US cookie and tracking requirements vary by state, business activity and the information collected. This guide explains the main rules and helps you understand which privacy choices your website may need to provide.
Most US websites are not automatically required to block every non-essential cookie until the visitor gives consent.
However, covered businesses may need to disclose their tracking, provide opt-out controls for targeted advertising or the sale of personal data, honour recognised privacy signals, and obtain consent before processing certain sensitive or children’s information.
Whether you need a banner or another privacy control depends on the laws that apply to your business and what your trackers do, not simply on whether your website uses cookies. The examples and checklist below help you identify which controls to review for your setup.
What Are US Cookie Consent Laws?
US cookie consent laws are rules that affect how websites collect, use, disclose, sell, or share information through cookies and similar technologies.
These requirements may come from:
- federal consumer protection laws;
- federal laws covering children, health, finance, or other regulated sectors;
- comprehensive state privacy laws;
- state consumer protection laws;
- state laws covering biometric, health, or children’s information;
- contractual requirements imposed by advertising and analytics platforms.
The rules can apply to more than traditional browser cookies. Tracking pixels, local storage, advertising identifiers, embedded services, and device fingerprinting may also collect information covered by privacy laws.
If you want to compare the United States with other regions, begin with our guide to cookie consent laws around the world.
Is There a Federal Cookie Law in the United States?
The United States does not currently have one comprehensive federal law that creates the same cookie consent requirements for every website.
Instead, several federal laws and rules may become relevant depending on the website, visitor, and information involved.
Federal Trade Commission Act
The Federal Trade Commission can take action against unfair or deceptive business practices.
A website may create legal risk when it:
- makes inaccurate claims about its tracking practices;
- collects information after promising that tracking is disabled;
- ignores a privacy choice it claims to respect;
- shares sensitive information without adequate disclosure;
- uses misleading banner wording or design;
- fails to provide reasonable protection for collected information.
A privacy policy should therefore describe what the website actually does. The website’s technologies must also respect the choices presented to visitors.
Children’s Online Privacy Protection Act
The Children’s Online Privacy Protection Act, commonly called COPPA, applies to certain websites and online services directed to children under 13. It can also apply when an operator has actual knowledge that it is collecting personal information from a child under 13.
Covered operators generally need verifiable parental consent before collecting personal information from children. Persistent identifiers used for tracking, profiling, or behavioural advertising may be treated as personal information.
The updated COPPA Rule also requires separate verifiable parental consent for disclosures to third parties, including for targeted advertising, unless the disclosure is integral to the nature of the website or service. An ordinary cookie banner’s Accept button does not by itself verify parental consent. See the FTC’s explanation of the updated COPPA requirements.
Industry-specific privacy laws
Additional federal rules may apply to organisations operating in regulated sectors.
Examples can include:
- healthcare and health-related services;
- banks and financial institutions;
- credit reporting;
- educational services;
- telecommunications services.
A website should not assume that ordinary state privacy rules are the only requirements that matter.
How Do State Privacy Laws Affect Cookies?
A growing number of states have enacted comprehensive consumer privacy laws. These laws do not normally regulate files called cookies as a separate category. Instead, they regulate the personal data collected through cookies and other technologies.
Covered businesses may need to:
- publish a clear privacy notice;
- explain the categories of personal data they process;
- identify the purposes of the processing;
- disclose targeted advertising or the sale of personal data;
- provide an accessible opt-out method;
- honour applicable universal opt-out signals;
- obtain consent before processing certain sensitive data;
- complete assessments for higher-risk processing;
- respond to consumer privacy requests.
The following table provides simplified examples. It is not a complete list of US state privacy laws.
| State | Main Framework | Common Tracking Right | Possible Website Requirement |
|---|---|---|---|
| California | CCPA and CPRA amendments | Opt out of the sale or sharing of personal information | Provide a clear opt-out method and honour applicable Global Privacy Control signals |
| Colorado | Colorado Privacy Act | Opt out of targeted advertising, data sales, and certain profiling | Provide an accessible opt-out and recognise valid universal opt-out mechanisms |
| Connecticut | Connecticut Data Privacy Act | Opt out of targeted advertising and the sale of personal data | Provide an opt-out link and honour applicable opt-out preference signals |
| Texas | Texas Data Privacy and Security Act | Opt out of targeted advertising, data sales, and certain profiling | Clearly disclose the processing and explain how consumers can opt out |
Every state law has its own definitions, thresholds, exemptions, and effective dates. A business must first determine whether it falls within the scope of the relevant law.
Do not assume that a state privacy law applies to every small website. Some laws use revenue, data-volume, business-activity, or other thresholds. However, federal consumer protection and industry-specific rules may still apply.
