Do US websites need a cookie banner? A practical privacy guide

European websites usually ask visitors to accept or reject cookies first. Many US websites show no banner at all, while others copy the European style. Which is right for a US business depends on who visits your site, what your cookies and tags do, and which state laws apply to you. This guide explains how California's privacy law, Global Privacy Control, other state laws and the FTC Act relate to cookies and tracking, and gives a practical checklist. It is general information, not legal advice; for questions about your own obligations, talk to a privacy lawyer.

Is cookie consent required in the USA?

US privacy law works differently from the European model. The Federal Trade Commission (FTC) says it uses Section 5 of the FTC Act, which bars unfair and deceptive acts and practices in or affecting commerce, together with other federal privacy and security laws. None of the official sources used for this guide describes a general federal rule that every website must ask visitors to opt in to cookies.

Instead, several states have their own consumer privacy laws. The ones covered here are built mainly around opt-out rights: people can tell a business to stop selling their personal information or using it for targeted advertising. Advertising cookies and tracking pixels are often how that selling or sharing happens, so cookies are in scope even where no opt-in banner is required.

What does California require?

The California Consumer Privacy Act (CCPA), as amended, applies to for-profit businesses that do business in California and meet at least one threshold. According to the California Attorney General and the California Privacy Protection Agency (CPPA), these are an annual gross revenue threshold that is adjusted over time (the CPPA's FAQ lists the current figure), buying, selling or sharing the personal information of 100,000 or more California residents or households, or deriving 50% or more of annual revenue from selling or sharing California residents' personal information.

California residents can ask to know, delete and correct their personal information, opt out of its sale or sharing, and limit the use of sensitive personal information. For a website, the key points are:

• Sharing means ad targeting: the Attorney General explains that sharing refers specifically to sharing for cross-context behavioral advertising, meaning ads based on activity across multiple websites.
• An opt-out link: businesses that sell or share personal information must generally provide a clear and conspicuous "Do Not Sell or Share My Personal Information" link, usually in the header or footer. The CPPA says businesses may instead use "Your California Privacy Choices" or "Your Privacy Choices".
• No account needed: a business cannot require someone to create an account to opt out.
• Notice at collection: at or before the point of collection, you must list the categories of personal information you collect and why, and include the opt-out link if you sell or share.

The Attorney General and the CPPA enforce the CCPA.

What is Global Privacy Control, and do you have to honor it?

Global Privacy Control (GPC) is a browser setting or extension that tells each website a visitor's choice to opt out of the sale or sharing of their personal information. The California Attorney General says a user-enabled global privacy control must be honored by covered businesses as a valid consumer request to stop selling or sharing, and the CPPA's FAQ states that businesses must honor opt-out preference signals.

Technically, the GPC specification defines an HTTP request header, Sec-GPC, whose only valid value is 1, and a JavaScript property, navigator.globalPrivacyControl, that a page can read. A site can also publish a file at /.well-known/gpc.json to say it supports GPC.

In practice, when the signal is present, your site should switch off the advertising and cross-site tracking tags that amount to selling or sharing, for that browser, without asking the visitor to do anything else.

Which other states have similar rules?

Two examples, confirmed by their own regulators:

• Colorado: the Colorado Attorney General says the Colorado Privacy Act took effect on July 1, 2023, and gives consumers the right to opt out of the sale of their personal data and its use for targeted advertising or certain profiling. The Attorney General publishes a list of recognized universal opt-out mechanisms and describes Global Privacy Control as the state's first.
• Connecticut: the Connecticut Attorney General says that from January 1, 2025, all controllers subject to the Connecticut Data Privacy Act must honor opt-out preference signals such as GPC. The Act applies to businesses that meet thresholds such as controlling or processing the personal data of at least 35,000 consumers, or that sell personal data.

On September 9, 2025, the CPPA and the Attorneys General of California, Colorado and Connecticut announced a joint investigative sweep of businesses that may not be processing opt-out requests sent through GPC. Other states have privacy laws too, each with its own thresholds, so check the states where your customers live.

How does the FTC Act affect your privacy policy?

Even where no state privacy law applies, what you say about cookies and data matters. The FTC says it brings cases to make sure companies live up to the privacy promises they make to consumers. If your privacy policy says you do not share data with advertisers but your site loads advertising pixels, that gap is a risk. Keep the policy, your cookie settings and the tags that actually run in line, and update the policy when you add new tools.

When does a cookie banner make sense for a US website?

A consent banner is worth considering in these situations:

• You have UK or EU visitors. The EU's ePrivacy Directive allows storing or accessing information on a user's device only with consent, unless it is strictly necessary for a service the user requested. The UK Information Commissioner's Office (ICO) says PECR has no specific rules for organizations based outside the UK, but the UK GDPR may apply if you offer goods or services to people in the UK or monitor their behavior. If you sell to UK customers, see our guide to UK GDPR and cookie consent.
• You run advertising or retargeting tags. A banner or preference center is a clear place to explain them and to offer the opt-out that state laws require.

What do cookie consent banner examples look like?

Most banners on US sites follow one of three patterns:

• Notice with privacy choices: a short message that the site uses cookies, with links to the privacy policy and a "Your Privacy Choices" page where visitors can opt out of sale or sharing.
• Opt-out preference center: a panel with categories such as essential, analytics and advertising, where advertising is on by default but can be switched off, and is switched off automatically when GPC is detected.
• Opt-in banner for UK and EU visitors: shown by location, with "Accept" and "Reject" options of equal prominence and non-essential tags blocked until the visitor chooses.

What should your setup checklist include?

• List every tag: record each cookie, pixel and script, who sets it and why.
• Classify them: essential, analytics, functional and advertising, noting which send data to third parties.
• Decide which laws apply: check the state thresholds above and whether you have UK or EU visitors.
• Update your privacy policy and notice at collection: describe the data, the purposes and people's choices.
• Add the opt-out link: if you sell or share personal information, place it in the header or footer, and make the opt-out work without an account.
• Honor GPC: read the signal on the server or in the browser and block the relevant tags; test it with a GPC-enabled browser.
• Control tags centrally: use a consent tool or tag manager so choices actually stop the tags.
• Test and review: check which cookies load before and after each choice, and repeat when you add tools.

These details are easiest to get right while a site is being built or rebuilt. Our website development and US website development pages explain how we approach privacy features as part of a project.

Sources

• California Attorney General: California Consumer Privacy Act (CCPA)
• California Privacy Protection Agency: Frequently Asked Questions
• California Privacy Protection Agency: Joint investigative privacy sweep announcement, September 9, 2025
• Global Privacy Control: Take Control of Your Privacy
• W3C: Global Privacy Control (GPC) specification
• Colorado Attorney General: Colorado Privacy Act (CPA)
• Connecticut Attorney General: The Connecticut Data Privacy Act
• FTC: Privacy and Security Enforcement
• EUR-Lex: Directive 2002/58/EC on privacy and electronic communications
• ICO: What are the PECR rules?