Is cookie consent required in the USA? What to show instead of a banner

Is cookie consent required in the USA? For most visitors, no. There’s no federal law that asks a website to wait for a yes before it sets cookies, and the state laws that do exist work the other way round: the data can flow, but a resident has to be able to say stop.

That doesn’t make the question go away. California asks for a specific link, a browser signal and an opt-out that works. Other states ask for an opt-out of targeted advertising. And the moment someone from Dublin or Manchester lands on your homepage, the rules change under your feet.

This guide walks through what the US asks for instead of a banner, when an EU or UK audience changes the answer, and how to check your own site on a phone.

Is cookie consent required in the USA? Mostly not, but opt-outs are

The US has no equivalent of Europe’s ePrivacy rule. What it has is a set of state privacy laws, California’s first among them, that treat tracking as a question of selling and sharing personal information.

The California Consumer Privacy Act, usually shortened to CCPA, applies to a for-profit business that does business in California and meets any one of three thresholds. The state’s privacy agency lists them: a gross annual revenue of $26.625 million or more, buying, selling or sharing the personal information of 100,000 or more California residents or households, or earning half or more of its revenue from selling or sharing that information. The revenue figure moved up from $25 million on 1 January 2025.

Those thresholds are high, and a small company often sits under all three. Watch the second one: an advertising pixel that fires for every visitor counts toward that 100,000 figure whether or not you ever look at the data.

The Attorney General’s page lists the right to opt out of sale or sharing alongside the rights to know, delete and correct.

Do I need a cookie banner on my website?

Not for California. The regulations list the methods a business has to offer for an opt-out request, and then say a cookie banner or cookie controls are not by itself an acceptable method. The regulation’s own reason is that cookies concern the collection of personal information, not its sale or sharing.

A banner can stay. It just can’t be your answer when a Californian asks how to opt out.

What California asks for instead

Three things, all on your public pages.

The Do Not Sell or Share link

A business that sells or shares personal information has to show a clear and conspicuous “Do Not Sell or Share My Personal Information” link. The regulations put it in the header or footer of the homepage, looking like the other links around it. The page behind it has to let the visitor opt out there and then.

Two things remove the need for it. If your site honours opt-out preference signals in a frictionless manner, section 7013 lets you post a notice of the right instead. And if you don’t sell or share personal information at all, and your privacy policy says so, no link or notice is needed.

The Global Privacy Control signal

Global Privacy Control is a setting in a browser or extension that sends “don’t sell or share my data” with every page request. The Attorney General’s page names it as an acceptable opt-out method and says it must be honored by covered businesses as a valid request to stop the sale or sharing.

So your advertising and cross-site tags stay quiet for a visitor whose browser sends the signal, before they’ve clicked anything.

An opt-out that actually works

Section 7026 describes the shape of the opt-out. The method has to be easy for consumers to execute and require minimal steps. You can’t ask the person to create an account. You can’t demand a verifiable request. And you have to stop selling or sharing their data as soon as feasibly possible, no later than 15 business days after the request.

The agency’s Enforcement Division wrote a related idea into Enforcement Advisory 2024-02, dated 4 September 2024. It calls it symmetry in choice: the path to the more privacy-protective option shall not be longer, more difficult or more time-consuming than the path to the less protective one. Its example of a symmetrical banner offers “Accept All” and “Decline All”. One of its three sample interfaces is a banner with a single “OK” button and the line that by using the website you consent. The advisory then asks a business to check whether its path to “no” is longer than its path to “yes”.

Which states require cookie consent, and which an opt-out

None of the state laws asks for consent before ordinary cookies load. They give residents a right to opt out, and the newer ones add browser signals.

Connecticut shows the pattern outside California. Its Data Privacy Act reaches a business that controls or processes the personal data of at least 35,000 consumers, or any sensitive data, or that offers personal data for sale. Residents can opt out of targeted advertising and of the sale of their data, and the Attorney General’s page says that since 1 January 2025 covered businesses have to honour universal opt-out preference signals.

Virginia, Colorado and Texas have their own versions, with different thresholds and definitions of a sale. The Handbook article on state privacy laws sets them side by side.

When an EU or UK audience changes the answer

If nobody outside the US ever visits, you can skip this section. For everyone else: the moment people in the EU or the UK use your site, the question flips from opt-out to opt-in.

In the EU, the ePrivacy rule says a site may store information on a visitor’s device, or read it, only after the visitor has consented. Cookies the site needs to work are the exception. The Court of Justice spelled out what consent looks like in Planet49 on 1 October 2019: a pre-checked checkbox which the user must deselect is not valid consent. The European Data Protection Board adds that scrolling or swiping through a page will not under any circumstances count as a clear affirmative action.

