Question 1

Does the CCPA require cookie consent?

Accepted Answer

The CCPA/CPRA does not require prior cookie consent (opt-in) like the EU's GDPR. Instead, California uses an opt-out model: businesses can set cookies by default but must provide consumers with a clear "Do Not Sell or Share My Personal Information" link and honor Global Privacy Control (GPC) signals. If cookies are used to sell or share personal information, consumers must be given the ability to opt out. Sensitive data collection via cookies does require opt-in consent under CPRA.

Question 2

Which US states require cookie consent banners?

Accepted Answer

No US state currently requires a European-style opt-in cookie consent banner. However, states with privacy laws — including California, Colorado, Connecticut, Texas, Virginia, and others — require businesses to provide opt-out mechanisms for data sales and targeted advertising conducted via cookies. States that require GPC support (California, Colorado, Connecticut, Texas, Montana, Oregon, New Jersey, Delaware, Nebraska, Maryland, and Minnesota) effectively require a cookie management solution that can detect and honor universal opt-out signals.

Question 3

Do I need to honor Global Privacy Control (GPC) for cookies?

Accepted Answer

If you operate in states that require universal opt-out mechanism support — including California, Colorado, Connecticut, Texas, Montana, New Jersey, and Maryland — you must honor GPC signals. When a GPC signal is detected, you must suppress advertising cookies, tracking pixels, and any data-sharing mechanisms. The California Privacy Protection Agency has actively enforced GPC compliance, fining Sephora $1.2 million for ignoring GPC signals.

Question 4

What is the difference between opt-in and opt-out cookie consent?

Accepted Answer

Opt-in consent (used in the EU under GDPR) requires explicit user permission before setting any non-essential cookies. Opt-out consent (used in US state privacy laws) allows businesses to set cookies by default but requires them to provide a mechanism for consumers to opt out of data sales and targeted advertising. All current US state privacy laws follow the opt-out model, though sensitive data generally requires opt-in consent.

Question 5

Can I use Google Analytics without cookie consent under US state laws?

Accepted Answer

Under most US state privacy laws, you can use Google Analytics without prior opt-in consent because these laws follow an opt-out model. However, if Google Analytics data is shared with Google for advertising purposes, this may constitute a "sale" or "sharing" of personal information under laws like the CCPA/CPRA. You must provide opt-out mechanisms and honor GPC signals in applicable states. Consider using Google Analytics in privacy-focused mode or switching to cookieless alternatives like Plausible or Fathom for simpler compliance.

Cookie Consent Compliance Checker

Step 1: Where are your users located?

Cookie Consent Compliance Checker

Step 1: Where are your users located?