State Privacy Laws In 2026: Your Cookie Banner Is Not The Problem

Why This Is Twenty Problems

The United States has no comprehensive federal privacy law. It has sector-specific federal rules covering health and financial data, and it has state legislation that has proliferated rapidly.

Reporting indicates roughly twenty active comprehensive state privacy laws as of 2026, with Indiana, Kentucky and Rhode Island taking effect on 1 January 2026 and Pennsylvania arriving mid-year. Every one has its own applicability thresholds, its own definitions of sensitive data, and its own enforcement model.

Two structural facts shape how to respond. Only California is described as granting a private right of action, and only for data breaches rather than general violations, so most enforcement runs through state attorneys general. And the variation is not cosmetic: one state requires opt-out where another requires opt-in, thresholds range widely, and obligations differ enough that a genuinely state-by-state compliance program is impractical for a small team.

Which points at the only workable approach for a national ecommerce brand, covered in section ten: build once to the strictest standard you are exposed to, rather than attempting to vary behavior by visitor location.

The Signal You Are Already Receiving

Global Privacy Control is a technical standard. When enabled, the browser sends a signal in the HTTP headers of every request indicating that the user opts out of sale or sharing of their personal information.

The detail that makes this urgent rather than theoretical is adoption. Firefox and Brave enable GPC by default, which means a portion of your traffic is transmitting the signal today. You do not need users to have sought this out. It arrives because of a browser default.

It is also worth understanding why this is not the old Do Not Track header, which failed. Do Not Track had no legal force, so sites ignored it without consequence. GPC has statutory recognition in a growing number of states, which converts an ignored preference into a violated right.

Which States Require It

The list is consistent across independent sources, which is unusual in this area and worth noting.

Reporting indicates that as of 1 January 2026, businesses subject to the relevant state laws must detect and honor GPC in twelve states: California, Colorado, Connecticut, Delaware, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, and Texas.

The trend line is the more useful information. That list is described as having more than doubled in two years, with every serious draft bill now including a universal opt-out clause. Treating GPC support as an edge case is planning for a version of the landscape that is receding.

Which produces a straightforward engineering conclusion. Detecting the signal and honoring it universally, for all traffic regardless of state, is simpler than geolocating visitors and applying different logic per jurisdiction, and it is more robust as the list grows.

You Are Probably In Scope

The comfortable assumption is that these laws target large companies. Thresholds are moving in the opposite direction.

Two things follow. First, thresholds trend lower over time rather than higher, so an assessment done two years ago may no longer hold. Second, and more important for ecommerce, selling or sharing personal data frequently lowers the bar considerably even where a volume threshold exists.

That second point catches brands out because of what counts as selling or sharing. It is broader than exchanging data for money, and the advertising practices in section five fall inside it under several state definitions. A brand below every volume threshold that shares data with advertising platforms may still be in scope.

Genuinely small single-state sellers may owe no obligation under any comprehensive state law, and that is a real category. Before assuming it describes you, check the states where you have meaningful traffic and check whether your advertising stack constitutes sharing.

Lookalike Audiences Are Sharing

Here is the exposure most ecommerce brands carry and have never examined, and it has nothing to do with your website.

A user opts out, through a banner or through GPC. Your site records the preference correctly. Then, separately, your marketing team exports a customer list, uploads it to an advertising platform, and builds a lookalike or modeled audience from it.

Transferring data to build lookalike audiences is described in reporting as counting as regulated sharing. If the exported list includes people who opted out, the opt-out was recorded and then ignored by a process running in a different system.

The framing that fixes this is treating universal opt-out as a data-flow obligation running from the browser signal through every downstream advertising system, rather than as a website checkbox. Concretely, that means opt-out status has to be a field that travels with the customer record and is applied before any export or sync.

The practical instruction is unglamorous: exclude opted-out users from modeled audiences before upload, and audit the full data map to find flows nobody remembered creating. Our guide to attribution tracking covers mapping those flows, which turns out to be a compliance exercise as well as a measurement one.

Proving You Honored It

A newer obligation that changes the standard from doing the right thing to demonstrating it.

Reporting indicates California now requires businesses to display a visible confirmation when a GPC signal is detected, such as a badge indicating the opt-out request was honored, with one source citing a specific regulatory provision effective 1 January 2026.

That is a meaningful shift. Previously you could honor a signal silently and the user had no way to know. Now the user, and by extension a regulator running a sweep, can observe from the outside whether your site responded.

It also makes non-compliance trivially detectable. An investigator can visit your site with GPC enabled and see immediately whether anything acknowledges it, which is a considerably lower-effort enforcement path than auditing your data flows.

The corresponding internal requirement is logging. If you cannot evidence that a specific signal was received and acted upon, you cannot demonstrate compliance after the fact. Make processing provable, test programmatically rather than by eye, and retain the records.

Sensitive Data And Opt-In

A category where the default flips from opt-out to opt-in, and where ecommerce brands often hold more than they realize.

Reporting indicates that in all states except California, Utah and Iowa, processing sensitive personal information requires opt-in consent, with Iowa requiring only clear notice and an opt-out. Maryland reportedly goes furthest and prohibits the sale of sensitive data outright, which makes consent irrelevant in that context.

