in trade or commerce regardless of volume (effective July 1, 2026, Public Act 25-113, Sec. 6; the pre-amendment 100,000/25,000+25%-revenue test no longer applies).

Enforcement: Connecticut Attorney General.

Virginia: Virginia Consumer Data Protection Act (VCDPA)

Virginia's Consumer Data Protection Act (VCDPA) took effect January 1, 2023.

Cookie-related requirements:

• Consumers can opt out of targeted advertising and the sale of personal data
• Must provide a "reasonably accessible, clear, and meaningful" opt-out mechanism
• Does NOT require recognition of universal opt-out mechanisms like GPC
• Data protection assessments required for targeted advertising activities

Applies to: Businesses that control or process personal data of 100,000+ Virginia residents, or 25,000+ while deriving over 50% of gross revenue from personal data sales.

Enforcement: Virginia Attorney General exclusively. No private right of action.

Texas: Texas Data Privacy and Security Act (TDPSA)

Texas's Data Privacy and Security Act took effect July 1, 2024.

Cookie-related requirements:

• Opt-out rights for targeted advertising, sale of personal data, and profiling
• Must honor universal opt-out mechanisms beginning January 1, 2025
• Must provide "one or more secure and reliable means" for consumers to submit opt-out requests
• Small business exception does NOT apply to the sale of sensitive personal data

Applies to: Businesses that conduct business in Texas or produce products/services consumed by Texas residents AND process or sell personal data (but are NOT small businesses as defined by the SBA, unless selling sensitive data).

Enforcement: Texas Attorney General. Civil penalties up to $25,000 per violation.

Oregon: Oregon Consumer Privacy Act (OCPA)

Oregon's Consumer Privacy Act took effect July 1, 2024.

Cookie-related requirements:

• Opt-out rights for targeted advertising, sale of personal data, and profiling
• Must honor universal opt-out mechanisms (including GPC) as of January 1, 2025
• Nonprofit organizations are included (unlike most other state laws)
• Must provide a "clear and conspicuous" method for exercising opt-out rights

Applies to: Businesses that control or process personal data of 100,000+ Oregon residents, or 25,000+ while deriving 25%+ of gross revenue from selling personal data.

Enforcement: Oregon Attorney General.

Montana: Montana Consumer Data Privacy Act (MCDPA)

Montana's privacy law took effect October 1, 2024.

Cookie-related requirements:

• Opt-out rights for targeted advertising and sale of personal data
• Must honor universal opt-out mechanisms as of January 1, 2025
• Low applicability thresholds given Montana's small population

Applies to: Businesses that control or process personal data of 50,000+ Montana residents (excluding payment transaction data), or any number of residents while deriving 25%+ of gross revenue from data sales.

Enforcement: Montana Attorney General.

Additional States with Cookie-Related Privacy Laws

Several additional states have enacted privacy laws taking effect between 2024 and 2028.

Florida (effective July 1, 2024): The Florida Digital Bill of Rights (Fla. Stat. 501.701 et seq., enacted as ch. 2023-201) has by far the narrowest reach of any law on this list. It applies only to for-profit businesses with more than $1 billion in global gross annual revenues that also either derive 50% or more of those revenues from selling advertisements online, operate a consumer smart speaker with a voice assistant, or run an app store or digital distribution platform offering at least 250,000 applications. Businesses within scope must honor opt-outs of targeted advertising and the sale of personal data. The statute contains no universal opt-out (GPC) recognition requirement.

Delaware (effective January 1, 2025): Applies to businesses processing data of 35,000+ residents (or 10,000+ while selling data). Requires recognition of universal opt-out mechanisms.

New Hampshire (effective January 1, 2025): Applies to businesses processing data of 35,000+ residents. Requires recognition of universal opt-out mechanisms.

New Jersey (effective January 15, 2025): Applies to businesses processing data of 100,000+ residents (or 25,000+ while selling data). Requires recognition of universal opt-out mechanisms.

Nebraska (effective January 1, 2025): Applies broadly to businesses processing personal data, with no minimum threshold. Requires recognition of universal opt-out mechanisms.

Iowa (effective January 1, 2025): Applies to businesses processing data of 100,000+ residents. Does NOT require universal opt-out recognition.

Tennessee (effective July 1, 2025): Applies to businesses with $25 million+ revenue processing data of 175,000+ residents. Does NOT require universal opt-out recognition.

Indiana (effective January 1, 2026): Applies to businesses processing data of 100,000+ residents. Does NOT require universal opt-out recognition.

Kentucky (effective January 1, 2026): Applies to businesses processing data of 100,000+ residents. Universal opt-out recognition to be determined by regulations.

Rhode Island (effective January 1, 2026): The Rhode Island Data Transparency and Privacy Protection Act (R.I. Gen. Laws ch. 6-48.1) applies to for-profit entities that controlled or processed the personal data of 35,000+ customers, or of 10,000+ customers while deriving more than 20% of gross revenue from the sale of personal data. Customers can opt out of targeted advertising, the sale of personal data, and profiling. The statute contains no universal opt-out (GPC) recognition requirement.

Maryland (effective October 1, 2025): Notably stronger than most states. Minimization principle requires that data collection be limited to what is "reasonably necessary." Restricts targeted advertising to minors entirely.

Minnesota (effective July 31, 2025): Includes targeted advertising opt-out rights. Requires data protection assessments.

