US state cookie & consent laws, in plain English

Last reviewed October 14, 2026 · kept current as laws take effect · research, not legal advice

No US state requires a European-style "accept before anything loads" banner. The American model is opt-out: you may load cookies and ad pixels by default, but you must tell people and give them a working way to stop the "sale," "sharing," or "targeted advertising" of their data. Here is the whole map — who's covered, what each state wants, and what actually gets fined.

The five things to know

24 states now have a comprehensive privacy law. 20 are in force today; Oklahoma and Louisiana start January 1, 2027, Alabama May 1, 2027, and Vermont January 1, 2028.
Ad pixels are the trigger. Meta, TikTok, Google Ads and similar pixels are generally treated as "sale/sharing" or "targeted advertising" — that is what the opt-out must actually switch off.
12 states require honoring Global Privacy Control (GPC) — a browser signal that means "opt me out," automatically: CA, CO, CT, DE, MD, MN, MT, NE, NH, NJ, OR, TX. This is the most-enforced cookie rule in America right now.
Opt-in is required in narrow cases: sensitive data (health, precise location, biometrics, children) in most states, and teens' data for ads or sale in several. Maryland bans selling sensitive data outright.
No state law ≠ no risk. 26 states have no comprehensive law, but wiretap lawsuits — California's CIPA above all — are the biggest cookie risk for stores everywhere. California narrowed one CIPA theory on September 30, 2026 (SB 690), but the main wiretap claims still stand.

All 24 states at a glance

Every law below gives consumers the right to opt out of sale and targeted advertising. Thresholds count residents of that state per year. Sorted by in-force date.

State	Law	In force	Covered if you…	GPC	Max penalty
California	CCPA/CPRA	2020 / 2023	$25M+ revenue, or 100k consumers, or 50%+ revenue from selling/sharing	Yes	$2,500 / $7,500 intentional
Virginia	VCDPA	Jan 2023	100k, or 25k + 50% revenue from sales	No	$7,500
Colorado	CPA	Jul 2023	100k, or 25k + any revenue from sales	Yes	$20,000
Connecticut	CTDPA	Jul 2023	35k (from Jul 2026), or any sensitive data, or any sale	Yes	$5,000 willful
Utah	UCPA	Dec 2023	$25M revenue AND (100k, or 25k + 50%)	No	$7,500
Texas	TDPSA	Jul 2024	Anyone not an SBA small business	Yes	$7,500
Oregon	OCPA	Jul 2024	100k, or 25k + 25% revenue from sales	Yes	$7,500
Florida	FDBR	Jul 2024	$1B+ revenue + tech tests — rarely applies to stores	No	$50,000
Montana	MCDPA	Oct 2024	25k, or 15k + 25% (since Oct 2025)	Yes	AG enforcement
Iowa	ICDPA	Jan 2025	100k, or 25k + 50%	No	$7,500
Delaware	DPDPA	Jan 2025	35k, or 10k + 20%	Yes	$10,000
Nebraska	NDPA	Jan 2025	Anyone not an SBA small business	Yes	$7,500
New Hampshire	NHPA	Jan 2025	35k, or 10k + 25%	Yes	$10,000
New Jersey	NJDPA	Jan 2025	100k, or 25k + any revenue from sales	Yes	$10,000 / $20,000 repeat
Tennessee	TIPA	Jul 2025	$25M revenue AND (175k, or 25k + 50%)	No	$7,500 (×3 willful)
Minnesota	MCDPA	Jul 2025	100k, or 25k + 25%	Yes	$7,500
Maryland	MODPA	Oct 2025	35k, or 10k + 20%	Yes	$10,000 / $25,000 repeat
Indiana	ICDPA	Jan 2026	100k, or 25k + 50%	No	$7,500
Kentucky	KCDPA	Jan 2026	100k, or 25k + 50%	No	$7,500
Rhode Island	RIDTPPA	Jan 2026	35k, or 10k + 20%	No	$10,000
Oklahoma	OCDPA	Jan 2027	100k, or 25k + 50%	No	$7,500
Louisiana	LDPA	Jan 2027	$25M revenue, or 75k consumers/devices, or 50% from sales	Partly*	State UDAP law
Alabama	APDPA	May 2027	25k, or 25% from sales; under 500 employees exempt if no sale	No	$15,000
Vermont	VDPOSA	Jan 2028	35k, or sensitive/sold data of 3k	Yes	Consumer protection act

*Louisiana treats browser and device settings as an "authorized agent" for opt-outs, so GPC-style signals can count without a stand-alone mandate. Penalty figures are statutory maximums per violation — verify before relying on them.

What actually gets fined

Enforcement so far points at four failures, and none of them is "no banner":

The banner says off, but tags still fire. Healthline paid $1.55 million because its consent banner didn't actually stop tracking. This is the single most important thing to test on your own store.
Ignoring Global Privacy Control. Sephora ($1.2M), Todd Snyder ($345,178) and PlayOn ($1.1M) were all fined for not treating the browser signal as a real opt-out.
Opting out is harder than opting in. Honda paid $632,500 for a one-click accept next to a multi-step opt-out. Regulators call these dark patterns, and consent obtained through them is invalid.
No proof. The laws expect a record of each choice — who, when, under which version of your policy — and a cookie inventory you can produce.

What a compliant US setup looks like

One configuration can satisfy all 24 states by following the strictest common rules:

An inventory of every cookie, pixel and SDK, with vendor and purpose.
A "Your Privacy Choices" / "Do Not Sell or Share" link on every page.
A one-click opt-out — no harder than opting in — that really stops marketing tags from firing.
GPC detected and applied automatically for every US visitor.
Opt-in before anything runs on sensitive pages (health, children's products).
A consent log you could hand to a regulator: timestamp, choice, policy version, whether GPC applied.
Geo-aware rules: EU and UK get ask-first, US gets opt-out + GPC, and the setup refreshes as new laws start (Connecticut tightened July 2026; Oklahoma and Louisiana start January 2027, Alabama May 2027, Vermont January 2028).

Where Vafer fits

This list is Vafer's feature set: per-state rules (California can differ from Texas), automatic GPC honoring that's logged as such, an opt-out that genuinely stops and deletes, a per-store cookie declaration, an exportable consent log, and a live Diagnostics screen showing what each state's visitors are actually served. We publish our limits too — see how it works.

Check your own store

The free coverage checker reads your store's current consent setup — whatever app you use — and shows what's actually covered.

Run the free coverage check Join the waitlist