The UK kept the same rule after leaving the EU. The ICO’s guide says you cannot set non-essential cookies on your website’s homepage before the user has consented, and that consent has to be more than simply continuing to use the website. Its examples of strictly necessary cookies are a shopping basket, a session cookie that keeps online banking secure, and load balancing.

So a US business with an EU or UK audience ends up with both: a banner that holds the analytics and advertising tags until a yes for those visitors, and an opt-out link and signal for Californians. One consent tool can do both, if it’s set up for both.

The Handbook article on trackers before consent covers the EU side, and the cookie banner examples post shows what a banner that waits looks like.

What regulators have looked at

Every California case so far is about an opt-out that didn’t reach the trackers.

In August 2022 the Attorney General announced a $1.2 million settlement with Sephora. The allegation was that the retailer did not tell consumers it was selling their personal information and did not process opt-out requests sent through the Global Privacy Control. Sephora agreed to update its disclosures and support the signal.

On 1 July 2025 the Attorney General announced $1.55 million from Healthline Media. The complaint alleged that the site kept sharing data with some advertising third parties after readers opted out, and that its consent banner did not disable tracking cookies when a reader unchecked a box. The Attorney General said Healthline disregarded consumer’s rights to opt-out of the sale and sharing of this data. Those are allegations the settlement resolved.

In March 2025 the privacy agency announced that Honda would pay $632,500 to resolve allegations that included a privacy tool which, in the Enforcement Division’s words, failed to offer Californians their privacy choices in a symmetrical or equal way, and that asked people to verify themselves before opting out. In September 2025 Tractor Supply agreed to pay $1,350,000 over allegations that its opt-out mechanism did not work effectively, including for signals such as the Global Privacy Control.

Healthline had a banner. Honda had a privacy tool. The allegations were about what happened after someone used them.

Check your own site in five minutes

Use a phone and a browser you don’t normally use, so no saved choices get in the way.

1. Open your homepage and scroll to the footer. Look for a link that says Do Not Sell or Share My Personal Information, or Your Privacy Choices. Note whether it’s there and whether it looks like the other footer links.
2. Tap it. The page behind it should let you opt out right away, with no login and no request for your ID. Count the taps.
3. Compare the two paths. If accepting takes one tap and declining takes four, that’s the asymmetry the advisory describes.
4. Try the signal. Install a browser that sends Global Privacy Control, such as Brave, DuckDuckGo or Firefox, and load your homepage. Open the page’s privacy or cookie settings and see whether the advertising category shows as off.
5. Read your privacy policy for the words “sell” and “share”. If the policy says you do neither, and your pages run advertising tags, the two don’t match.
6. If you have EU or UK visitors, reload with a clean browser and watch what loads before you touch the banner. Analytics and advertising tags should wait.

If step 2 fails, fix that first. A link that leads to a page that does nothing is the pattern in several of the cases above.

Peeky reads the public pages of your site. For the opt-out link, the signal and the state laws behind them, the checks are US-02, US-03 and US-11 in the Handbook. The CCPA compliance checklist post covers the rest of the law, and types of website cookies sorts out which cookies the EU and UK rules let through.

Questions people ask

Is cookie consent mandatory in the USA?

Not as a yes-before-anything-loads rule. No federal law asks for a cookie banner, and California's law works on opt-out. The state's Attorney General says a business that sells or shares personal information needs a clear and conspicuous Do Not Sell or Share My Personal Information link and has to honour the Global Privacy Control signal. A visitor from the EU or UK is a different question.

Do I need a cookie banner on my website if I'm a US business?

The CCPA doesn't ask for one. If you sell or share personal information and fall under the law, it asks for an opt-out link in the header or footer of your homepage, or for your site to honour opt-out signals instead. The regulations say a cookie banner is not by itself an acceptable method for opting out. If EU or UK visitors matter to you, a banner that waits for a yes comes back into the picture.

Which states require cookie consent?

None of them asks for consent before ordinary cookies load. The ones with privacy laws give residents a right to opt out of targeted advertising and the sale of their data. Connecticut's Attorney General says that since 1 January 2025 covered businesses have to honour opt-out preference signals too.

What happens when a visitor opts out through my site?

In California the regulations give you 15 business days to stop selling or sharing that person's data, and the opt-out has to work without an account or an identity check. The Attorney General's page adds that you then wait at least 12 months before asking them to opt back in.

Is a cookie banner enough for the CCPA?

The regulations say no. Section 7026 lists a cookie banner or cookie controls as not by itself an acceptable method for an opt-out request, because cookies are about collection and the right is about selling and sharing. A banner can sit alongside the link. It can't replace it.