No single US federal law requires a cookie banner. Whether a US website needs one depends on who visits and what the site does with their data: California and the other states with comprehensive privacy laws require a privacy notice and an easy way to opt out of the sale or sharing of data and of targeted advertising, not an opt-in pop-up; visitors from the EU, EEA or UK trigger opt-in consent before non-essential cookies; Google requires consent signals for EEA, UK and Swiss traffic; and health data, sensitive data and California wiretap lawsuits over session replay and chat tools push many US companies to add a banner anyway. The usual compliant setup for a US-only site is a footer link such as "Your Privacy Choices", automatic handling of Global Privacy Control, and a banner shown only where the law or the data requires one. This is general information, not legal advice.
A cookie banner is the on-page prompt that asks visitors to accept or reject trackers. An opt-in model blocks non-essential trackers until the visitor agrees. An opt-out model lets them run but must offer a clear way to say no, including browser signals that say no automatically. Most US state laws are opt-out. European law is opt-in. We get this question monthly, mostly about paid landing pages, and this is the answer we give.
Does any US law require a cookie banner?
No US federal or state statute requires an opt-in cookie banner for ordinary website analytics and advertising. There is no comprehensive federal privacy law; COPPA covers data from children under 13, and the FTC can act on privacy promises a site breaks. State laws require notice and an opt-out, plus opt-in for sensitive data in most states. A banner is one way to deliver that, not the only way.
Which state privacy laws are in effect in 2026?
As of October 2026, 19 states have comprehensive consumer privacy laws in effect, and two more (Oklahoma and Alabama) are enacted and take effect in 2027. Some trackers also count narrower laws such as Florida's.
- In effect: California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky and Rhode Island (the last three on January 1, 2026)
- Enacted, not yet in effect: Oklahoma on January 1, 2027 and Alabama on May 1, 2027
- Thresholds differ: California applies to businesses with gross annual revenue of $26.625 million or more (as adjusted January 1, 2025) or meeting its data tests; most others start at 100,000 residents, some lower, and Texas and Nebraska reach any non-small business
- Health data sits on top: Washington's My Health My Data Act has no revenue threshold
What does California require on a website?
California requires a notice at collection, a "Do Not Sell or Share My Personal Information" or "Your Privacy Choices" link in the header or footer, and honoring Global Privacy Control as a valid opt-out. Under the CCPA as amended by the CPRA, "sharing" means disclosing personal information for cross-context behavioral advertising, which covers most retargeting pixels. A site running retargeting pixels on California visitors is usually sharing, even if it never sells a list.
Global Privacy Control (GPC) is a browser setting that sends a Sec-GPC: 1 header and a navigator.globalPrivacyControl value to every site. California treats it as an opt-out of sale and sharing. CCPA regulations effective January 1, 2026 also require a business to show whether it processed the signal, for example "Opt-Out Request Honored". California's Opt Me Out Act requires browsers to offer this setting by January 1, 2027. Enforcement is real: the California Attorney General's 2022 settlement with Sephora, for $1.2 million, was over failing to process GPC opt-outs.
Do other states require opt-in consent for cookies?
Most other state laws require opt-in consent only for sensitive data, not for ordinary advertising cookies. They give residents the right to opt out of targeted advertising, the sale of personal data and certain profiling. Sensitive data generally includes health, precise geolocation, race, religion, sexual orientation, citizenship, biometric and genetic data, and data from known children. Utah and Iowa use notice and an opt-out for sensitive data instead. California also differs: it gives a right to limit the use of sensitive personal information rather than requiring opt-in.
About a dozen states require honoring a universal opt-out signal such as GPC. Honoring it for every US visitor meets the strictest version everywhere at once, which is what we set up.
| Region | Main law | Consent model for ad and analytics cookies | What the site must show | Opt-out signal (GPC) |
|---|---|---|---|---|
| EU and EEA | GDPR plus ePrivacy Directive Article 5(3) | Opt-in before any non-essential cookie | Banner with accept and reject, purposes, vendors, withdraw option | Not the mechanism; consent is |
| United Kingdom | UK GDPR plus PECR, amended by the Data (Use and Access) Act 2025 | Opt-in, with new exceptions such as some statistical analytics | Banner for non-exempt cookies, clear information, easy objection where exempt | Not the mechanism; consent is |
| California | CCPA as amended by CPRA | Opt-out of sale and sharing | Notice at collection, Do Not Sell or Share or Your Privacy Choices link | Must honor and show status (from January 1, 2026) |
| Colorado, Connecticut, Texas, Oregon, Montana, Delaware, Nebraska, New Hampshire, New Jersey, Minnesota, Maryland | State comprehensive privacy acts | Opt-out of targeted ads and sale; opt-in for sensitive data | Privacy notice with a clear opt-out method | Must honor a universal opt-out signal |
| Virginia, Utah, Iowa, Tennessee, Indiana, Kentucky, Rhode Island | State comprehensive privacy acts | Opt-out of targeted ads and sale; sensitive data opt-in in most (notice and opt-out in Utah and Iowa) | Privacy notice with a clear opt-out method | Not mandated by statute; honoring it is still the clean default |
| Washington (health data) | My Health My Data Act | Opt-in to collect consumer health data, separate opt-in to share it | Consumer health data privacy policy linked on the homepage | Not the mechanism; consent is |
| Oklahoma, Alabama | New acts, effective January 1, 2027 and May 1, 2027 | Opt-out model with sensitive data rules | Plan the same notice and opt-out link now | Check each act before its date |
When do EU and UK visitors trigger opt-in consent?
