VaferNo US state requires a European-style "accept before anything loads" banner — and 24 states now regulate your tracking anyway. The American model is opt-out: pixels may fire by default, but visitors must get a working way to stop the "sale" or "sharing" of their data, and in 12 states their browser can say no for them automatically. Here is the five-minute version for a Shopify store; the full state-by-state table lives in our US privacy-law map.
The shape of US cookie law in one paragraph
US laws don't regulate cookies as such — they regulate what the data is used for. Your cart cookie needs nothing beyond a privacy-policy mention. Your Meta, TikTok and Google Ads pixels are the regulated thing: they count as "sale," "sharing" or "targeted advertising" in essentially every state law, and that is exactly what the opt-out must switch off. Twenty-four states have passed comprehensive laws; twenty are in force today, with Oklahoma and Louisiana starting January 2027, Alabama May 2027, and Vermont January 2028.
The rule that actually gets enforced: GPC
Twelve states — California, Colorado, Connecticut, Delaware, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon and Texas — require honoring Global Privacy Control: a browser signal that means "opt me out," with no click needed. Ignoring it is the most-fined cookie failure in America: Sephora paid $1.2M, Todd Snyder $345,178, PlayOn $1.1M. If your consent setup does one thing right for US traffic, make it this.
What else the fines teach
| Failure | Case | Lesson |
|---|---|---|
| Banner says off, tags still fire | Healthline — $1.55M | The opt-out must genuinely stop the pixels, not save a preference. Test yours in 5 minutes. |
| GPC ignored | Sephora, Todd Snyder, PlayOn | Detect the signal and apply it automatically. |
| Opt-out harder than opt-in | Honda — $632,500 | Symmetry is the law: one click in, one click out. |
| No records | Every consent decree | Keep a log: who chose what, when, under which policy version. |
"My store is small — am I even covered?"
Maybe not by a statute — most laws have thresholds like 100,000 state residents a year. But the floor is dropping: Montana now starts at 25,000, Connecticut, Delaware, New Hampshire, Rhode Island and Maryland at 35,000, and Texas and Nebraska have no count at all — they cover any business that isn't an SBA-defined small business. And the biggest cookie risk never had a threshold: wiretap lawsuits under California's CIPA target stores of every size over session-replay tools, chat widgets and pixels. California narrowed one CIPA theory in September 2026, but the main claims still stand.
What a compliant US setup looks like on Shopify
One configuration covers all 24 states if it follows the strictest common rules: a cookie inventory, a "Your Privacy Choices" link, a one-click opt-out that actually stops marketing tags, GPC honored automatically, opt-in on sensitive pages, a consent log you could hand to a regulator, and geo-aware rules so the EU still gets its opt-in. That list is what Vafer enforces by design — including per-state rules, so California's treatment can differ from Texas's.