Opt-In vs Opt-Out Cookie Consent in the US
One of the main differences between the United States and European Union is the common starting point for online tracking.
| Consent Model | How It Works | Common US Use |
|---|---|---|
| Opt-out | Processing may begin, but the visitor receives information and a way to stop certain uses | Targeted advertising, data sales, sharing, or certain profiling under applicable state laws |
| Opt-in | The relevant processing remains disabled until the visitor gives permission | Sensitive data, certain children’s information, and other processing for which consent is required |
A website may need to support both models. For example, it may provide an opt-out for targeted advertising while requiring prior consent before collecting precise geolocation or processing information about a child.
Want a simple comparison between the European and California privacy models?
When Can Cookies Be Used Without Prior Consent?
Many US laws do not require prior consent before every ordinary cookie is activated.
Depending on the applicable law, prior consent may not normally be required for technologies used to:
- keep a shopping cart working;
- maintain a secure login session;
- remember basic website preferences;
- prevent fraud or protect account security;
- balance website traffic;
- complete a transaction requested by the visitor;
- perform certain transparent and lower-risk website measurements.
The website should still collect only information that is reasonably necessary for its disclosed purposes. It should also explain its practices accurately.
A cookie does not become exempt simply because the website owner considers it useful. The purpose, information collected, providers, and applicable law must be reviewed.
When May Cookie Consent Be Required?
Prior consent may be required when a federal or state law treats the processing as sensitive or gives a particular group additional protection.
Examples may include:
- collecting personal information from children covered by COPPA;
- processing precise geolocation data;
- processing biometric identifiers;
- collecting certain health information;
- processing information revealing racial or ethnic origin, religious beliefs, sexual orientation, or citizenship status;
- selling or using the information of children or teenagers for targeted advertising where a state law requires opt-in consent;
- using data for another purpose that is materially different from the purpose originally disclosed;
- processing information in a way that requires consent under a specific state law.
The definition of sensitive data differs between jurisdictions. Website owners should determine what each tracker collects instead of relying only on the provider’s description.
A basic session cookie used to keep a visitor logged in creates a different privacy risk from a location-tracking identifier used to build an advertising profile across multiple services.
Targeted Advertising, Sale, and Sharing Explained
Many US state privacy laws focus on how personal data is used rather than whether a website uses a file called a cookie.
Targeted advertising
Targeted advertising generally involves selecting advertisements based on information collected about a person’s activity across different websites, applications, or services.
Technologies used for targeted advertising may include:
- third-party advertising cookies;
- tracking pixels;
- mobile advertising identifiers;
- cross-site identifiers;
- browser fingerprinting;
- advertising scripts and tags.
Several state privacy laws give covered consumers the right to opt out of targeted advertising.
Sale of personal data
A sale does not always require a traditional cash payment. Some state laws use broader definitions that may include exchanging personal data for monetary or another valuable form of consideration.
Sharing personal information
California separately regulates certain sharing of personal information for cross-context behavioural advertising. This can be relevant even when no money changes hands.
For California-specific requirements, read our guide to California cookie consent, sale and sharing opt-outs.
A business should map its advertising relationships instead of assuming that using a free analytics or advertising service cannot constitute a regulated disclosure.
What Is Global Privacy Control?
Global Privacy Control, commonly called GPC, is a browser-based signal that allows a visitor to communicate an opt-out preference automatically.
Depending on the applicable state law, a recognised signal may represent a request to opt out of:
- the sale of personal data;
- the sharing of personal information;
- targeted advertising.
California requires covered businesses to treat GPC as a valid request to stop selling or sharing personal information. Colorado and Connecticut also require covered organisations to recognise applicable universal opt-out mechanisms or preference signals.
A website should test whether:
- the signal is detected correctly;
- advertising or sharing covered by the request stops;
- the visitor’s preference is stored;
- the preference is not overridden by a default banner setting;
- the privacy policy explains how the signal is handled.
A standard cookie banner does not automatically honour Global Privacy Control. The consent platform and connected advertising technologies must be configured to respond to the signal correctly.
Do Analytics Cookies Require Consent in the US?
There is no universal US rule requiring prior consent before every analytics cookie is activated.
A limited analytics setup may present a lower risk when it:
- measures only the performance of the website;
- collects the minimum information necessary;
- does not create detailed profiles of individual visitors;
- does not connect analytics data with advertising information;
- does not follow people across unrelated websites;
- uses appropriate retention periods;
- matches the disclosures in the privacy notice.
Additional requirements become more likely when analytics information is:
- used for targeted advertising;
- combined with information from other services;
- used to create individual profiles;
- shared or sold to third parties;
- connected to sensitive health or location information;
- collected from children or teenagers.
Our separate guide explains what website owners should consider when configuring Google Analytics cookie consent.
