Is Cookie Consent Required in the USA? (State by State, 2026)
ConsentProof is a cookie consent checker that scans any website with a real browser and records which cookies and third-party trackers fire before the visitor consents.
A different shape of rule
There is no US federal equivalent of the ePrivacy rule, so the question is not 'did you get consent before setting this cookie' but 'did you honour an opt-out, and did you disclose the sale or sharing of personal information'.
That makes the compliance artefact different. In the EU the evidence is what happened before a click; in the US it is what happened after a signal, and whether the disclosures match the tags actually present.
Global Privacy Control is the mechanism to watch
From 1 January 2026 a substantial group of state laws requires businesses to honour an opt-out preference signal, in practice Global Privacy Control, including California, Colorado, Connecticut, Delaware, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon and Texas. Three more state laws — Indiana, Kentucky and Rhode Island — also took effect on that date.
Enforcement is live rather than theoretical: the California Privacy Protection Agency issued a record $1.35 million penalty against Tractor Supply on 30 September 2025.
What this means for an agency with US clients
The tag inventory is the same work. Whether the legal question is prior consent or honoured opt-out, you still need to know which third parties are on the page, who they are, and when they run.
Our scan produces that inventory. It does not currently test GPC signal handling; when it does, it will say so on this page rather than implying it now.
Frequently asked
- Do US websites need a cookie banner?
- Usually not an EU-style opt-in banner. Most state laws require disclosure plus an opt-out route, and a growing number require honouring the Global Privacy Control signal. Sites with EU or UK visitors still need the opt-in path for those visitors.
- Which states require honouring Global Privacy Control in 2026?
- As of 1 January 2026 the list includes California, Colorado, Connecticut, Delaware, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon and Texas. State laws keep arriving, so verify against a current tracker before advising a client.
- Does ConsentProof test Global Privacy Control?
- Not today. It records the cookies and third-party requests before and after consent. GPC and universal opt-out testing is on the roadmap, and this page will change when it ships rather than before.
Related
Try ConsentProof
Free public scan, no account needed.