What counts as sensitive varies and commonly includes health information, precise geolocation, biometric data, and other categories states are actively expanding. Ecommerce brands accumulate this without deliberate intent: a supplement retailer holds health-adjacent data, a store selling assistive products may hold health inferences, and location data collected for shipping or store-finder features can be precise.

The first task is classification rather than consent, though. You cannot apply the right rule to sensitive data until you know which of your fields qualify, and most brands have never inventoried that. Start there.

Data Minimization Is Arriving

A shift in principle that will matter more over time than any single technical requirement.

Maryland's law, described as taking effect in October 2025 and as among the strictest in the country, reportedly limits collection to what is reasonably necessary to provide the requested product or service. That is a data minimization standard closer to European law than to the American norm of collect-then-justify.

Minnesota is described as taking a comprehensive governance-focused approach including data inventory requirements and stricter retention rules limiting how long personal data may be kept.

The practical implication for ecommerce is that the default habit of collecting everything available because it might prove useful becomes a liability rather than an asset. A checkout form requesting information you have no operational use for is harder to defend under a reasonable-necessity standard.

The corresponding discipline is cheap and rarely done: for each field you collect, name the purpose. Fields without a purpose get removed. That reduces exposure, shortens forms, and generally improves conversion, which makes it one of the few compliance measures with a direct commercial upside.

What Enforcement Has Looked Like

Two reported matters give a sense of what regulators are actually pursuing, and both are settlements rather than judgments.

Failure to honor GPC. Reporting describes a $1.55 million settlement involving Healthline in July 2025, characterized as the largest CCPA settlement to date and centred partly on failure to honor GPC signals. Whatever the full circumstances, it establishes that the signal is being examined in enforcement.

Asymmetric opt-out flows. Reporting describes a 2025 Honda settlement as establishing that asymmetric opt-out flows are unlawful, with one source calling it an enforcement template for dark patterns. The underlying principle is familiar: if opting in takes one click and opting out takes six, the imbalance is itself the problem.

Coordinated enforcement sweeps are also reported to be running, which is a different threat model from individual complaints. A sweep visits many sites with a specific test, which pairs badly with the visible-confirmation requirement in section six, since it makes a large number of sites checkable in an afternoon.

Two caveats on reading these. Settlements are negotiated outcomes rather than rulings, so they indicate enforcement priorities rather than establishing law. And both involved larger companies than most readers of this article. The useful signal is what regulators are looking at, not the size of the numbers.

Building To One Standard

The strategic conclusion, and it is the same one that applies to most multi-jurisdiction compliance.

Attempting to vary behavior by visitor state is technically possible and a poor idea for a small team. It requires reliable geolocation, per-state rule logic, and maintenance every time any of twenty states amends anything. The failure modes are silent and the maintenance burden compounds.

Building once to the strictest applicable standard costs more in foregone data and less in everything else. Practically that means honoring GPC for all traffic regardless of state, requiring opt-in for sensitive data everywhere, collecting only what has a named purpose, propagating opt-outs to every downstream system, and providing rights requests to anyone who asks.

The commercial cost is real and worth naming. You will have a smaller addressable audience for retargeting, less complete conversion data, and modeled audiences built from fewer records. That is a genuine performance cost, not a rounding error.

What you get in exchange is one system rather than twenty, no re-engineering each time a state legislates, and no dependence on geolocation accuracy for legal compliance. For most brands that trade is worth making, and it becomes more clearly worth it as the number of states grows.

A Technical Checklist

Concrete steps, in order of how much exposure each one closes.

Step two is where implementations most often fail. A consent tool that records preferences in browser storage satisfies the website and does nothing for the export your marketing team runs next month, because the two systems never speak. Opt-out status has to live with the customer record to survive.

Step seven usually produces surprises. Most brands accumulate integrations over years, each added for a good reason by someone who has since moved on, and the resulting data map is genuinely unknown to anyone currently working there. Our web development team handles this kind of stack audit, and it is worth doing even setting compliance aside.

What This Costs You Commercially

An honest accounting, because compliance content usually pretends there is no trade-off and there plainly is.

Honoring universal opt-outs shrinks your retargeting pools, degrades conversion data feeding platform optimization, and reduces the seed lists behind modeled audiences. Advertising performance gets somewhat worse. Anyone telling you otherwise is selling something.

The strategic response is the one good brands were already moving toward. Data you collect directly, with clear consent, in exchange for something the customer values, is unaffected by any of this. Email and SMS subscribers who opted in knowingly remain reachable. Purchase history in your own systems remains yours to analyze.

What degrades is the layer built on inferred and shared data: third-party targeting, lookalike expansion, and cross-site tracking. That layer was already deteriorating for other reasons, and privacy law is accelerating a decline rather than initiating one.

Which makes the sensible investment obvious. Owned channels, direct relationships, and first-party data become more valuable as the alternatives become less usable. Our guides to customer lifetime value and owning your customer relationship cover that shift, and our email marketing work is the practical expression of it. We do sell that, so weigh the recommendation accordingly, though the direction holds regardless of who implements it.

The Minimum Version

If you do one thing, make it this: find every place customer data leaves your systems, and apply opt-out status as a filter before it goes. That single control closes the largest and least visible category of exposure, and it is invisible to the customer, so it costs you nothing in experience.

The banner you already have is not useless and it is not sufficient. It handles the visible half of a problem whose expensive half lives in exports and syncs that nobody has looked at in two years.