US Cookie Banner Requirements
A US website does not automatically need the same Accept and Reject banner used for European visitors.
The appropriate interface depends on:
- which federal and state laws apply;
- whether the business falls within their thresholds;
- which technologies the website uses;
- whether personal data is sold or shared;
- whether data is used for targeted advertising;
- whether sensitive or children’s information is processed;
- whether an opt-out preference signal must be honoured.
A US privacy banner or preference interface should generally:
- clearly explain the main tracking purposes;
- identify targeted advertising or other relevant data uses;
- provide an accessible opt-out when required;
- obtain prior consent where applicable;
- avoid misleading colours, wording, or controls;
- link to more complete privacy information;
- allow visitors to change their choices later;
- respond correctly to recognised privacy signals;
- work on desktop and mobile devices.
Opt-out interface
An opt-out interface may explain that personal data is used for targeted advertising or another regulated purpose and provide a control to stop that use.
Depending on the law, labels may include:
- Do Not Sell or Share My Personal Information
- Opt Out of Targeted Advertising
- Your Privacy Choices
The control should be easy to find and should stop the relevant processing. A link that does not work or leads visitors through unnecessary steps may not provide an effective choice.
Opt-in consent interface
When prior consent is required, the relevant technologies should remain disabled until the visitor or an authorised parent gives permission.
The interface should explain:
- which information will be collected;
- why it is needed;
- which providers will receive it;
- how it will be used;
- how consent can later be withdrawn.
Does a US Cookie Banner Need a Reject All Button?
US law does not generally require every website to display a “Reject All” button.
For an opt-out model, a more relevant control may be “Your Privacy Choices” or “Opt Out of Targeted Advertising.” The visitor is stopping a specific regulated use rather than rejecting every non-essential cookie.
However, when a website requests opt-in consent, declining should be clear and straightforward. Showing equally understandable accept and decline choices reduces confusion and helps demonstrate that consent was genuine.
A banner should not:
- hide the privacy choice inside several menus;
- use misleading button labels;
- claim that tracking is necessary when it is not;
- make opting out substantially harder than continuing;
- continue regulated advertising or sharing after a valid opt-out.
Does a US Website Need a Cookie Policy?
US privacy laws generally focus on providing an accurate privacy notice rather than requiring a separate document specifically titled “Cookie Policy.”
However, a separate cookie policy can make technical tracking information easier for visitors to understand.
The privacy or cookie notice should normally explain:
- which categories of personal data are collected;
- which cookies and similar technologies are used;
- the purpose of each category;
- whether information is used for targeted advertising;
- whether personal data is sold or shared;
- which categories of third parties receive information;
- how long the information is retained;
- which privacy rights are available;
- how visitors can opt out or submit requests;
- how universal privacy signals are handled.
The notice must reflect the website’s actual practices. Copying another company’s policy without checking the technologies on the website can create inaccurate disclosures.
Learn how to organise the information in our guide on how to create a cookie policy page.
Do US Privacy Laws Apply to Businesses Outside the US?
A company does not necessarily avoid US state privacy requirements because it is established or hosted in another country.
Relevant factors may include:
- whether the business offers goods or services to residents of a state;
- whether it collects personal data from those residents;
- whether it meets the law’s revenue or data-processing thresholds;
- whether it sells personal data or uses it for targeted advertising;
- whether a specific jurisdiction is targeted;
- whether an exemption applies.
Each law has its own geographical scope. An international website may need to provide different privacy choices to US, EU, UK, and other visitors.
Do not determine the applicable law only from the location of the website’s server. The business activities, visitor location, processing volume, and use of personal data may also matter.
Who Enforces US Cookie and Tracking Rules?
Enforcement depends on which law applies.
Possible enforcement authorities include:
- the Federal Trade Commission;
- state attorneys general;
- dedicated state privacy regulators;
- other federal or state agencies responsible for regulated industries.
Some laws also provide limited private rights of action for particular violations. However, many comprehensive state privacy laws are primarily enforced by government authorities.
The website owner remains responsible for understanding its technologies and data relationships. Installing a consent management platform does not automatically make the website compliant.
What Happens If a Website Does Not Comply?
Possible consequences can include:
- consumer complaints;
- requests for information from a regulator;
- privacy investigations;
- requirements to change or stop data practices;
- financial penalties or settlements;
- contractual problems with advertising providers;
- civil claims where a law permits them;
- loss of visitor trust;
- unreliable consent and analytics records.
Regulators have taken action against businesses for failing to provide effective opt-outs, ignoring privacy preference signals, making misleading disclosures, and sharing sensitive information through tracking technologies.
Compliance should therefore be based on the website’s actual data flows rather than only on the appearance of its cookie banner.
Practical US Cookie Compliance Checklist
Website owners can use the following steps to review their US cookie and tracking setup.
