US cookie compliance starts with what the site does with information, which state laws apply, and whether privacy choices actually change that behavior. A banner is one interface. It is not the whole system.
The sections below cover selected state-law differences, California's sale/sharing rules, Global Privacy Control (GPC), enforcement examples and a runnable demo. Sources were checked on October 22, 2026. This implementation guide is not a 50-state survey or a determination of any organization's legal obligations.
Are cookie banners required in the US?
US websites do not all need the same cookie banner. First identify which laws cover the business and its processing. An opt-out from sale or targeted advertising is different from prior consent to a particular use of information.
For example, California gives consumers of covered businesses sale/sharing opt-out rights, while Virginia requires consent for covered sensitive-data processing. Neither statement means that every ordinary cookie must have an Accept button. California AG's CCPA overview, Virginia Code, §59.1-578.
Before choosing a consent platform, inventory each script, cookie, pixel, app and server integration. Record its purpose, recipient, information sent, retention, contractual role and control method. “Analytics” and “necessary” are labels to substantiate, not automatic legal exemptions. An advertising request can disclose information even when it uses no cookie.
If the site also serves people in Europe, review GDPR applicability and the separate cookie rules. A US-state opt-out configuration should not silently become the site's EU consent policy.
California: CCPA, CPRA and cookie choices
CPRA amended CCPA; they should not be treated as two unrelated cookie regimes. California's published applicability tests concern qualifying for-profit businesses doing business in California: preceding-year gross revenue of $26.625 million or more, annually buying/selling/sharing personal information of 100,000 or more California residents or households, or deriving 50% or more annual revenue from selling/sharing California residents' information. Other statutory conditions and exemptions need review. CPPA FAQ.
The revenue amount is the inflation-adjusted threshold effective January 1, 2025, still the published amount at this review date. Do not keep copying an older $25 million checklist. CPPA threshold adjustments.
Sale and sharing are not just a cash transaction
California's sale definition includes monetary or other valuable consideration. Sharing concerns cross-context behavioral advertising and can occur without money changing hands. A retailer saying “we do not sell customer lists” has not answered what its advertising integrations do. CCPA statute, §1798.140, California AG's explanation of sale/sharing.
A covered site should map the actual data flow and provide applicable notices and working opt-outs. Under §§7025–7026, a valid signal must be processed for the browser or device and associated profiles, and for the consumer when known. A covered business that collects personal information online must offer the signal plus at least one other method for a sale/sharing opt-out; a cookie banner alone does not count. A business can omit the separate “Do Not Sell or Share” link only if it processes signals frictionlessly, the signal fully carries out the opt-out, and its privacy policy includes required information. The site must also show whether it honored the signal. Current CCPA regulations, §§7025–7026.
Not every privacy choice uses the same rule
California has separate sale/sharing opt-in rules for consumers known to be under 16: ages 13–15 authorize themselves; under 13 requires a parent or guardian. Sensitive-information limits are another distinct right. These should not be collapsed into an ordinary adult cookie-banner setting. CPPA consumer-rights FAQ.
Below a CCPA threshold does not mean that every privacy, security, advertising or sector obligation disappears. Establish the entity's obligations before claiming either “fully compliant” or “exempt.”
California's CCPA regulations also changed on January 1, 2026. They add privacy risk-assessment and cybersecurity-audit duties for some businesses, and rules for certain automated decisionmaking technology. Those are separate from cookie controls, and their thresholds and phased dates need their own review. A cookie audit alone is not a complete CCPA assessment. The CPPA's current regulation package lists the provisions and effective date.
What changes in other states?
The examples below highlight selected differences; they are not a complete eligibility calculator. Comprehensive privacy laws commonly distinguish residents acting personally from employment or commercial contexts, and each law's exemptions and definitions need review. IP location helps with implementation but does not establish residency or applicability.
Colorado: GPC and nonprofit applicability
Colorado's general thresholds are controlling/processing 100,000 consumers' information annually, or 25,000 while receiving revenue or a discount from personal-data sales, along with its business/targeting conditions. Nonprofits are not automatically excluded. Covered controllers must honor recognized universal opt-out mechanisms for sale and targeted advertising from July 1, 2024; the AG currently identifies GPC as its recognized mechanism. A nonprofit with substantial audience data should assess scope rather than copying California's for-profit assumption. Colorado AG privacy guidance, recognized opt-out mechanisms.