Oklahoma (effective January 1, 2027): Applies to businesses processing data of 100,000+ residents (or 25,000+ while deriving more than 50% of revenue from data sales). The enacted law does not require recognition of universal opt-out mechanisms such as GPC.

Alabama (effective May 1, 2027): Applies to businesses processing data of more than 25,000 residents, or deriving more than 25% of gross revenue from data sales regardless of volume. A Senate amendment removed a proposed universal opt-out (GPC) recognition requirement before passage, so the enacted law does not require it.

Louisiana (effective January 1, 2027): Applies to businesses processing data of 75,000+ consumers, households, or devices. Grants an opt-out right for the sale of personal data, targeted advertising, and certain profiling; universal opt-out (GPC) recognition has not been confirmed for this law.

Vermont (effective January 1, 2028): Applies to businesses processing data of 35,000+ residents, or the sensitive data or sale of personal data of 3,000+ residents. No consumer privacy rights, including opt-out rights, are in force under this law until it takes effect.

State-by-State Comparison Table

Universal Opt-Out Mechanisms and GPC

The Global Privacy Control (GPC) is a browser-level signal specified at globalprivacycontrol.org. When enabled, GPC sends a technical signal (the Sec-GPC: 1 HTTP header) with every web request, communicating the user's preference to opt out of the sale or sharing of their personal information.

Which States Require GPC Recognition?

As of June 2026, ten states explicitly require businesses to honor universal opt-out mechanisms: California, Colorado, Connecticut, Texas, Oregon, Montana, Delaware, New Hampshire, New Jersey, and Nebraska. Additional states (Maryland, Minnesota, Kentucky) have provisions for universal opt-out that will be clarified through rulemaking; Oklahoma and Alabama do not require universal opt-out recognition.

How GPC Works Technically

When a user enables GPC in their browser (built into Firefox, Brave, and DuckDuckGo; available as an extension for Chrome and other browsers), the browser sends a Sec-GPC: 1 header with every HTTP request and sets navigator.globalPrivacyControl = true in the JavaScript environment.

Websites must detect this signal and suppress data practices covered by the applicable state laws (sale, sharing, targeted advertising) without requiring any additional action from the user. The opt-out should be applied automatically, without displaying a banner asking the user to confirm.

GPC vs. Do Not Track (DNT)

GPC differs from the older Do Not Track (DNT) signal in a critical way: GPC has legal backing. The CCPA/CPRA and other state laws require businesses to honor GPC. DNT was a voluntary standard with no legal enforcement mechanism, and the advertising industry broadly ignored it. The FTC has signaled support for GPC in enforcement actions, further establishing its legal weight.

Opt-In vs. Opt-Out: Understanding the US Approach

The fundamental difference between US and EU cookie law is the default setting. In the EU, tracking is off until the user turns it on (opt-in). In the US, tracking is on until the user turns it off (opt-out).

Why the US Uses Opt-Out

The US approach reflects a different legal philosophy. US privacy law traditionally treats personal information collection as permissible unless restricted, placing the burden on the consumer to object. The EU approach treats personal data as belonging to the individual, requiring justification for any collection.

Exceptions: When US Law Requires Opt-In

There are narrow exceptions to the US opt-out model:

• Children's data under COPPA: The federal Children's Online Privacy Protection Act (COPPA) requires verifiable parental consent before collecting personal information from children under 13
• California minors (13-15): The CCPA/CPRA requires opt-in consent before selling personal information of consumers between 13 and 15
• Sensitive data in some states: Maryland and other states with stronger laws may require opt-in for certain sensitive data categories

Practical Compliance for Multi-State Operations

Option 1: Universal Opt-Out (Recommended)

The simplest approach for businesses operating nationwide is to implement a single opt-out mechanism that honors requests from all visitors regardless of state. This avoids the complexity of geolocation and state-specific logic.

A universal approach includes:

1. A "Do Not Sell or Share My Personal Information" link in the footer and privacy policy
2. GPC auto-detection that suppresses targeted advertising and data sharing when the signal is present
3. A privacy preference center where users can manage their data choices
4. Automatic honoring of opt-out requests for targeted advertising, data sales, and data sharing

Option 2: State-Specific Geolocation

Organizations that want to maximize data collection in states without privacy laws can implement geolocation-based compliance. This approach uses IP geolocation to determine the visitor's state and displays opt-out mechanisms only where legally required.

The drawbacks of this approach include implementation complexity, risk of misidentification (VPNs, mobile users crossing state lines), and the reputational risk of appearing to respect privacy only where legally compelled.

Option 3: National Baseline + California Extras

A middle-ground approach provides basic opt-out mechanisms nationwide (satisfying most state laws) while adding California-specific elements (the "Do Not Sell or Share" and "Limit Sensitive Information" links, GPC recognition, and age-gating for minors) for California visitors.

Federal Privacy Legislation: Still Pending

As of August 2026, Congress has not passed a comprehensive federal privacy law. See our US state privacy laws comparison for the current landscape. The American Privacy Rights Act (APRA) advanced through committee in 2024 but did not receive a full vote. If a federal law is enacted, it could preempt the state-by-state patchwork and establish uniform national requirements for cookies and tracking technologies.

Until federal legislation passes, businesses must navigate the growing number of state laws independently.

This is general legal information, not legal advice. State privacy laws are evolving rapidly, with new laws taking effect and existing laws being amended through regulation. Consult a privacy attorney for advice specific to your business operations and the states where you operate.