Use these steps to identify the federal and state privacy requirements that may apply to your website.
- Identify your technologies. Check cookies, pixels, scripts, tags, local storage, advertising identifiers, embeds, and fingerprinting.
- Record the information collected. Determine whether each technology handles personal or sensitive data.
- Identify every purpose. Separate necessary functions, analytics, personalisation, targeted advertising, and other uses.
- Map your providers. Identify which third parties receive or access visitor information.
- Check applicable laws. Review federal rules, state scope thresholds, consumer location, and industry-specific requirements.
- Review sensitive data. Look for health information, precise location, biometric identifiers, and children’s information.
- Identify regulated advertising. Determine whether personal data is sold, shared, or used for targeted advertising.
- Choose the correct privacy model. Configure an opt-out, prior consent, or both where required.
- Support privacy signals. Confirm whether your website must recognise Global Privacy Control or another universal mechanism.
- Publish accurate information. Keep the privacy and cookie notices consistent with the website’s real behaviour.
- Test every choice. Verify that opt-outs and consent decisions actually change which technologies run.
- Repeat the review. Check again whenever laws, plugins, tags, providers, or advertising practices change.
A cookie audit can help identify the technologies your website currently loads.
After configuring your privacy controls, follow our guide on how to test a cookie banner. That guide covers browser-level cookie and tracking checks. Separately verify that GPC signals and opt-out choices are honoured by your advertising partners and any relevant server-side processing.
Official US Privacy Guidance
Because US privacy requirements come from several federal and state sources, website owners should consult the authorities responsible for the laws that apply to them.
Useful official resources include:
- Federal Trade Commission privacy and security guidance;
- Federal Trade Commission COPPA resources;
- California Attorney General CCPA guidance;
- California guidance on Global Privacy Control;
- Colorado Attorney General privacy guidance;
- Connecticut Attorney General privacy guidance;
State privacy laws, regulations, and enforcement guidance can change. Website owners should review their setup regularly instead of treating cookie compliance as a one-time task.
Conclusion
The United States does not use one universal cookie consent model. Federal laws protect particular groups and types of information, while comprehensive state privacy laws create additional disclosure, consent, and opt-out requirements.
Many US state laws focus on targeted advertising, the sale or sharing of personal data, sensitive information, and universal opt-out signals. An EU-style prior-consent banner is therefore not automatically required for every US visitor.
The practical starting point is to identify what the website loads, understand what information each technology collects, determine which laws apply, and configure the appropriate opt-in or opt-out controls.
This article provides general information about cookie consent and privacy requirements. It does not constitute legal advice.
Recommended Next Step
Apply these rules to your own website with our guide, Does My Website Need a Cookie Banner? It helps you review your tracking tools and visitors to decide whether to investigate a consent banner, opt-out controls or a simpler privacy notice for your setup.
Frequently Asked Questions
Common questions about this topic
No. The United States does not have one universal law requiring every website to display an EU-style cookie banner. Whether a banner or privacy interface is needed depends on the applicable federal and state laws, the website’s activities, and how visitor data is used.
Not for every cookie. Many US privacy laws use an opt-out model for targeted advertising, data sales, or sharing. Prior consent may still be required for sensitive data, children’s information, precise location data, and certain other higher-risk processing.
Not automatically. Limited analytics used only to measure website performance may not require prior consent. Additional requirements may apply when analytics data is combined with advertising information, used to profile visitors, shared with third parties, or connected to sensitive data.
Not generally. Under an opt-out model, controls such as “Your Privacy Choices” or “Opt Out of Targeted Advertising” may be more appropriate. When a website requests prior consent, declining should still be clear and straightforward.
Global Privacy Control, or GPC, is a browser-based signal that communicates a visitor’s opt-out preference. Covered businesses in states such as California must honour applicable GPC signals as requests to stop certain sales or sharing of personal information.
Selling generally involves exchanging personal data for money or another form of value, depending on the applicable law. California also regulates certain sharing of personal information for cross-context behavioural advertising, even when no money changes hands.
Not always. Many state privacy laws use revenue, data-volume, business-activity, or other thresholds. A small website that falls outside a comprehensive state law may still be subject to federal consumer protection, children’s privacy, or industry-specific requirements.
Yes. A business located outside the US may need to consider state privacy laws if it offers services to residents of a state, processes their personal data, and meets the relevant law’s scope requirements.
US laws commonly require an accurate privacy notice rather than a separate document specifically called a cookie policy. However, a cookie policy can help explain the technologies used, their purposes, third-party providers, and available privacy choices.
It can. COPPA applies to certain websites and online services directed to children under 13 or operators with actual knowledge that they collect personal information from children under 13. Persistent identifiers used for tracking or behavioural advertising may be covered.