Storing or reading a non-essential cookie on the device of a visitor in the EU or EEA requires their prior consent, whether or not your company is in Europe. Article 5(3) of the ePrivacy Directive sets the rule, with an exception for storage that is strictly necessary to provide a service the user asked for. GDPR also reaches non-EU businesses that monitor people in the EU. Pre-ticked boxes and "by continuing to browse you agree" do not count as consent.
The UK follows the same model under PECR. The Data (Use and Access) Act 2025 added exceptions, including one for certain storage used only for statistical purposes, if users get clear information and a simple way to object. Read the ICO guidance before relying on it; it does not cover advertising pixels.
What does Google require for EEA and UK traffic?
Google's EU user consent policy requires you to get valid consent from users in the EEA, the UK and Switzerland for cookies where the law requires it and for personal data used to personalize ads.
Consent Mode is how a site passes those choices to Google tags. It has four core consent types: ad_storage and analytics_storage control cookies, and ad_user_data and ad_personalization control whether user data is sent to Google for advertising and whether ads can be personalized. Google Ads help states that both must be granted for personalized advertising, and that ad_user_data is required for measurement uses such as tag-based conversion tracking and enhanced conversions. Without valid signals you lose remarketing and measurement for that traffic. Basic mode blocks Google tags until the visitor chooses; advanced mode loads them denied and sends cookieless pings for modeling.
Why do US companies still show cookie banners?
US companies usually add banners to manage risk that sits outside the state privacy laws: health data, sensitive data, and California wiretap lawsuits.
- Health data: a pixel on a page about a condition or treatment can make a page view consumer health data under Washington's My Health My Data Act, which requires consent to collect, separate consent to share, and allows private lawsuits
- CIPA wiretap claims: plaintiffs sue under the California Invasion of Privacy Act, arguing that session replay, chat widgets and some pixels let a third party intercept communications without consent; the statute allows $5,000 per violation, and prior consent is the usual defense
- One setup for all traffic: sites with real EU or UK traffic often run one consent setup everywhere
CIPA is moving. SB 690, signed September 30, 2026 and effective January 1, 2027, leaves website pen register and trap and trace claims under Penal Code section 638.51 to the Attorney General only. It does not change wiretap and eavesdropping claims under sections 631 and 632, where session replay and chat cases are brought.
What does a compliant setup look like for a US site?
For most US sites, a compliant setup is a privacy notice, a footer opt-out link, automatic GPC handling, and a consent banner shown only to visitors in regions that require opt-in. This is the build order we use.
Do paid landing pages need a cookie banner?
A US-targeted paid landing page does not need an opt-in banner under state privacy laws, but it does need the footer opt-out link and GPC handling like every other page. US-targeted campaigns still pull some foreign visitors; a geo-targeted banner covers them without touching US conversion rates. For health, legal or financial offers, consent before pixels fire is the safer default. If your form also collects phone numbers for calls or texts, consent for that is a separate question, covered in our guide to TCPA consent language for web forms.
What is normal and what is a red flag.
Some data loss after a correct consent setup is expected and is not a tracking bug. Rejections and GPC opt-outs slow remarketing audiences and cut browser-side conversions. Server-side events through the Conversions API and enhanced conversions recover some measurement, but they must respect the same opt-outs.
Red flags: tags firing before a banner choice where opt-in applies, a Do Not Sell or Share link that leads only to an email address, GPC browsers still sending ad requests, and session replay recording form fields on health pages.
Does CCPA require a cookie consent banner?
No. The CCPA requires a notice at collection, a Do Not Sell or Share My Personal Information or Your Privacy Choices link, and honoring opt-out preference signals such as Global Privacy Control. It is an opt-out law, so it does not require consent before cookies load.
Do I need a cookie banner if my site only targets US customers?
Usually not for ordinary analytics and ads, if you have the notice, the opt-out link and GPC handling. You may still want one for health or sensitive data, session replay or chat tools, or meaningful European traffic.
What is Global Privacy Control and do I have to honor it?
Global Privacy Control is a browser setting that tells every site the user opts out of the sale and sharing of their data. California requires businesses to treat it as a valid opt-out, and from January 1, 2026 to show that it was processed. About a dozen other states require honoring a universal opt-out signal as well.
Do I need Google Consent Mode v2 for a US website?
Google's EU user consent policy and the ad_user_data and ad_personalization requirements apply to users in the EEA, the UK and Switzerland. A US-only site does not need them for US visitors, but any site with European traffic on Google Ads or Analytics should implement consent mode.
Can I use a banner only for European visitors?
Yes. Most consent platforms can show the opt-in banner by region and apply US opt-out rules everywhere else, and Google consent mode supports region-specific defaults. Test it from each region.