Connecticut: the July 2026 scope change matters
From July 1, 2026, Connecticut's applicability alternatives are: doing business in the state or targeting its residents and processing at least 35,000 consumers' data in the preceding year; processing consumers' sensitive data; or offering consumer data for sale in trade/commerce. The first two exclude payment-only processing. Exemptions still need review: nonprofits are generally exempt, but the state says that exclusion does not apply to consumer-health-data controllers, which are covered without a size threshold. The signal obligation began January 1, 2025 and requires a consumer-selected signal. This concerns opt-out transmission, not consent to every activity. Connecticut statutes, §§42-516–42-520, Connecticut Attorney General's applicability guidance.
A site offering a precise-location feature needs to examine sensitive-data processing, rather than assuming low traffic settles Connecticut scope.
Connecticut's Public Act 26-64, effective October 1, 2026, further amended the CTDPA. It expands consumer rights around profiling and certain profiles built from public information, and prohibits controllers and third parties from selling consumers' precise geolocation data. The act also adds a separate disclosure rule for some online surveillance pricing. Check location, profiling and pricing flows alongside the existing GPC opt-out process. The enacted act, Connecticut Attorney General's summary.
Virginia: opt-out rights without the same express signal mandate
Virginia's general tests are 100,000 consumers, or 25,000 plus more than 50% of gross revenue from personal-data sales, with its business/targeting conditions. Government bodies and nonprofits are among its entity exemptions. Covered consumers can opt out of targeted advertising and sales. The current statute also prohibits selling or offering for sale consumers' precise geolocation data and restricts certain processing of known children's data—including targeted advertising, sale and certain profiling—with parental-consent conditions. These are separate questions for sites that collect precise location or serve children. The reviewed statute specifies request methods without an express GPC mandate; that does not remove the underlying opt-out rights. Virginia Code, §§59.1-576–59.1-578.
Set the legal policy first: identify covered activities and populations, then configure the interface, signal handling and downstream integrations to match. Recheck when the business, vendors or law changes.
How Global Privacy Control works
GPC communicates a do-not-sell/share preference through a supporting browser or extension. An HTTP request carries `Sec-GPC: 1`; client-side code can read `navigator.globalPrivacyControl === true`. Both communicate the same opt-out preference. Define how it interacts with other site choices under applicable law, and do not let a generic Accept action silently clear it. The specification is an evolving W3C draft, and applicable law determines its legal effect. W3C GPC specification.
GPC is not a request to delete an account, block every cookie, or stop a shopping cart from working. It also is not the older Do Not Track setting. Absence of GPC is not affirmative consent. Other site choices and legal requirements still apply.
California's Opt Me Out Act (AB 566) becomes operative on January 1, 2027. It requires a CCPA-covered business that develops or maintains a browser to provide consumer-configurable functionality that sends an opt-out preference signal, makes the feature easy to find and configure, and explains the signal in public disclosures. This browser requirement does not set a new deadline for websites to start honoring signals: covered businesses already have duties under the CCPA regulations to process valid signals they receive. The enacted bill, CPPA's announcement.
Real enforcement examples: the controls must work
Sephora: advertising arrangements and an ignored signal
In August 2022, California's AG announced a $1.2 million settlement resolving allegations that Sephora failed to disclose personal-data sales and process user-enabled GPC opt-outs, among other violations. The AG explained that retailers could benefit in kind from third-party tracking arrangements. This was a settlement of allegations, not our audit of Sephora's current site. Official Sephora announcement.
For a retailer reviewing its own site, the useful question is: which recipients receive browsing information, on what terms, and does the opt-out change those flows?
Honda: excessive verification and unequal choices
In March 2025, CPPA announced a $632,500 Honda settlement resolving claims including excessive information required for opt-out/limit requests and unequal privacy-choice design. This is a controls/friction example, not a GPC-specific case. Official Honda announcement.
Test a privacy request as carefully as a checkout. Do not route every right through an account-login or identity-verification process merely because the same form handles deletion requests.
A working example: GPC is detected, but advertising still runs
We built a local GPC-check demo source download for a fictional shop. It reads the actual JavaScript browser signal and provides a clearly separate checkbox to simulate an active signal. The simulator does not change your browser settings or send an actual Sec-GPC header.
In the before view, the status acknowledges an active preference, but the optional advertising test still reads the local event file. Detection without enforcement is the defect.
In the after view, the active signal blocks that test request. A separate necessary-site test remains available. A direct site opt-out independently blocks advertising; turning the simulator off does not erase that choice.
All requests read fixed synthetic JSON from the same loopback server. The demonstration has no third-party trackers, personal information, cookies, persistent preferences or connected account. It does not determine state-law applicability or prove a live vendor's compliance.
Put the check in the execution path
In the demo handler, combine the real browser signal with the test-only simulator and separate site choice before deciding whether to send an optional request:
const browserGpc = navigator.globalPrivacyControl === true;
const saleShareOptOut =
browserGpc || controller.simulatedGpc || controller.siteOptOut;
if (requestKind === 'optional_advertising' && saleShareOptOut) {
addLog('Blocked', 'Optional advertising request was not sent.');
return;
}The full local controller and request wiring source download applies this combined state before loading its fixed synthetic JSON. A production integration additionally needs policy decisions, persisted preferences where applicable, account linkage, vendor controls and server-side enforcement. The absence of an opt-out in this sample is not permission for every possible use.
The browser sends the real header; JavaScript should not try to create Sec-GPC in fetch. Check what reaches the server and apply the preference before applicable server-side events. A JavaScript check alone cannot stop a separate backend advertising integration.
What to check on WordPress, Shopify or another site
1. Establish the scope and classify the flows
Record entity type, relevant residents, threshold calculations, exemptions and activity-specific rules with an accountable reviewer. Then map scripts and server integrations to actual purposes. Review advertising audiences, cross-site tracking, embedded video/maps, session replay, chat and app integrations individually. A platform or vendor label does not settle sale/sharing status.
2. Test the signal before loading the page
Use a supporting browser/extension, enable GPC, and start a clean test session. In DevTools, inspect the document request for the real Sec-GPC: 1 header, then check the client-side signal. Compare with an otherwise equivalent session without the signal. Chrome Network inspection.
Browsers may expose GPC differently. Record the browser/version and observed header or property. An unsupported property does not show that the user affirmatively permitted tracking. The demo's simulator can test the controller, but it cannot replace a real browser-header test.
3. Verify effects, not just the banner message
For an authorized test, compare document load, navigation, form/product interactions and checkout handoffs. Under the applicable opt-out, inspect both new storage and outbound requests. Check existing identifiers too. Capture endpoint, trigger, purpose, recipient and expected versus observed behavior. Chrome Application panel.
For WordPress, inspect theme scripts, plugin output, tag-manager containers and embedded services. For Shopify, include app/pixel integrations and checkout-related flows as well as theme code. Removing a theme snippet does not prove that an app or backend stopped sending the same event.
Some integrations may support a lawful restricted mode instead of being removed. Check its actual behavior and terms; “consent mode enabled” describes a configuration, not a test result.
4. Check direct choices and known accounts
Test the visible privacy link without signing in. Confirm a direct opt-out changes classified activity. Test a returning session and an authorized synthetic account where relevant; do not assume browser-only state implements known-consumer scope. Ensure generic Accept actions do not silently erase an opt-out signal or an earlier site choice.
The demo resets on reload. A production system needs its own policy for how choices persist, propagate and interact, with appropriate records and minimal collected information.
5. Review the handoff beyond the browser
Inspect server events, CRM/audience exports and vendor settings with authorized access. Match notices and contracts to the actual inventory. Define who approves a new app, script or purpose and who retests the controls afterward.
A monthly audit should leave a dated inventory, tested cases, evidence, unresolved questions, owners and fixes. A green cookie-scanner screenshot alone does not give the team that record.
What should the next step be?
Start with the site's business facts and data flows. Decide which rules apply, configure the notices and controls, then test whether preferences change browser and server behavior while the site's necessary features continue to work.
dirango offers cookie-consent implementation and monthly audits and website governance. Use the project form to share the platform, markets, advertising integrations and controls for review.
Need help with your site?
We offer cookie consent. Send us the site and what you need help with, or read more about the service.